Analysis
-
max time kernel
140s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
11/06/2024, 13:12
Static task
static1
Behavioral task
behavioral1
Sample
35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe
-
Size
725KB
-
MD5
35ee6f0dc7c7fd2e6da25e68d6410f90
-
SHA1
8291ac950e09265bfe83b02b9ff4c4cec46da514
-
SHA256
f97337ff70564a40969055924fba0f582d7a49c61eaccadae3d8a1731386fa4d
-
SHA512
8626312544e0a12d6c8fa90b005684f83f4398d2781b38535531c0900c40379d35d50d39bdba7a2e23248f87b2441454bc31c80a735f4add063f32ea4b98bf2c
-
SSDEEP
12288:c8VnWQLY4wpc1HCRruJcRH0wpwI1QvFudHokTFfOfFJRGkp8AQ:BUF4wpcA0wpwIOvFuqwfOfkAQ
Malware Config
Signatures
-
Sets file execution options in registry 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\debugger = "ntsd -d" reg.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe " cmd.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification \??\c:\Windows\SysWOW64\regedit.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Windows Media Player\WMPDMC.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Windows Media Player\wmpenc.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.EXE 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Windows Media Player\wmpconfig.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\javah.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Internet Explorer\ExtExport.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmlaunch.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Windows Mail\wabmig.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\ink\mip.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\private_browsing.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\rmiregistry.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Internet Explorer\ieinstal.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Internet Explorer\ielowutil.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\kinit.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\unpack200.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\vsta_ep32.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\7-Zip\7zFM.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\mip.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\java.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\VideoLAN\VLC\vlc.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\ktab.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Internet Explorer\iexplore.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\OIS.EXE 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\minidump-analyzer.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Windows Photo Viewer\ImagingDevices.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\pingsender.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification \??\c:\Windows\write.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Windows\bfsvc.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Windows\explorer.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Windows\hh.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Windows\winhlp32.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Windows\twunk_16.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Windows\twunk_32.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Windows\Boot\PCAT\memtest.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Windows\fveupdate.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Windows\HelpPane.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Windows\notepad.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe File opened for modification \??\c:\Windows\splwow64.exe 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe -
Modifies registry class 14 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.txt \ = " exefile" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.txt cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell cmd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1364 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1364 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 1364 wrote to memory of 2796 1364 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe 28 PID 1364 wrote to memory of 2796 1364 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe 28 PID 1364 wrote to memory of 2796 1364 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe 28 PID 1364 wrote to memory of 2796 1364 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe 28 PID 1364 wrote to memory of 1660 1364 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe 30 PID 1364 wrote to memory of 1660 1364 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe 30 PID 1364 wrote to memory of 1660 1364 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe 30 PID 1364 wrote to memory of 1660 1364 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe 30 PID 1364 wrote to memory of 936 1364 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe 31 PID 1364 wrote to memory of 936 1364 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe 31 PID 1364 wrote to memory of 936 1364 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe 31 PID 1364 wrote to memory of 936 1364 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe 31 PID 1364 wrote to memory of 1124 1364 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe 33 PID 1364 wrote to memory of 1124 1364 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe 33 PID 1364 wrote to memory of 1124 1364 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe 33 PID 1364 wrote to memory of 1124 1364 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe 33 PID 1364 wrote to memory of 976 1364 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe 34 PID 1364 wrote to memory of 976 1364 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe 34 PID 1364 wrote to memory of 976 1364 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe 34 PID 1364 wrote to memory of 976 1364 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe 34 PID 1364 wrote to memory of 1880 1364 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe 36 PID 1364 wrote to memory of 1880 1364 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe 36 PID 1364 wrote to memory of 1880 1364 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe 36 PID 1364 wrote to memory of 1880 1364 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe 36 PID 1364 wrote to memory of 1964 1364 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe 37 PID 1364 wrote to memory of 1964 1364 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe 37 PID 1364 wrote to memory of 1964 1364 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe 37 PID 1364 wrote to memory of 1964 1364 35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe 37 PID 1660 wrote to memory of 3056 1660 cmd.exe 42 PID 1660 wrote to memory of 3056 1660 cmd.exe 42 PID 1660 wrote to memory of 3056 1660 cmd.exe 42 PID 1660 wrote to memory of 3056 1660 cmd.exe 42 PID 1660 wrote to memory of 1452 1660 cmd.exe 43 PID 1660 wrote to memory of 1452 1660 cmd.exe 43 PID 1660 wrote to memory of 1452 1660 cmd.exe 43 PID 1660 wrote to memory of 1452 1660 cmd.exe 43 PID 1660 wrote to memory of 3044 1660 cmd.exe 44 PID 1660 wrote to memory of 3044 1660 cmd.exe 44 PID 1660 wrote to memory of 3044 1660 cmd.exe 44 PID 1660 wrote to memory of 3044 1660 cmd.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\SysWOW64\cmd.execmd.exe2⤵PID:2796
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\123.bat2⤵
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Sets file execution options in registry
PID:3056
-
-
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Sets file execution options in registry
PID:1452
-
-
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Sets file execution options in registry
PID:3044
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c assoc .txt = exefile2⤵
- Modifies registry class
PID:936
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype comfile=C:\Users\Admin\AppData\Local\Temp\35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe2⤵
- Modifies system executable filetype association
- Modifies registry class
PID:1124
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype zipfile=C:\Users\Admin\AppData\Local\Temp\35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe2⤵
- Modifies registry class
PID:976
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype jpgfile=C:\Users\Admin\AppData\Local\Temp\35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe2⤵
- Modifies registry class
PID:1880
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype txtfile=C:\Users\Admin\AppData\Local\Temp\35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe2⤵
- Modifies registry class
PID:1964
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
443B
MD570170ba16a737a438223b88279dc6c85
SHA1cc066efa0fca9bc9f44013660dea6b28ddfd6a24
SHA256d3674f4b34a8ca8167160519aa5c66b6024eb09f4cb0c9278bc44370b0efec6a
SHA51237cc8c954544374d0a1ca4d012c9bd0b47781bc9bb8d0c15a8a95b9934893db3bedee867b984c20edabe54c39574abf7250de433aade6c0d544b8dd2c972c6da
-
Filesize
725KB
MD558c8464a6b77e2040baddbd5bd911c69
SHA18ddaa778c2c9b7f4faa273fa2eed4352f101f70b
SHA2565b6feaa2616e194f648a6e622fb14fc2df032e738d5b01334e3f2faba6d9e9c9
SHA51220617d7925ebb2a6adcdddcc051926efb5a8130ea817a581a4e097e4b3bc8e3e191004db01c0af283f2750ba13332c78de1db5563866cf7df233db4364e9a064