Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
30-05-2024 13:04
Static task
static1
Behavioral task
behavioral1
Sample
6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe
-
Size
89KB
-
MD5
6e69ce42995c67a7d08e5beb171a0b60
-
SHA1
92ef26c42433f3360a00dfaddebb88f8d5f883ec
-
SHA256
79db5ee51b3e04f6d56b27a9305c39331e803e363994b0ab6ed64b0e1aa4701c
-
SHA512
1a1043d69c51a8c9408f57bde5017bf4a6cb14849a6a534d42b497a212f50c7358847bea8cccd7224fa5a3294f5f9ecd11f87186c80d0cf9174280bbf9d74ec0
-
SSDEEP
1536:71sMveb4lR0daHy9v7Zc86y9U4AFRfBWAEnn:BDeb4T0daHy9DZc86yGUtnn
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SPOOLSV.EXE -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe -
Executes dropped EXE 12 IoCs
pid Process 4804 SVCHOST.EXE 872 SVCHOST.EXE 2540 SVCHOST.EXE 2176 SVCHOST.EXE 3324 SVCHOST.EXE 1220 SPOOLSV.EXE 2868 SVCHOST.EXE 624 SVCHOST.EXE 5016 SPOOLSV.EXE 2116 SPOOLSV.EXE 3952 SVCHOST.EXE 2100 SPOOLSV.EXE -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Recycled\desktop.ini 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe File opened for modification F:\Recycled\desktop.ini 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\S: SPOOLSV.EXE File opened (read-only) \??\Q: 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\L: 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\Q: SPOOLSV.EXE File opened (read-only) \??\R: SPOOLSV.EXE File opened (read-only) \??\Y: SPOOLSV.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\O: 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe File opened (read-only) \??\V: 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe File opened (read-only) \??\L: SPOOLSV.EXE File opened (read-only) \??\W: SPOOLSV.EXE File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\S: 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\Z: 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\X: SPOOLSV.EXE File opened (read-only) \??\X: 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\O: SPOOLSV.EXE File opened (read-only) \??\R: 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\J: SPOOLSV.EXE File opened (read-only) \??\V: SPOOLSV.EXE File opened (read-only) \??\I: 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe File opened (read-only) \??\K: 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe File opened (read-only) \??\U: 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\E: SPOOLSV.EXE File opened (read-only) \??\N: 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe File opened (read-only) \??\T: 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe File opened (read-only) \??\U: SPOOLSV.EXE File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\N: SPOOLSV.EXE File opened (read-only) \??\W: 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe File opened (read-only) \??\Y: 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\H: SPOOLSV.EXE File opened (read-only) \??\G: 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe File opened (read-only) \??\M: 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe File opened (read-only) \??\Z: SPOOLSV.EXE File opened (read-only) \??\P: SPOOLSV.EXE File opened (read-only) \??\T: SPOOLSV.EXE File opened (read-only) \??\E: SVCHOST.EXE -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\Root\VFS\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\docicon.exe 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
Modifies registry class 30 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL\COMMAND 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\*\TileInfo = "prop:Type;Size" 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\*\QuickTip = "prop:Type;Size" 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SPOOLSV.EXE Key created \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\*\InfoTip = "prop:Type;Write;Size" 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\*\QuickTip = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Key created \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings Explorer.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG\COMMAND 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\*\TileInfo = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 1444 WINWORD.EXE 1444 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1220 SPOOLSV.EXE 1220 SPOOLSV.EXE 1220 SPOOLSV.EXE 1220 SPOOLSV.EXE 1220 SPOOLSV.EXE 1220 SPOOLSV.EXE 1220 SPOOLSV.EXE 1220 SPOOLSV.EXE 1220 SPOOLSV.EXE 1220 SPOOLSV.EXE 1220 SPOOLSV.EXE 1220 SPOOLSV.EXE 2540 SVCHOST.EXE 2540 SVCHOST.EXE 2540 SVCHOST.EXE 2540 SVCHOST.EXE 2540 SVCHOST.EXE 2540 SVCHOST.EXE 2540 SVCHOST.EXE 2540 SVCHOST.EXE 2540 SVCHOST.EXE 2540 SVCHOST.EXE 2540 SVCHOST.EXE 2540 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 2540 SVCHOST.EXE 2540 SVCHOST.EXE 2540 SVCHOST.EXE 2540 SVCHOST.EXE -
Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 4804 SVCHOST.EXE 872 SVCHOST.EXE 2540 SVCHOST.EXE 2176 SVCHOST.EXE 3324 SVCHOST.EXE 1220 SPOOLSV.EXE 2868 SVCHOST.EXE 624 SVCHOST.EXE 5016 SPOOLSV.EXE 2116 SPOOLSV.EXE 3952 SVCHOST.EXE 2100 SPOOLSV.EXE 1444 WINWORD.EXE 1444 WINWORD.EXE 1444 WINWORD.EXE 1444 WINWORD.EXE 1444 WINWORD.EXE 1444 WINWORD.EXE 1444 WINWORD.EXE -
Suspicious use of WriteProcessMemory 43 IoCs
description pid Process procid_target PID 4556 wrote to memory of 4804 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 81 PID 4556 wrote to memory of 4804 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 81 PID 4556 wrote to memory of 4804 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 81 PID 4804 wrote to memory of 872 4804 SVCHOST.EXE 83 PID 4804 wrote to memory of 872 4804 SVCHOST.EXE 83 PID 4804 wrote to memory of 872 4804 SVCHOST.EXE 83 PID 4804 wrote to memory of 2540 4804 SVCHOST.EXE 84 PID 4804 wrote to memory of 2540 4804 SVCHOST.EXE 84 PID 4804 wrote to memory of 2540 4804 SVCHOST.EXE 84 PID 2540 wrote to memory of 2176 2540 SVCHOST.EXE 85 PID 2540 wrote to memory of 2176 2540 SVCHOST.EXE 85 PID 2540 wrote to memory of 2176 2540 SVCHOST.EXE 85 PID 2540 wrote to memory of 3324 2540 SVCHOST.EXE 86 PID 2540 wrote to memory of 3324 2540 SVCHOST.EXE 86 PID 2540 wrote to memory of 3324 2540 SVCHOST.EXE 86 PID 2540 wrote to memory of 1220 2540 SVCHOST.EXE 87 PID 2540 wrote to memory of 1220 2540 SVCHOST.EXE 87 PID 2540 wrote to memory of 1220 2540 SVCHOST.EXE 87 PID 1220 wrote to memory of 2868 1220 SPOOLSV.EXE 88 PID 1220 wrote to memory of 2868 1220 SPOOLSV.EXE 88 PID 1220 wrote to memory of 2868 1220 SPOOLSV.EXE 88 PID 1220 wrote to memory of 624 1220 SPOOLSV.EXE 89 PID 1220 wrote to memory of 624 1220 SPOOLSV.EXE 89 PID 1220 wrote to memory of 624 1220 SPOOLSV.EXE 89 PID 1220 wrote to memory of 5016 1220 SPOOLSV.EXE 90 PID 1220 wrote to memory of 5016 1220 SPOOLSV.EXE 90 PID 1220 wrote to memory of 5016 1220 SPOOLSV.EXE 90 PID 4804 wrote to memory of 2116 4804 SVCHOST.EXE 91 PID 4804 wrote to memory of 2116 4804 SVCHOST.EXE 91 PID 4804 wrote to memory of 2116 4804 SVCHOST.EXE 91 PID 4556 wrote to memory of 3952 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 93 PID 4556 wrote to memory of 3952 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 93 PID 4556 wrote to memory of 3952 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 93 PID 4556 wrote to memory of 2100 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 94 PID 4556 wrote to memory of 2100 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 94 PID 4556 wrote to memory of 2100 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 94 PID 4804 wrote to memory of 3964 4804 SVCHOST.EXE 95 PID 4804 wrote to memory of 3964 4804 SVCHOST.EXE 95 PID 4804 wrote to memory of 3964 4804 SVCHOST.EXE 95 PID 3964 wrote to memory of 2704 3964 userinit.exe 96 PID 3964 wrote to memory of 2704 3964 userinit.exe 96 PID 4556 wrote to memory of 1444 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 97 PID 4556 wrote to memory of 1444 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:872
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2176
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3324
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2868
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:624
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5016
-
-
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2116
-
-
C:\Windows\SysWOW64\userinit.exeC:\Windows\system32\userinit.exe3⤵
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE4⤵
- Modifies registry class
PID:2704
-
-
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3952
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2100
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.doc" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1444
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
89KB
MD5dea7ac0928d76fe25df0d233cf9cfd42
SHA1d3dac7241dea3925948649c43b62d55eee1e32d5
SHA2564e198d138f28edd805a7d2e24636bce42b8c4e8b51013cdf89458b33d83b78bf
SHA5123b43e6f6e304cda82824a4a11937e583d0fa2f9567a000ebd753b66fe6d1198fb2f65c928c22aa6571d8653036260a7dd15193c6cf08498a98d73f0c69dcc8d3
-
Filesize
89KB
MD56c9c9f12535612eed119b5f8ed137457
SHA1d061c21b9411e3816fdf85387e4e05b62a278514
SHA256bc1e863bde6f68e3611b74b76fea33ba81e988e0f13b040c223c6a89872ee258
SHA512c161a2c17de9e25441cb87939be5319ed54d022307f883038c688f0629504f611c3921c51bcf14a34836819542b22d277fd12ff8b02cf6d9188ddef778775a84
-
Filesize
1KB
MD50269b6347e473980c5378044ac67aa1f
SHA1c3334de50e320ad8bce8398acff95c363d039245
SHA25668f5bd85c17975419bb4eacf615286d749bcb951e487813361837580b39ffee2
SHA512e5c525fe688ecd3926ae634a61dc48c4837d7e56aae00b22e4f7d824df804cb536f6df077d5f6c67f63f73832ba00249ed3a75ed40ec9db6e026041b28404d7b
-
Filesize
245KB
MD5f883b260a8d67082ea895c14bf56dd56
SHA17954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
-
Filesize
2B
MD52b9d4fa85c8e82132bde46b143040142
SHA1a02431cf7c501a5b368c91e41283419d8fa9fb03
SHA2564658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
SHA512c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
-
Filesize
89KB
MD5ebeaa8657231c2d1786e4f38c15948e3
SHA1097713cb6b55521ea5294f85adacfb84dc0afb84
SHA2564c0e6bccea1b5b62dbd2fc88926496bdb61dfac85029393aa9c1db58279c04d4
SHA512129662542de922b3c9a67ff1fb305a73f0d76467c9e24fb8d8f005d2299996e8c3648455bcb9cf54c0f23929de62454169418959c182d5d8316dcb13621123d5