Analysis
-
max time kernel
140s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/06/2024, 09:23
Static task
static1
Behavioral task
behavioral1
Sample
2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe
-
Size
125KB
-
MD5
2fe57c000d1920bc35b8aa0163a9e5f0
-
SHA1
60870441ea2d3d1174e07a79c61b0045dbce006a
-
SHA256
4f5de6cb9593a2ddd762da83476ec5d33d3b7641f02e87991e6826deb7faf2d3
-
SHA512
f5e6d6c8ed35fa9aeb3a972db1979960b8aebf1d1f21d712d593bbb82278020254031c71c569e31edd6820c72a74bdf153aaa8403bd3433f18b8ddd49ea7886f
-
SSDEEP
1536:RkAHDp/3yZhxjjaDswjvLzVCMnIqTMhTYLg5tqf70LJZmh82vP/6UT:j3sXj2sevLzVCM86+00LJZi1vP/6M
Malware Config
Signatures
-
Sets file execution options in registry 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\debugger = "ntsd -d" reg.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe " cmd.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification \??\c:\Windows\SysWOW64\regedit.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\DVD Maker\DVDMaker.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\servertool.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\ktab.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\maintenanceservice.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\rmid.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\firefox.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\OIS.EXE 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\java.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\javah.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Windows Media Player\wmpshare.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\private_browsing.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmpshare.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\kinit.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\unpack200.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Internet Explorer\iexplore.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\ssvagent.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Windows Media Player\WMPDMC.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jps.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Windows Mail\wabmig.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmpconfig.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Windows NT\Accessories\wordpad.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Windows Media Player\wmpenc.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\javacpl.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Windows Media Player\setup_wm.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\jp2launcher.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\VideoLAN\VLC\vlc.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Windows NT\Accessories\wordpad.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification \??\c:\Windows\write.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Windows\bfsvc.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Windows\explorer.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Windows\HelpPane.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Windows\notepad.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Windows\winhlp32.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Windows\Boot\PCAT\memtest.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Windows\fveupdate.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Windows\hh.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Windows\splwow64.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Windows\twunk_16.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe File opened for modification \??\c:\Windows\twunk_32.exe 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe -
Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe " cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.txt \ = " exefile" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.txt cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe " cmd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2080 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2080 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 2080 wrote to memory of 1732 2080 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe 28 PID 2080 wrote to memory of 1732 2080 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe 28 PID 2080 wrote to memory of 1732 2080 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe 28 PID 2080 wrote to memory of 1732 2080 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe 28 PID 2080 wrote to memory of 712 2080 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe 30 PID 2080 wrote to memory of 712 2080 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe 30 PID 2080 wrote to memory of 712 2080 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe 30 PID 2080 wrote to memory of 712 2080 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe 30 PID 2080 wrote to memory of 448 2080 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe 31 PID 2080 wrote to memory of 448 2080 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe 31 PID 2080 wrote to memory of 448 2080 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe 31 PID 2080 wrote to memory of 448 2080 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe 31 PID 2080 wrote to memory of 3060 2080 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe 33 PID 2080 wrote to memory of 3060 2080 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe 33 PID 2080 wrote to memory of 3060 2080 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe 33 PID 2080 wrote to memory of 3060 2080 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe 33 PID 2080 wrote to memory of 2156 2080 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe 34 PID 2080 wrote to memory of 2156 2080 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe 34 PID 2080 wrote to memory of 2156 2080 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe 34 PID 2080 wrote to memory of 2156 2080 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe 34 PID 2080 wrote to memory of 3032 2080 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe 35 PID 2080 wrote to memory of 3032 2080 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe 35 PID 2080 wrote to memory of 3032 2080 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe 35 PID 2080 wrote to memory of 3032 2080 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe 35 PID 2080 wrote to memory of 1088 2080 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe 36 PID 2080 wrote to memory of 1088 2080 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe 36 PID 2080 wrote to memory of 1088 2080 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe 36 PID 2080 wrote to memory of 1088 2080 2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe 36 PID 712 wrote to memory of 1044 712 cmd.exe 42 PID 712 wrote to memory of 1044 712 cmd.exe 42 PID 712 wrote to memory of 1044 712 cmd.exe 42 PID 712 wrote to memory of 1044 712 cmd.exe 42 PID 712 wrote to memory of 1952 712 cmd.exe 43 PID 712 wrote to memory of 1952 712 cmd.exe 43 PID 712 wrote to memory of 1952 712 cmd.exe 43 PID 712 wrote to memory of 1952 712 cmd.exe 43 PID 712 wrote to memory of 640 712 cmd.exe 44 PID 712 wrote to memory of 640 712 cmd.exe 44 PID 712 wrote to memory of 640 712 cmd.exe 44 PID 712 wrote to memory of 640 712 cmd.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\SysWOW64\cmd.execmd.exe2⤵PID:1732
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\123.bat2⤵
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Sets file execution options in registry
PID:1044
-
-
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Sets file execution options in registry
PID:1952
-
-
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Sets file execution options in registry
PID:640
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c assoc .txt = exefile2⤵
- Modifies registry class
PID:448
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype comfile=C:\Users\Admin\AppData\Local\Temp\2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe2⤵
- Modifies system executable filetype association
- Modifies registry class
PID:3060
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype zipfile=C:\Users\Admin\AppData\Local\Temp\2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe2⤵
- Modifies registry class
PID:2156
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype jpgfile=C:\Users\Admin\AppData\Local\Temp\2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe2⤵
- Modifies registry class
PID:3032
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype txtfile=C:\Users\Admin\AppData\Local\Temp\2fe57c000d1920bc35b8aa0163a9e5f0_NeikiAnalytics.exe2⤵
- Modifies registry class
PID:1088
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
443B
MD570170ba16a737a438223b88279dc6c85
SHA1cc066efa0fca9bc9f44013660dea6b28ddfd6a24
SHA256d3674f4b34a8ca8167160519aa5c66b6024eb09f4cb0c9278bc44370b0efec6a
SHA51237cc8c954544374d0a1ca4d012c9bd0b47781bc9bb8d0c15a8a95b9934893db3bedee867b984c20edabe54c39574abf7250de433aade6c0d544b8dd2c972c6da
-
Filesize
125KB
MD522678c524e9663590776186a458a821d
SHA17ca5f4e49f31b6248998fd508ceb0b4ce06fa93c
SHA256b0b6ab1c9bfe550d48139e237380679a390b3450cca4f01908fe9a0b4f85020f
SHA5122def121e168859bb1bf8c6b62208910da1d209aa862a29bc4d88dbad928d9504dd1f0980f033da2eee7ff77e48de2b040798dd748f2fa1714328797d93dba8a0