cb3adeaee03768c5f785a46500f067efc4760f61b560cd07cf349ba4de1559cb

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe

Windows security bypass 2 TTPs 2 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe = "0"	37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1692	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe

Windows security modification 2 TTPs 3 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe = "0"	37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 4920 set thread context of 4936	4920	37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe	102
PID 4936 set thread context of 3464	4936	ngen.exe	56
PID 4936 set thread context of 2972	4936	ngen.exe	112
PID 2972 set thread context of 3464	2972	mtstocom.exe	56
PID 2972 set thread context of 5112	2972	mtstocom.exe	122

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\Registry\User\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	mtstocom.exe

Runs regedit.exe 1 IoCs

pid	Process
5044	regedit.exe

Suspicious behavior: EnumeratesProcesses 63 IoCs

pid	Process
1692	powershell.exe
1692	powershell.exe
1692	powershell.exe
4936	ngen.exe
4936	ngen.exe
4936	ngen.exe
4936	ngen.exe
4936	ngen.exe
4936	ngen.exe
4936	ngen.exe
4936	ngen.exe
4936	ngen.exe
4936	ngen.exe
4936	ngen.exe
4936	ngen.exe
4936	ngen.exe
4936	ngen.exe
4936	ngen.exe
4936	ngen.exe
4936	ngen.exe
4936	ngen.exe
2972	mtstocom.exe
2972	mtstocom.exe
2972	mtstocom.exe
2972	mtstocom.exe
2972	mtstocom.exe
2972	mtstocom.exe
2972	mtstocom.exe
2972	mtstocom.exe
2972	mtstocom.exe
2972	mtstocom.exe
2972	mtstocom.exe
2972	mtstocom.exe
2972	mtstocom.exe
2972	mtstocom.exe
2972	mtstocom.exe
2972	mtstocom.exe
2972	mtstocom.exe
2972	mtstocom.exe
2972	mtstocom.exe
2972	mtstocom.exe
2972	mtstocom.exe
2972	mtstocom.exe
2972	mtstocom.exe
2972	mtstocom.exe
2972	mtstocom.exe
2972	mtstocom.exe
2972	mtstocom.exe
2972	mtstocom.exe
2972	mtstocom.exe
2972	mtstocom.exe
2972	mtstocom.exe
2972	mtstocom.exe
2972	mtstocom.exe
2972	mtstocom.exe
2972	mtstocom.exe
2972	mtstocom.exe
2972	mtstocom.exe
2972	mtstocom.exe
2972	mtstocom.exe
2972	mtstocom.exe
2972	mtstocom.exe
2972	mtstocom.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
4936	ngen.exe
3464	Explorer.EXE
3464	Explorer.EXE
2972	mtstocom.exe
2972	mtstocom.exe
2972	mtstocom.exe
2972	mtstocom.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4920	37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe
Token: SeDebugPrivilege	1692	powershell.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3464	Explorer.EXE

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 1692	4920	37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe	99
PID 4920 wrote to memory of 1692	4920	37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe	99
PID 4920 wrote to memory of 5044	4920	37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe	100
PID 4920 wrote to memory of 5044	4920	37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe	100
PID 4920 wrote to memory of 5044	4920	37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe	100
PID 4920 wrote to memory of 5044	4920	37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe	100
PID 4920 wrote to memory of 4936	4920	37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe	102
PID 4920 wrote to memory of 4936	4920	37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe	102
PID 4920 wrote to memory of 4936	4920	37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe	102
PID 4920 wrote to memory of 4936	4920	37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe	102
PID 4920 wrote to memory of 4936	4920	37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe	102
PID 4920 wrote to memory of 4936	4920	37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe	102
PID 4920 wrote to memory of 1152	4920	37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe	103
PID 4920 wrote to memory of 1152	4920	37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe	103
PID 4920 wrote to memory of 1152	4920	37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe	103
PID 3464 wrote to memory of 2972	3464	Explorer.EXE	112
PID 3464 wrote to memory of 2972	3464	Explorer.EXE	112
PID 3464 wrote to memory of 2972	3464	Explorer.EXE	112
PID 2972 wrote to memory of 5112	2972	mtstocom.exe	122
PID 2972 wrote to memory of 5112	2972	mtstocom.exe	122

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Users\Admin\AppData\Local\Temp\37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe"
  2⤵
  - UAC bypass
  - Windows security bypass
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Checks BIOS information in registry
  - Checks computer location settings
  - Windows security modification
  - Checks whether UAC is enabled
  - Maps connected drives based on registry
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4920
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe" -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1692
- - C:\Windows\regedit.exe
    "C:\Windows\regedit.exe"
    3⤵
    - Runs regedit.exe
    PID:5044
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:4936
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
    3⤵
    PID:1152
- C:\Windows\SysWOW64\mtstocom.exe
  "C:\Windows\SysWOW64\mtstocom.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:5112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion