Analysis
- max time kernel
149s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 12:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe
- Size 97KB
- Sample240603-px776agb87
- SHA256 b0cc5e932346fbb1dfbc5542c0b3484acb06ffff3b77d3003b7cfada4107fa9c
- MD5 a3d8ae35aa255d4d1dca74eabccf8850
- SHA1 4e3f1d928b78b87f50728ef6dc3171b8e36e5ade
- SHA512 b117a57f8804112aca8d4ab0a2587666184604cc44a12c46e852c88f88643074eb59c937cbeecae5f81e5b4d5061d83de4592b59fe50bec7ecdce7b717c06352
- SSDEEP 1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoI6:J8dfX7y9DZ+N7eB+tI6
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE - Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SPOOLSV.EXE - Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe - Executes dropped EXE 12 IoCs
pid Process 4828 SVCHOST.EXE 5108 SVCHOST.EXE 2728 SVCHOST.EXE 1144 SVCHOST.EXE 2192 SVCHOST.EXE 4964 SPOOLSV.EXE 1036 SVCHOST.EXE 5044 SVCHOST.EXE 4408 SPOOLSV.EXE 396 SPOOLSV.EXE 5076 SVCHOST.EXE 4388 SPOOLSV.EXE - Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Recycled\desktop.ini a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe File opened for modification F:\Recycled\desktop.ini a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\T: SPOOLSV.EXE File opened (read-only) \??\X: a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe File opened (read-only) \??\K: SPOOLSV.EXE File opened (read-only) \??\S: SPOOLSV.EXE File opened (read-only) \??\W: SPOOLSV.EXE File opened (read-only) \??\O: SPOOLSV.EXE File opened (read-only) \??\S: a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\G: SPOOLSV.EXE File opened (read-only) \??\P: SPOOLSV.EXE File opened (read-only) \??\Q: SPOOLSV.EXE File opened (read-only) \??\E: a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe File opened (read-only) \??\R: a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe File opened (read-only) \??\W: a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe File opened (read-only) \??\Z: a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\I: SPOOLSV.EXE File opened (read-only) \??\U: a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\X: SPOOLSV.EXE File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\M: SPOOLSV.EXE File opened (read-only) \??\R: SPOOLSV.EXE File opened (read-only) \??\M: a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\H: a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\N: SPOOLSV.EXE File opened (read-only) \??\I: a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\U: SPOOLSV.EXE File opened (read-only) \??\E: SPOOLSV.EXE File opened (read-only) \??\O: a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\J: SPOOLSV.EXE File opened (read-only) \??\K: a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\Root\VFS\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\docicon.exe a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Fonts\ Explorer.exe SVCHOST.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe SPOOLSV.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe File opened for modification C:\Windows\Fonts\ Explorer.exe SVCHOST.EXE - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 29 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL\COMMAND a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\*\TileInfo = "prop:Type;Size" SPOOLSV.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\*\TileInfo = "prop:Type;Size" a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\*\InfoTip = "prop:Type;Write;Size" a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\*\QuickTip = "prop:Type;Size" SPOOLSV.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG\COMMAND a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\*\QuickTip = "prop:Type;Size" a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SPOOLSV.EXE - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3840 WINWORD.EXE 3840 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4828 SVCHOST.EXE 4828 SVCHOST.EXE 4828 SVCHOST.EXE 4828 SVCHOST.EXE 4828 SVCHOST.EXE 4828 SVCHOST.EXE 4828 SVCHOST.EXE 4828 SVCHOST.EXE 4828 SVCHOST.EXE 4828 SVCHOST.EXE 4828 SVCHOST.EXE 4828 SVCHOST.EXE 5008 a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe 5008 a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe 2728 SVCHOST.EXE 2728 SVCHOST.EXE 5008 a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe 5008 a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe 2728 SVCHOST.EXE 2728 SVCHOST.EXE 5008 a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe 5008 a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe 2728 SVCHOST.EXE 5008 a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe 2728 SVCHOST.EXE 5008 a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe 2728 SVCHOST.EXE 2728 SVCHOST.EXE 5008 a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe 5008 a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe 2728 SVCHOST.EXE 2728 SVCHOST.EXE 5008 a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe 5008 a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe 2728 SVCHOST.EXE 2728 SVCHOST.EXE 4964 SPOOLSV.EXE 4964 SPOOLSV.EXE 4964 SPOOLSV.EXE 4964 SPOOLSV.EXE 4964 SPOOLSV.EXE 4964 SPOOLSV.EXE 4964 SPOOLSV.EXE 4964 SPOOLSV.EXE 4964 SPOOLSV.EXE 4964 SPOOLSV.EXE 4964 SPOOLSV.EXE 4964 SPOOLSV.EXE 4828 SVCHOST.EXE 4828 SVCHOST.EXE 4828 SVCHOST.EXE 4828 SVCHOST.EXE 4828 SVCHOST.EXE 4828 SVCHOST.EXE 4828 SVCHOST.EXE 4828 SVCHOST.EXE 4828 SVCHOST.EXE 4828 SVCHOST.EXE 4828 SVCHOST.EXE 4828 SVCHOST.EXE 2728 SVCHOST.EXE 2728 SVCHOST.EXE 2728 SVCHOST.EXE 2728 SVCHOST.EXE - Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 5008 a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe 4828 SVCHOST.EXE 5108 SVCHOST.EXE 2728 SVCHOST.EXE 1144 SVCHOST.EXE 2192 SVCHOST.EXE 4964 SPOOLSV.EXE 1036 SVCHOST.EXE 5044 SVCHOST.EXE 4408 SPOOLSV.EXE 396 SPOOLSV.EXE 5076 SVCHOST.EXE 4388 SPOOLSV.EXE 3840 WINWORD.EXE 3840 WINWORD.EXE 3840 WINWORD.EXE 3840 WINWORD.EXE 3840 WINWORD.EXE 3840 WINWORD.EXE 3840 WINWORD.EXE - Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 5008 wrote to memory of 4828 5008 a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe 84 PID 5008 wrote to memory of 4828 5008 a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe 84 PID 5008 wrote to memory of 4828 5008 a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe 84 PID 4828 wrote to memory of 5108 4828 SVCHOST.EXE 85 PID 4828 wrote to memory of 5108 4828 SVCHOST.EXE 85 PID 4828 wrote to memory of 5108 4828 SVCHOST.EXE 85 PID 4828 wrote to memory of 2728 4828 SVCHOST.EXE 86 PID 4828 wrote to memory of 2728 4828 SVCHOST.EXE 86 PID 4828 wrote to memory of 2728 4828 SVCHOST.EXE 86 PID 2728 wrote to memory of 1144 2728 SVCHOST.EXE 87 PID 2728 wrote to memory of 1144 2728 SVCHOST.EXE 87 PID 2728 wrote to memory of 1144 2728 SVCHOST.EXE 87 PID 2728 wrote to memory of 2192 2728 SVCHOST.EXE 88 PID 2728 wrote to memory of 2192 2728 SVCHOST.EXE 88 PID 2728 wrote to memory of 2192 2728 SVCHOST.EXE 88 PID 2728 wrote to memory of 4964 2728 SVCHOST.EXE 89 PID 2728 wrote to memory of 4964 2728 SVCHOST.EXE 89 PID 2728 wrote to memory of 4964 2728 SVCHOST.EXE 89 PID 4964 wrote to memory of 1036 4964 SPOOLSV.EXE 90 PID 4964 wrote to memory of 1036 4964 SPOOLSV.EXE 90 PID 4964 wrote to memory of 1036 4964 SPOOLSV.EXE 90 PID 4964 wrote to memory of 5044 4964 SPOOLSV.EXE 91 PID 4964 wrote to memory of 5044 4964 SPOOLSV.EXE 91 PID 4964 wrote to memory of 5044 4964 SPOOLSV.EXE 91 PID 4964 wrote to memory of 4408 4964 SPOOLSV.EXE 92 PID 4964 wrote to memory of 4408 4964 SPOOLSV.EXE 92 PID 4964 wrote to memory of 4408 4964 SPOOLSV.EXE 92 PID 4828 wrote to memory of 396 4828 SVCHOST.EXE 93 PID 4828 wrote to memory of 396 4828 SVCHOST.EXE 93 PID 4828 wrote to memory of 396 4828 SVCHOST.EXE 93 PID 5008 wrote to memory of 5076 5008 a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe 94 PID 5008 wrote to memory of 5076 5008 a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe 94 PID 5008 wrote to memory of 5076 5008 a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe 94 PID 5008 wrote to memory of 4388 5008 a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe 96 PID 5008 wrote to memory of 4388 5008 a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe 96 PID 5008 wrote to memory of 4388 5008 a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe 96 PID 5008 wrote to memory of 3840 5008 a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe 98 PID 5008 wrote to memory of 3840 5008 a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5108
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1144
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2192
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1036
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5044
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4408
-
-
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:396
-
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5076
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4388
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\a3d8ae35aa255d4d1dca74eabccf8850_NeikiAnalytics.doc" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3840
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Recycled\SPOOLSV.EXE
- Size 97KB
- SHA256 5a1666cc87eee2c7a1a3bb8d7189c68c97d28976624ae952e9d04aad325a2b0a
- MD5 e933cec34e1270e3619ae4e7bc7958d9
- SHA1 017f6c5c16076e9342b42eb8e2a7130263e97f50
- SHA512 879624a073c4a4d7b36fe867c3734cc5324d47f8d64a6820961d8ac7d6ec7b5aa85d394383115980d0024ad601738ddafa4acd04934f9b67a6a6d6c99ef46736
- SSDEEP 1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoI3:J8dfX7y9DZ+N7eB+tI3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Recycled\SVCHOST.EXE
- Size 97KB
- SHA256 7930350a580ee10b2e270f0265153a7bd4d86e799a317b30d39fed9dcb341888
- MD5 6cb678763467683c4f8314d6b8ade43e
- SHA1 383800041539e68e966e6d4ff657670529ed29cf
- SHA512 0237652d3c0857d255b62197abdbf846bc22cd21d6ca690728cd2f13f1bccffc8d3ea33afd703f277c664aa4856b0b848725d07b9e3db20f480a5a0a998c7f17
- SSDEEP 1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoIY:J8dfX7y9DZ+N7eB+tIY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Flu Burung.txt
- Size 2KB
- SHA256 2661c05273f33efa4b7faa6ed8a6f7e69a13ad86077f69ee285ece9cba57e44c
- MD5 1a1dce35d60d2c70ca8894954fd5d384
- SHA1 58547dd65d506c892290755010d0232da34ee000
- SHA512 4abe37613145fabeb44ea4c28ecc827c8a0eb2b003e86ae7aef9be5687711fa7a294f17567ea0a70a6f14ab3cbe7886c83763a7c49278097fd53f0d11fd8154e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\TCD9DDE.tmp\sist02.xsl
- Size 245KB
- SHA256 ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
- MD5 f883b260a8d67082ea895c14bf56dd56
- SHA1 7954565c1f243d46ad3b1e2f1baf3281451fc14b
- SHA512 d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
- SSDEEP 6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\ Explorer.exe
- Size 97KB
- SHA256 798d79b2ee7226f706aa4a9adbafadf19700d545c35cfb2cb0682a995895f3eb
- MD5 1abc6935d61cb40589d7ac22301820c7
- SHA1 4f5cd3bf2c9eb0fe6c426a3dfe4b942cbbb80ca9
- SHA512 93aa62777bfaf64b34fdefb10ab71a0093c55d4b82bd60a1ed8ac6d3f90cdd78f573ffe2c57aed5500212b4e7af8e5339d9dae130f324ee05a7b653c5c0cb2b6
- SSDEEP 1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoIL:J8dfX7y9DZ+N7eB+tIL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\ Explorer.exe
- Size 97KB
- SHA256 6d7456c4be4f5ebfa4715c4b27169e9e9fab333c7e5b9a910798410de12a2af5
- MD5 2a589b0b9399145f4d1a83eee590d939
- SHA1 34d311fd864b57500efd1ae62f12707e060cf170
- SHA512 8ddf7dff5a990660f8d7ebc6bf52b881382942710a568e6a833b83d00936181c6fe3e63bc1916de1e87b1351ee34265c370b0fbfdedcc27e51ed5ecd73718ba1
- SSDEEP 1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoIv:J8dfX7y9DZ+N7eB+tIv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\ Explorer.exe
- Size 97KB
- SHA256 91ed3b6732e764894b18a4842f8e74b5a469723988c53750d2e911b3d70466b3
- MD5 55deaf8c45eaff45deda5f3d841b3a9c
- SHA1 5db795538b100570744b24faf7e0561807fd5879
- SHA512 4d45ec8c9f308c0f5f4896dfad3d8456b0d9394bc2aa307fbc24349f0ff9be80af9857cfe75b4697411c8eff912146017906e8fc9276f35673a4954320a67a3a
- SSDEEP 1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoIH:J8dfX7y9DZ+N7eB+tIH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\begolu.txt
- Size 2B
- SHA256 4658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
- MD5 2b9d4fa85c8e82132bde46b143040142
- SHA1 a02431cf7c501a5b368c91e41283419d8fa9fb03
- SHA512 c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
- MD5 SHA1 SHA512
- Path F:\Recycled\SVCHOST.EXE
- Size 97KB
- SHA256 e8dbc174e715deaa199d3ff1ad4933cb4b284d975a27578a6e4f647600699273
- MD5 ecdf2657dcae62b67063df9059c0415a
- SHA1 f69cd0d5fa6d408ead16176c9f75e27b9d1464e4
- SHA512 b61d5992a42cce33c4de4b6a059a1242f36a7ae92a819f142d675e6e97a957b6458405b7a3a2198a53e519e51f02e3c2a7fb1cd6f9167c56d284ef386ec2b2f2
- SSDEEP 1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoIz:J8dfX7y9DZ+N7eB+tIz
- MD5 SHA1 SHA512 SSDEEP