Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
05/06/2024, 03:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
4 signatures
150 seconds
General
-
Target
34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe
-
Size
92KB
-
MD5
34e9608e68304e1cf3fa471922e1b3d0
-
SHA1
47713f49f00d1e178a462f112b0fb858fbc3ade5
-
SHA256
0c1f1d80bc526ec24a543b433219036eb456b0390fcf53114121e210d7fd4ff8
-
SHA512
0e3ecd9f8eb751fb3f4b7ce51536b4dd98a689b3038e752b6a9c0083e218e394c44882624e6b35a86c4958d7ba1c566d87b156fb5f92464a34ce61810d07c9f8
-
SSDEEP
1536:JJvJnBpwdaMIOOnToIfiV6pdQcTUgamo7Zo:JJvxKaCqTBfiooXg7o7Z
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\CHOICE.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\MSDT.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\REKEYWIZ.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\WINRS.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\RRINSTALLER.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\SYNCHOST.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\CLEANMGR.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\DIALER.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\EXPAND.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\FC.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\NETBTUGC.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\PSR.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\TASKKILL.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\WERFAULT.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\WSCRIPT.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\CONVERT.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\FONDUE.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\FORFILES.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\PICKERHOST.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\TCMSETUP.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\W32TM.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMETC\IMTCLNWZ.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\PERFMON.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\SC.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\WBEM\WINMGMT.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\DISM.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\FINGER.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\HH.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\IME\SHARED\IMESEARCH.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\NTPRINT.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\VERCLSID.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\REAGENTC.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\WIAACMGR.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\DTDUMP.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\EUDCEDIT.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\LOGAGENT.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\SEARCHPROTOCOLHOST.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\TYPEPERF.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\USER.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\CHARMAP.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\EVENTVWR.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\PRINT.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\EFSUI.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\GAMEBARPRESENCEWRITER.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\RELOG.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\TAPIUNATTEND.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\DPAPIMIG.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\ISOBURN.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\PASSWORDONWAKESETTINGFLYOUT.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\PING.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\POWERCFG.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMUWPLAUNCHER.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\CMSTP.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\MMGASERVER.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\SETUPUGC.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMPROPERTIESPERFORMANCE.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\TASKMGR.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\IME\SHARED\IMEWDBLD.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\INFDEFAULTINSTALL.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\TSWPFWRP.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\DLLHOST.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\SPATIALAUDIOLICENSESRV.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\COMPUTERDEFAULTS.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\FSQUIRT.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\IDLJ.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\PPTICO.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\JAVA\JAVA UPDATE\JUCHECK.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSOEV.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.SCREENSKETCH_10.1907.2471.0_X64__8WEKYB3D8BBWE\SCREENSKETCH.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.WINDOWSALARMS_10.1906.2182.0_X64__8WEKYB3D8BBWE\TIME.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\APPVSHNOTIFY.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_BK\INSTALL\{261BF71B-BFBE-4658-B4A6-F4D9642FE2F8}\MICROSOFTEDGEUPDATESETUP_X86_1.3.185.29.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.WALLET_2.4.18324.0_X64__8WEKYB3D8BBWE\MICROSOFT.WALLET.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.WEBPIMAGEEXTENSION_1.0.22753.0_X64__8WEKYB3D8BBWE\CODECPACKS.WEBP.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\INK\INPUTPERSONALIZATION.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\VPREVIEW.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\OSMCLIENTICON.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMLAUNCH.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\JOTICON.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\DISABLEDGOOGLEUPDATE.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_BK\1.3.185.29\MICROSOFTEDGEUPDATECORE.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESX64\MICROSOFT ANALYSIS SERVICES\AS OLEDB\140\SQLDUMPER.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.WINDOWSSOUNDRECORDER_10.1906.1972.0_X64__8WEKYB3D8BBWE\SOUNDREC.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MAIL\WAB.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\7-ZIP\UNINSTALL.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\INTEGRATION\ADDONS\ONEDRIVESETUP.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSOHTMED.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESX86\MICROSOFT ANALYSIS SERVICES\AS OLEDB\140\SQLDUMPER.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.ZUNEMUSIC_10.19071.19011.0_X64__8WEKYB3D8BBWE\MUSIC.UI.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPNSCFG.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.MICROSOFTSOLITAIRECOLLECTION_4.4.8204.0_X64__8WEKYB3D8BBWE\MICROSOFT.MICROSOFTSOLITAIRECOLLECTION.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\INK\PIPANEL.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES (X86)\INTERNET EXPLORER\IEXPLORE.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\92.0.902.67\COOKIE_EXPORTER.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OFFICECLICKTORUN.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JAVADOC.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\JAVA-RMI.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES (X86)\MOZILLA MAINTENANCE SERVICE\UNINSTALL.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\ADDINS\MICROSOFT POWER QUERY FOR EXCEL INTEGRATED\BIN\MICROSOFT.MASHUP.CONTAINER.NETFX45.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.BINGWEATHER_4.25.20211.0_X64__8WEKYB3D8BBWE\MICROSOFT.MSN.WEATHER.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.DESKTOPAPPINSTALLER_1.0.30251.0_X64__8WEKYB3D8BBWE\APPINSTALLERELEVATEDAPPSERVICECLIENT.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.MIXEDREALITY.PORTAL_2000.19081.1301.0_X64__8WEKYB3D8BBWE\MIXEDREALITYPORTAL.BROKERED.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\JAVA\JAVA UPDATE\JAUREG.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\DOTNET\DOTNET.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\KINIT.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\SERVERTOOL.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JSTACK.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JSTATD.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\JAVA\JAVA UPDATE\JUSCHED.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSOTD.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ADOBE\ARM\1.0\ADOBEARMHELPER.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.36.151\GOOGLEUPDATESETUP.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_BK\1.3.185.29\MICROSOFTEDGEUPDATECOMREGISTERSHELL64.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7Z.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\JAVA.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\CLIENT\APPVLP.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\DBCICONS.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.MICROSOFT3DVIEWER_6.1908.2042.0_X64__8WEKYB3D8BBWE\VIEW3D.RESOURCERESOLVER.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\92.0.902.67\MSEDGE_PWA_LAUNCHER.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\DOTNET\SHARED\MICROSOFT.NETCORE.APP\8.0.2\CREATEDUMP.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\CHROME.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JHAT.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\EULA.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\READER_SL.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ORACLE\JAVA\JAVAPATH\JAVAW.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_BK\1.3.185.29\MICROSOFTEDGECOMREGISTERSHELLARM64.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\TNAMESERV.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\UPDATER.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\ASPNET_WP.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\SMSVCHOST.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\ASPNET_REGIIS.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.APPREP.CHXAPP_CW5N1H2TXYEWY\CHXSMARTSCREEN.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\ILASM.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\ADDINUTIL.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.0\WINDOWS COMMUNICATION FOUNDATION\SERVICEMODELREG.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSBUILD.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.ASSIGNEDACCESSLOCKAPP_CW5N1H2TXYEWY\ASSIGNEDACCESSLOCKAPP.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_ADDINPROCESS_B77A5C561934E089_4.0.15805.0_NONE_74BABA51266F3010\ADDINPROCESS.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_HYPERV-COMPUTE-HOST-SERVICE_31BF3856AD364E35_10.0.19041.1288_NONE_6C70124C60E2B4EF\VMCOMPUTE.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\INSTALLER\$PATCHCACHE$\MANAGED\68AB67CA7DA73301B744CAF070E41400\15.7.20033\WOW_HELPER.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\NGEN.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\JSC.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.5\ADDINPROCESS32.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\NETFXSBS10.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINHLP32.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_ASPNET_REGSQL_B03F5F7F11D50A3A_10.0.19041.1_NONE_C9157DDC38B83B1B\ASPNET_REGSQL.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_CASPOL_B03F5F7F11D50A3A_10.0.19041.1_NONE_E51212A36C631D23\CASPOL.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\ASSEMBLY\GAC_32\MSBUILD\V4.0_4.0.0.0__B03F5F7F11D50A3A\MSBUILD.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\REGASM.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.PEOPLEEXPERIENCEHOST_CW5N1H2TXYEWY\PEOPLEEXPERIENCEHOST.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\SHELLEXPERIENCEHOST_CW5N1H2TXYEWY\SHELLEXPERIENCEHOST.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NGEN.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\ASPNET_WP.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.FILEPICKER_CW5N1H2TXYEWY\FILEPICKER.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.SECUREASSESSMENTBROWSER_CW5N1H2TXYEWY\SECUREASSESSMENTBROWSER.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\HH.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SMSVCHOST\V4.0_4.0.0.0__B03F5F7F11D50A3A\SMSVCHOST.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CVTRES.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\EDMGEN.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\ASPNET_REGSQL.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\REGASM.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_DATASVCUTIL_B77A5C561934E089_4.0.15805.0_NONE_5B1ADA239E3B0505\DATASVCUTIL.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\INSTALLER\$PATCHCACHE$\MANAGED\68AB67CA7DA73301B744CAF070E41400\15.7.20033\READER_SL.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.0\WINDOWS COMMUNICATION FOUNDATION\SMSVCHOST.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_DFSVC_B03F5F7F11D50A3A_4.0.15805.0_NONE_C0D2D1227427864F\DFSVC.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_HYPERV-COMPUTE-CONT..UTIONSERVICE-SHARED_31BF3856AD364E35_10.0.19041.1_NONE_0BC0F3D4CD7DC8FD\CEXECSVC.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.XGPUEJECTDIALOG_CW5N1H2TXYEWY\XGPUEJECTDIALOG.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_HYPERV-COMMANDLINE-TOOL_31BF3856AD364E35_10.0.19041.928_NONE_0B17415AE0DD0379\F\HVC.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\ASSEMBLY\GAC_MSIL\SMSVCHOST\3.0.0.0__B03F5F7F11D50A3A\SMSVCHOST.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CASPOL.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.0\WINDOWS COMMUNICATION FOUNDATION\SMSVCHOST.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\DATASVCUTIL.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\ASPNET_REGIIS.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\REGASM.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.PINNINGCONFIRMATIONDIALOG_CW5N1H2TXYEWY\PINNINGCONFIRMATIONDIALOG.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.0\WINDOWS COMMUNICATION FOUNDATION\SERVICEMODELREG.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\ASPNET_REGSQL.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\DFSVC.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\LDR64.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\INSTALLER\$PATCHCACHE$\MANAGED\68AB67CA7DA73301B744CAF070E41400\15.7.20033\RDRSERVICESUPDATER.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CSC.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WSATCONFIG.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFTWINDOWS.UNDOCKEDDEVKIT_CW5N1H2TXYEWY\UNDOCKEDDEVKIT.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\COMSVCCONFIG.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_HYPERV-COMMANDLINE-TOOL_31BF3856AD364E35_10.0.19041.1_NONE_E2F75FDA217D5015\HVC.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_HYPERV-COMPUTE-CONTAINERDIAGNOSTICSTOOL_31BF3856AD364E35_10.0.19041.928_NONE_6571FF6E96271A64\HCSDIAG.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\DW20.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\INSTALLUTIL.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\REGSVCS.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\DFSVC.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NGENTASK.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_HYPERV-COMMANDLINE-TOOL_31BF3856AD364E35_10.0.19041.928_NONE_0B17415AE0DD0379\R\HVC.EXE 34e9608e68304e1cf3fa471922e1b3d0_NeikiAnalytics.exe