Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
08/06/2024, 07:03
Behavioral task
behavioral1
Sample
96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe
-
Size
454KB
-
MD5
96e400b7ddac309d1bf2e3c574a14a80
-
SHA1
ce7869373d7454bcebfea8aa710e0a4caeaa014c
-
SHA256
d5a45993421f059eac39132f88e50b345329d8bff85fea0f541ad0d98144df1e
-
SHA512
f2626d3b87f78d6516fa84a7b70e116697a58f43f1f236d4b3facbe8a26d28c7113252d17ba048c2ec7838e46565c0497ea73b3197bf43d3a17d72c03c0d709e
-
SSDEEP
6144:G7tfhd1E6dqi4py5f7tfhd1E6dqi4py5f7tfhd1E6dqi4py5f7tfhd1E6dqi4pyg:0fEy1TfEy1TfEy1TfEy1e
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/files/0x0007000000015d4c-8.dat aspack_v212_v242 -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\bitsadmin.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\finger.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\mountvol.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\psr.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\sort.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\bthudtask.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\compact.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\dpapimig.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\eventcreate.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\mobsync.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\netsh.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Dism\DismHost.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\InstallShield\setup.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\doskey.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\isoburn.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\msfeedssync.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\net.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\ntprint.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP10\IMJPDADM.EXE 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\diskraid.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\mcbuilder.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\whoami.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\cmd.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\DevicePairingWizard.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\DWWIN.EXE 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\forfiles.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\osk.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP10\imjppdmg.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\findstr.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\wusa.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\PkgMgr.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\RegisterIEPKEYs.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\taskmgr.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\InstallShield\_isdel.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\convert.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\getmac.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\pcaui.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP10\imjpuexc.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\user.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\IME\IMETC10\IMTCPROP.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\dfrgui.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\dllhst3g.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\instnm.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\poqexec.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\ReAgentc.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\sxstrace.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\w32tm.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\WSManHTTPConfig.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\ftp.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\sdchange.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesProtection.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\winrshost.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\AdapterTroubleshooter.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\InfDefaultInstall.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\msiexec.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\ndadmin.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\taskkill.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\tracerpt.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\waitfor.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\esentutl.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\eventvwr.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\iscsicli.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\msra.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\misc.exe$ 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SETLANG.EXE$ 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$ 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe$ 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe$ 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File created C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe$ 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE$ 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe$ 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\Hearts.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe$ 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE$ 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe$ 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\bin\jp2launcher.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe$ 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE$ 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jre7\bin\klist.exe$ 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{F6AFA7E0-7C65-4C06-9D81-8A9FA89DB845}\chrome_installer.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File created C:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe$ 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe$ 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE$ 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File created C:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe$ 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\bin\rmiregistry.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe$ 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File created C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File created C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe$ 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Program Files\Java\jre7\bin\servertool.exe$ 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$ 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File created C:\Program Files (x86)\Microsoft Office\Office14\SCANPST.EXE 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess32.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-mediaplayer-wmpenc_31bf3856ad364e35_6.1.7600.16385_none_00192601418cadff\wmpenc.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_6.1.7601.17514_none_4e297fab940bc0e5\ntprint.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7601.17514_none_1beb53526fc80c8d\iexplore.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\servicing\GC64\tzupd.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-taskscheduler-engine_31bf3856ad364e35_6.1.7601.17514_none_43d2529dd579f798\taskeng.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\WsatConfig\36ca2928b2191011831ab673861c6ac6\WsatConfig.ni.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\SMSvcHost\0b4d4e172e8054cb61d27f5ab9e0e445\SMSvcHost.ni.exe$ 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-optionalfeatures_31bf3856ad364e35_6.1.7600.16385_none_c25bebf1075ff6aa\OptionalFeatures.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-setup-component_31bf3856ad364e35_6.1.7601.17514_none_905283bdc3e1d2d8\windeploy.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-iis-legacysnapin_31bf3856ad364e35_6.1.7601.17514_none_e99b83c8fd064a06\InetMgr6.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\WsatConfig\537950d9c71af966e1d8c9deb550f842\WsatConfig.ni.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ftp_31bf3856ad364e35_6.1.7601.17514_none_0b11635f6f2987f7\ftp.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-openfiles_31bf3856ad364e35_6.1.7600.16385_none_431b58a8041530aa\openfiles.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-xcopy_31bf3856ad364e35_6.1.7600.16385_none_beea9c500dfd4622\xcopy.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\winsxs\amd64_netfx-csharp_compiler_csc_b03f5f7f11d50a3a_6.1.7600.16385_none_8b52bb03d4ea5d36\csc.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_6.1.7600.16385_none_6bcef05d7f04260a_rasautou.exe_477abe34 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\ehome\ehexthost.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_6.1.7601.17514_none_4b57445488ba33fd\IMJPDCT.EXE 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-i..eoptionalcomponents_31bf3856ad364e35_11.2.9600.16428_none_e410f56f6c4ee930\ConfigureIEOptionalComponents.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-speechcommonnoia64_31bf3856ad364e35_6.1.7600.16385_none_5e9e78a6dd413413\sapisvr.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_6.1.7600.16385_none_9ba1049ce0053bef\ConvertInkStore.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-com-dtc-runtime_31bf3856ad364e35_6.1.7600.16385_none_7547f48c79b40229\msdtc.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ehexthost\6.1.0.0__31bf3856ad364e35\ehexthost.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ie-pdm_31bf3856ad364e35_8.0.7600.16385_none_6425238b793ee910\PDMSetup.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MSASCui.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMConfigInstaller.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..oxgames-purbleplace_31bf3856ad364e35_6.1.7600.16385_none_622070221822eb39\PurblePlace.exe$ 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-tabletpc-controlpanel_31bf3856ad364e35_6.1.7601.17514_none_3d9977977190cdc4\tabcal.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\winsxs\amd64_netfx-jsc_b03f5f7f11d50a3a_6.1.7600.16385_none_14e6e9dab736481d\jsc.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_6.1.7600.16385_none_963d3becc3a475f1\raserver.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-eudcedit_31bf3856ad364e35_6.1.7601.17514_none_b7be8a14d61db17a\eudcedit.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_6.1.7600.16385_none_c10c2a29895d4994\gpscript.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-msmq-triggers-service_31bf3856ad364e35_6.1.7601.17514_none_864c8948d3a4b9f3\mqtgsvc.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-recdisc-main_31bf3856ad364e35_6.1.7601.17514_none_e2a1ffe0ca40cff2\recdisc.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_c79aef32ab85d92b\cmdl32.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-rasclienttools_31bf3856ad364e35_6.1.7600.16385_none_cb3bc16fc2624947\rasphone.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-session0viewer_31bf3856ad364e35_6.1.7600.16385_none_3ddbd9a9605f0519\UI0Detect.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_6.1.7601.17514_none_fb3795fb0be32033\WUDFHost.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-i..xing-service-server_31bf3856ad364e35_6.1.7601.17514_none_0db5e5844ed6ffe9\CISVC.EXE 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_6.1.7601.17514_none_da3cb85562df73c9\memtest.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\winsxs\amd64_netfx-cvtres_for_vc_and_vb_b03f5f7f11d50a3a_6.1.7601.17514_none_726f4033dc35da15\cvtres.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-session0viewer_31bf3856ad364e35_6.1.7600.16385_none_3ddbd9a9605f0519_ui0detect.exe_639495e3 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-setupapi_31bf3856ad364e35_6.1.7601.17514_none_9d700972113e2691\wowreg32.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\assembly\GAC_MSIL\loadmxf\6.1.0.0__31bf3856ad364e35\loadmxf.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\SMSvcHost\04d794428d635f6a82ac57dd3d6f3628\SMSvcHost.ni.exe$ 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CasPol.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-bootconfig_31bf3856ad364e35_6.1.7600.16385_none_680b6eb133f91b1b\bootcfg.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-driververifier_31bf3856ad364e35_6.1.7600.16385_none_1660ccbeb66c6cf1\verifier.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-time-tool_31bf3856ad364e35_6.1.7600.16385_none_48fe0cfd559f80ad\w32tm.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe$ 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2352 96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\96e400b7ddac309d1bf2e3c574a14a80_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2352
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
908KB
MD5b7633301caff50df3ebd44f0a021b7fb
SHA1698b10e8fa37d193e404852a1cb5d358098930f4
SHA2565804fa43e3f1927b27c44d79984718ca4c9de1e4b308d9e603c4fd8a1de71543
SHA5127f34ff056c596bef62efddf22f2acdd00ecd4e4715b289b3ffd042a2452d89f61231304a344189a3db18d4b60eac480f7bad31e89eb21ca53b53002c52a55ae5