Malware Analysis Report

2024-09-11 12:59

Sample ID 240613-ahvwyszfrm
Target 4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe
SHA256 bf96c4e28174b9d6577918f528a69e33d42b446fc4cb731dc3529678145645e2
Tags
sality backdoor evasion trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

bf96c4e28174b9d6577918f528a69e33d42b446fc4cb731dc3529678145645e2

Threat Level: Known bad

The file 4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

sality backdoor evasion trojan upx

UAC bypass

Sality

Modifies firewall policy service

Windows security bypass

Deletes itself

UPX packed file

Executes dropped EXE

Windows security modification

Loads dropped DLL

Checks whether UAC is enabled

Enumerates connected drives

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

System policy modification

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Create or Modify System Process
T1543
Windows Service
T1543.003
Privilege Escalation
TA0004
Create or Modify System Process
T1543
Windows Service
T1543.003
Abuse Elevation Control Mechanism
T1548
Bypass User Account Control
T1548.002
Defense Evasion
TA0005
Modify Registry
T1112
Abuse Elevation Control Mechanism
T1548
Bypass User Account Control
T1548.002
Impair Defenses
T1562
Disable or Modify Tools
T1562.001
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Peripheral Device Discovery
T1120
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-13 00:13

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 00:13

Reported

2024-06-13 00:15

Platform

win7-20240220-en

Max time kernel

30s

Max time network

119s

Command Line

"C:\Windows\system32\Dwm.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Windows\SysWOW64\360safe.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\360safe.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Windows\SysWOW64\360safe.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\360safe.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\360safe.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\360safe.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\SysWOW64\360safe.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\360safe.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\360safe.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\360safe.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\360safe.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\360safe.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\360safe.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\360safe.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\SysWOW64\360safe.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\360safe.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Windows\SysWOW64\360safe.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\360safe.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\O: C:\Windows\SysWOW64\360safe.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
File opened (read-only) \??\K: C:\Windows\SysWOW64\360safe.exe N/A
File opened (read-only) \??\N: C:\Windows\SysWOW64\360safe.exe N/A
File opened (read-only) \??\I: C:\Windows\SysWOW64\360safe.exe N/A
File opened (read-only) \??\J: C:\Windows\SysWOW64\360safe.exe N/A
File opened (read-only) \??\L: C:\Windows\SysWOW64\360safe.exe N/A
File opened (read-only) \??\M: C:\Windows\SysWOW64\360safe.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
File opened (read-only) \??\H: C:\Windows\SysWOW64\360safe.exe N/A
File opened (read-only) \??\P: C:\Windows\SysWOW64\360safe.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
File opened (read-only) \??\E: C:\Windows\SysWOW64\360safe.exe N/A
File opened (read-only) \??\G: C:\Windows\SysWOW64\360safe.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\cctvbox.jpg C:\Windows\SysWOW64\360safe.exe N/A
File created C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File created C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File created C:\Windows\SysWOW64\360safe.exe C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\cctvbox.jpg C:\Windows\SysWOW64\360safe.exe N/A
File created C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File created C:\Windows\SysWOW64\cctvbox.jpg C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
File created C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File created C:\Windows\SysWOW64\cctvbox.jpg C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File created C:\Windows\SysWOW64\cctvbox.jpg C:\Windows\SysWOW64\360safe.exe N/A
File created C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\cctvbox.jpg C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\cctvbox.jpg C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
File created C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File created C:\Windows\SysWOW64\cctvbox.jpg C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\cctvbox.jpg C:\Windows\SysWOW64\360safe.exe N/A
File created C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\cctvbox.jpg C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File created C:\Windows\SysWOW64\cctvbox.jpg C:\Windows\SysWOW64\360safe.exe N/A
File created C:\Windows\SysWOW64\cctvbox.jpg C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\cctvbox.jpg C:\Windows\SysWOW64\360safe.exe N/A
File created C:\Windows\SysWOW64\cctvbox.jpg C:\Windows\SysWOW64\360safe.exe N/A
File created C:\Windows\SysWOW64\cctvbox.jpg C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\cctvbox.jpg C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\360safe.exe C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\360safe.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\360safe.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\360safe.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\360safe.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\360safe.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\360safe.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\360safe.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\360safe.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\360safe.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\360safe.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\360safe.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\360safe.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\360safe.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\360safe.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\360safe.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\360safe.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\360safe.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\360safe.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\360safe.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\360safe.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\360safe.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2856 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Windows\SysWOW64\360safe.exe
PID 2856 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Windows\SysWOW64\360safe.exe
PID 2856 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Windows\SysWOW64\360safe.exe
PID 2856 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Windows\SysWOW64\360safe.exe
PID 2856 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Windows\system32\Dwm.exe
PID 2856 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Windows\system32\taskhost.exe
PID 2856 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Windows\Explorer.EXE
PID 2856 wrote to memory of 2308 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Windows\system32\DllHost.exe
PID 2856 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Windows\SysWOW64\360safe.exe
PID 2856 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Windows\SysWOW64\360safe.exe
PID 2228 wrote to memory of 2440 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 2228 wrote to memory of 2440 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 2228 wrote to memory of 2440 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 2228 wrote to memory of 2440 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 2440 wrote to memory of 2388 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 2440 wrote to memory of 2388 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 2440 wrote to memory of 2388 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 2440 wrote to memory of 2388 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 2388 wrote to memory of 2080 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 2388 wrote to memory of 2080 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 2388 wrote to memory of 2080 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 2388 wrote to memory of 2080 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 2080 wrote to memory of 1868 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 2080 wrote to memory of 1868 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 2080 wrote to memory of 1868 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 2080 wrote to memory of 1868 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 1868 wrote to memory of 2380 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 1868 wrote to memory of 2380 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 1868 wrote to memory of 2380 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 1868 wrote to memory of 2380 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 2380 wrote to memory of 2640 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 2380 wrote to memory of 2640 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 2380 wrote to memory of 2640 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 2380 wrote to memory of 2640 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 2640 wrote to memory of 1864 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 2640 wrote to memory of 1864 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 2640 wrote to memory of 1864 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 2640 wrote to memory of 1864 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 2856 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Windows\system32\Dwm.exe
PID 2856 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Windows\system32\taskhost.exe
PID 2856 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Windows\Explorer.EXE
PID 2856 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Windows\SysWOW64\360safe.exe
PID 2856 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Windows\SysWOW64\360safe.exe
PID 1864 wrote to memory of 1040 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\system32\Dwm.exe
PID 1864 wrote to memory of 1056 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\system32\taskhost.exe
PID 1864 wrote to memory of 1100 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\Explorer.EXE
PID 1864 wrote to memory of 1040 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\system32\Dwm.exe
PID 1864 wrote to memory of 1056 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\system32\taskhost.exe
PID 1864 wrote to memory of 1100 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\Explorer.EXE

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\360safe.exe N/A

Processes

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe"

C:\Windows\SysWOW64\360safe.exe

C:\Windows\system32\360safe.exe

C:\Windows\SysWOW64\360safe.exe

C:\Windows\system32\360safe.exe

C:\Windows\SysWOW64\360safe.exe

C:\Windows\system32\360safe.exe

C:\Windows\SysWOW64\360safe.exe

C:\Windows\system32\360safe.exe

C:\Windows\SysWOW64\360safe.exe

C:\Windows\system32\360safe.exe

C:\Windows\SysWOW64\360safe.exe

C:\Windows\system32\360safe.exe

C:\Windows\SysWOW64\360safe.exe

C:\Windows\system32\360safe.exe

C:\Windows\SysWOW64\360safe.exe

C:\Windows\system32\360safe.exe

Network

N/A

Files

memory/2856-0-0x0000000000400000-0x000000000043B000-memory.dmp

\Windows\SysWOW64\360safe.exe

MD5 4f3437f0149e01b7fdf11d44b0d2f490
SHA1 4185bdf64ece6a82957d858b4c9a49913e7353f6
SHA256 bf96c4e28174b9d6577918f528a69e33d42b446fc4cb731dc3529678145645e2
SHA512 09a27059051625c9f162bff0665d4dc957d6236fca523ddc4799172220828426d05394a1d6844180bb9003136ae3cf19adca0dbc9dab0abb05ac916fae997d28

memory/2856-45-0x0000000002EA0000-0x0000000002EDB000-memory.dmp

memory/2856-43-0x0000000001DC0000-0x0000000002E4E000-memory.dmp

memory/2388-56-0x0000000000400000-0x000000000043B000-memory.dmp

memory/2856-42-0x0000000001DC0000-0x0000000002E4E000-memory.dmp

memory/2856-40-0x0000000001DC0000-0x0000000002E4E000-memory.dmp

memory/2440-52-0x0000000000400000-0x000000000043B000-memory.dmp

memory/2228-51-0x0000000002060000-0x000000000209B000-memory.dmp

memory/2856-14-0x0000000001DC0000-0x0000000002E4E000-memory.dmp

memory/2856-41-0x0000000001DC0000-0x0000000002E4E000-memory.dmp

memory/2228-39-0x00000000001B0000-0x00000000001B2000-memory.dmp

memory/2228-38-0x0000000000400000-0x000000000043B000-memory.dmp

memory/2856-37-0x0000000000440000-0x0000000000442000-memory.dmp

memory/2856-36-0x0000000001DC0000-0x0000000002E4E000-memory.dmp

memory/2228-35-0x00000000001B0000-0x00000000001B2000-memory.dmp

memory/2856-20-0x0000000001DC0000-0x0000000002E4E000-memory.dmp

memory/2228-32-0x0000000000300000-0x0000000000301000-memory.dmp

memory/2856-27-0x0000000000450000-0x0000000000451000-memory.dmp

memory/2856-25-0x0000000000450000-0x0000000000451000-memory.dmp

memory/2856-24-0x0000000000440000-0x0000000000442000-memory.dmp

memory/1040-15-0x0000000001DA0000-0x0000000001DA2000-memory.dmp

memory/2856-33-0x0000000000440000-0x0000000000442000-memory.dmp

memory/2856-13-0x0000000001DC0000-0x0000000002E4E000-memory.dmp

memory/2856-44-0x0000000001DC0000-0x0000000002E4E000-memory.dmp

memory/2856-58-0x0000000001DC0000-0x0000000002E4E000-memory.dmp

memory/2080-65-0x0000000000400000-0x000000000043B000-memory.dmp

memory/2388-64-0x0000000001C80000-0x0000000001CBB000-memory.dmp

memory/2856-57-0x0000000001DC0000-0x0000000002E4E000-memory.dmp

memory/2228-80-0x00000000001B0000-0x00000000001B2000-memory.dmp

memory/2856-79-0x0000000000440000-0x0000000000442000-memory.dmp

memory/2380-76-0x0000000000400000-0x000000000043B000-memory.dmp

memory/2856-70-0x0000000001DC0000-0x0000000002E4E000-memory.dmp

memory/2640-83-0x0000000000400000-0x000000000043B000-memory.dmp

memory/2856-87-0x0000000001DC0000-0x0000000002E4E000-memory.dmp

memory/2856-91-0x0000000001DC0000-0x0000000002E4E000-memory.dmp

memory/2640-92-0x0000000000400000-0x000000000043B000-memory.dmp

memory/2856-93-0x0000000001DC0000-0x0000000002E4E000-memory.dmp

memory/2380-94-0x0000000000400000-0x000000000043B000-memory.dmp

memory/2856-95-0x0000000001DC0000-0x0000000002E4E000-memory.dmp

memory/1868-96-0x0000000000400000-0x000000000043B000-memory.dmp

memory/2856-97-0x0000000001DC0000-0x0000000002E4E000-memory.dmp

memory/2856-98-0x0000000001DC0000-0x0000000002E4E000-memory.dmp

memory/2080-99-0x0000000000400000-0x000000000043B000-memory.dmp

memory/2856-101-0x0000000001DC0000-0x0000000002E4E000-memory.dmp

memory/2388-102-0x0000000000400000-0x000000000043B000-memory.dmp

memory/2440-105-0x0000000000400000-0x000000000043B000-memory.dmp

memory/1864-117-0x0000000000380000-0x0000000000382000-memory.dmp

memory/1864-118-0x0000000000390000-0x0000000000391000-memory.dmp

memory/2856-119-0x0000000001DC0000-0x0000000002E4E000-memory.dmp

memory/2228-124-0x0000000000400000-0x000000000043B000-memory.dmp

memory/2228-122-0x00000000001B0000-0x00000000001B2000-memory.dmp

memory/2856-125-0x0000000001DC0000-0x0000000002E4E000-memory.dmp

memory/2856-144-0x0000000000400000-0x000000000043B000-memory.dmp

memory/2856-127-0x0000000001DC0000-0x0000000002E4E000-memory.dmp

C:\Windows\SYSTEM.INI

MD5 dc62510bd435e76c8e0b6ec722558c90
SHA1 fead9fb201bc93d7049ebc6f714674319401e6aa
SHA256 440fff8c561bbcdc95ae60362b233be1b09b67b6935fd450e924d5063921582f
SHA512 457f5b76b2b0a5cb5a6395632c707c00dc742e939ed51372fc922d21a3c777182bef5894fa621b44721bc86a608f264fcd55ba96d5afac30316f8d022df59418

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 00:13

Reported

2024-06-13 00:15

Platform

win10v2004-20240226-en

Max time kernel

52s

Max time network

152s

Command Line

"fontdrvhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Windows\SysWOW64\360safe.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\360safe.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Windows\SysWOW64\360safe.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\360safe.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\360safe.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\360safe.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\360safe.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\360safe.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\360safe.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\SysWOW64\360safe.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\360safe.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\360safe.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\360safe.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Windows\SysWOW64\360safe.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\360safe.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\360safe.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Windows\SysWOW64\360safe.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\360safe.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
File opened (read-only) \??\K: C:\Windows\SysWOW64\360safe.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
File opened (read-only) \??\L: C:\Windows\SysWOW64\360safe.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
File opened (read-only) \??\J: C:\Windows\SysWOW64\360safe.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
File opened (read-only) \??\E: C:\Windows\SysWOW64\360safe.exe N/A
File opened (read-only) \??\G: C:\Windows\SysWOW64\360safe.exe N/A
File opened (read-only) \??\H: C:\Windows\SysWOW64\360safe.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
File opened (read-only) \??\N: C:\Windows\SysWOW64\360safe.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
File opened (read-only) \??\M: C:\Windows\SysWOW64\360safe.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
File opened (read-only) \??\I: C:\Windows\SysWOW64\360safe.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\cctvbox.jpg C:\Windows\SysWOW64\360safe.exe N/A
File created C:\Windows\SysWOW64\cctvbox.jpg C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\cctvbox.jpg C:\Windows\SysWOW64\360safe.exe N/A
File created C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\cctvbox.jpg C:\Windows\SysWOW64\360safe.exe N/A
File created C:\Windows\SysWOW64\cctvbox.jpg C:\Windows\SysWOW64\360safe.exe N/A
File created C:\Windows\SysWOW64\cctvbox.jpg C:\Windows\SysWOW64\360safe.exe N/A
File created C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File created C:\Windows\SysWOW64\cctvbox.jpg C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File created C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\cctvbox.jpg C:\Windows\SysWOW64\360safe.exe N/A
File created C:\Windows\SysWOW64\cctvbox.jpg C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\cctvbox.jpg C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File created C:\Windows\SysWOW64\cctvbox.jpg C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File created C:\Windows\SysWOW64\cctvbox.jpg C:\Windows\SysWOW64\360safe.exe N/A
File created C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\cctvbox.jpg C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File created C:\Windows\SysWOW64\cctvbox.jpg C:\Windows\SysWOW64\360safe.exe N/A
File created C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\cctvbox.jpg C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File created C:\Windows\SysWOW64\cctvbox.jpg C:\Windows\SysWOW64\360safe.exe N/A
File created C:\Windows\SysWOW64\cctvbox.jpg C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\cctvbox.jpg C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\cctvbox.jpg C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File created C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File created C:\Windows\SysWOW64\cctvbox.jpg C:\Windows\SysWOW64\360safe.exe N/A
File created C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File created C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\360safe.exe C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
File created C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File created C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File created C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File created C:\Windows\SysWOW64\cctvbox.jpg C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\cctvbox.jpg C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File created C:\Windows\SysWOW64\cctvbox.jpg C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\cctvbox.jpg C:\Windows\SysWOW64\360safe.exe N/A
File created C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\cctvbox.jpg C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\cctvbox.jpg C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\cctvbox.jpg C:\Windows\SysWOW64\360safe.exe N/A
File created C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\cctvbox.jpg C:\Windows\SysWOW64\360safe.exe N/A
File opened for modification C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A
File created C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A
N/A N/A C:\Windows\SysWOW64\360safe.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4616 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Windows\SysWOW64\360safe.exe
PID 4616 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Windows\SysWOW64\360safe.exe
PID 4616 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Windows\SysWOW64\360safe.exe
PID 3352 wrote to memory of 3300 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 3352 wrote to memory of 3300 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 3352 wrote to memory of 3300 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 4616 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Windows\system32\fontdrvhost.exe
PID 4616 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Windows\system32\fontdrvhost.exe
PID 4616 wrote to memory of 1000 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Windows\system32\dwm.exe
PID 4616 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Windows\system32\sihost.exe
PID 4616 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 4616 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Windows\system32\taskhostw.exe
PID 4616 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Windows\Explorer.EXE
PID 4616 wrote to memory of 3536 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 4616 wrote to memory of 3716 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Windows\system32\DllHost.exe
PID 4616 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4616 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Windows\System32\RuntimeBroker.exe
PID 4616 wrote to memory of 4048 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 4616 wrote to memory of 4116 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Windows\System32\RuntimeBroker.exe
PID 4616 wrote to memory of 4504 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Windows\System32\RuntimeBroker.exe
PID 4616 wrote to memory of 4488 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 4616 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4616 wrote to memory of 4648 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4616 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4616 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4616 wrote to memory of 728 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4616 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4616 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4616 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Windows\SysWOW64\360safe.exe
PID 4616 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Windows\SysWOW64\360safe.exe
PID 4616 wrote to memory of 3300 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Windows\SysWOW64\360safe.exe
PID 4616 wrote to memory of 3300 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Windows\SysWOW64\360safe.exe
PID 3300 wrote to memory of 3712 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 3300 wrote to memory of 3712 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 3300 wrote to memory of 3712 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 3712 wrote to memory of 8 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 3712 wrote to memory of 8 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 3712 wrote to memory of 8 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 8 wrote to memory of 4848 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 8 wrote to memory of 4848 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 8 wrote to memory of 4848 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 4848 wrote to memory of 3996 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 4848 wrote to memory of 3996 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 4848 wrote to memory of 3996 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 3996 wrote to memory of 1136 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 3996 wrote to memory of 1136 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 3996 wrote to memory of 1136 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 1136 wrote to memory of 1568 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 1136 wrote to memory of 1568 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 1136 wrote to memory of 1568 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 1568 wrote to memory of 1772 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 1568 wrote to memory of 1772 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 1568 wrote to memory of 1772 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 1772 wrote to memory of 408 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 1772 wrote to memory of 408 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 1772 wrote to memory of 408 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 408 wrote to memory of 2384 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 408 wrote to memory of 2384 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 408 wrote to memory of 2384 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 2384 wrote to memory of 3264 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 2384 wrote to memory of 3264 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 2384 wrote to memory of 3264 N/A C:\Windows\SysWOW64\360safe.exe C:\Windows\SysWOW64\360safe.exe
PID 4616 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Windows\system32\fontdrvhost.exe
PID 4616 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe C:\Windows\system32\fontdrvhost.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\360safe.exe N/A

Processes

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffae3442e98,0x7ffae3442ea4,0x7ffae3442eb0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2248 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2176 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3464 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5320 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=5408 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:1

C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\4f3437f0149e01b7fdf11d44b0d2f490_NeikiAnalytics.exe"

C:\Windows\SysWOW64\360safe.exe

C:\Windows\system32\360safe.exe

C:\Windows\SysWOW64\360safe.exe

C:\Windows\system32\360safe.exe

C:\Windows\SysWOW64\360safe.exe

C:\Windows\system32\360safe.exe

C:\Windows\SysWOW64\360safe.exe

C:\Windows\system32\360safe.exe

C:\Windows\SysWOW64\360safe.exe

C:\Windows\system32\360safe.exe

C:\Windows\SysWOW64\360safe.exe

C:\Windows\system32\360safe.exe

C:\Windows\SysWOW64\360safe.exe

C:\Windows\system32\360safe.exe

C:\Windows\SysWOW64\360safe.exe

C:\Windows\system32\360safe.exe

C:\Windows\SysWOW64\360safe.exe

C:\Windows\system32\360safe.exe

C:\Windows\SysWOW64\360safe.exe

C:\Windows\system32\360safe.exe

C:\Windows\SysWOW64\360safe.exe

C:\Windows\system32\360safe.exe

C:\Windows\SysWOW64\360safe.exe

C:\Windows\system32\360safe.exe

C:\Windows\SysWOW64\360safe.exe

C:\Windows\system32\360safe.exe

C:\Windows\SysWOW64\360safe.exe

C:\Windows\system32\360safe.exe

C:\Windows\SysWOW64\360safe.exe

C:\Windows\system32\360safe.exe

C:\Windows\SysWOW64\360safe.exe

C:\Windows\system32\360safe.exe

C:\Windows\SysWOW64\360safe.exe

C:\Windows\system32\360safe.exe

C:\Windows\SysWOW64\360safe.exe

C:\Windows\system32\360safe.exe

C:\Windows\SysWOW64\360safe.exe

C:\Windows\system32\360safe.exe

C:\Windows\SysWOW64\360safe.exe

C:\Windows\system32\360safe.exe

C:\Windows\SysWOW64\360safe.exe

C:\Windows\system32\360safe.exe

C:\Windows\SysWOW64\360safe.exe

C:\Windows\system32\360safe.exe

C:\Windows\SysWOW64\360safe.exe

C:\Windows\system32\360safe.exe

C:\Windows\SysWOW64\360safe.exe

C:\Windows\system32\360safe.exe

C:\Windows\SysWOW64\360safe.exe

C:\Windows\system32\360safe.exe

C:\Windows\SysWOW64\360safe.exe

C:\Windows\system32\360safe.exe

C:\Windows\SysWOW64\360safe.exe

C:\Windows\system32\360safe.exe

C:\Windows\SysWOW64\360safe.exe

C:\Windows\system32\360safe.exe

C:\Windows\SysWOW64\360safe.exe

C:\Windows\system32\360safe.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc

C:\Windows\System32\sihclient.exe

C:\Windows\System32\sihclient.exe /cv lT+Vx2NB4Eec+1sY1LpKAg.0.2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3732 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 17.173.189.20.in-addr.arpa udp

Files

memory/4616-0-0x0000000000400000-0x000000000043B000-memory.dmp

C:\Windows\SysWOW64\360safe.exe

MD5 4f3437f0149e01b7fdf11d44b0d2f490
SHA1 4185bdf64ece6a82957d858b4c9a49913e7353f6
SHA256 bf96c4e28174b9d6577918f528a69e33d42b446fc4cb731dc3529678145645e2
SHA512 09a27059051625c9f162bff0665d4dc957d6236fca523ddc4799172220828426d05394a1d6844180bb9003136ae3cf19adca0dbc9dab0abb05ac916fae997d28

memory/4616-5-0x0000000002410000-0x000000000349E000-memory.dmp

memory/3300-22-0x0000000000400000-0x000000000043B000-memory.dmp

memory/4616-17-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4616-12-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4616-16-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4616-10-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4616-11-0x0000000002410000-0x000000000349E000-memory.dmp

memory/3352-18-0x0000000000400000-0x000000000043B000-memory.dmp

memory/4616-20-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4616-21-0x0000000002410000-0x000000000349E000-memory.dmp

memory/3300-35-0x0000000000560000-0x0000000000562000-memory.dmp

memory/3712-40-0x0000000000400000-0x000000000043B000-memory.dmp

memory/4616-23-0x0000000002410000-0x000000000349E000-memory.dmp

memory/3352-34-0x00000000004B0000-0x00000000004B2000-memory.dmp

memory/4616-33-0x0000000004280000-0x0000000004282000-memory.dmp

memory/3300-38-0x0000000000560000-0x0000000000562000-memory.dmp

memory/3352-37-0x00000000004B0000-0x00000000004B2000-memory.dmp

memory/4616-36-0x0000000004280000-0x0000000004282000-memory.dmp

memory/3300-32-0x0000000000570000-0x0000000000571000-memory.dmp

memory/3352-30-0x0000000000510000-0x0000000000511000-memory.dmp

memory/4616-28-0x00000000043D0000-0x00000000043D1000-memory.dmp

memory/4616-27-0x0000000004280000-0x0000000004282000-memory.dmp

memory/8-47-0x0000000000400000-0x000000000043B000-memory.dmp

memory/4848-52-0x0000000000400000-0x000000000043B000-memory.dmp

memory/4616-45-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4616-42-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4616-53-0x0000000002410000-0x000000000349E000-memory.dmp

memory/1136-64-0x0000000000400000-0x000000000043B000-memory.dmp

memory/4616-63-0x0000000002410000-0x000000000349E000-memory.dmp

memory/1772-72-0x0000000000400000-0x000000000043B000-memory.dmp

memory/4616-77-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4616-87-0x0000000004280000-0x0000000004282000-memory.dmp

memory/3300-89-0x0000000000560000-0x0000000000562000-memory.dmp

memory/3352-88-0x00000000004B0000-0x00000000004B2000-memory.dmp

memory/3712-91-0x00000000006F0000-0x00000000006F1000-memory.dmp

memory/1136-111-0x0000000002040000-0x0000000002042000-memory.dmp

memory/3996-110-0x00000000005F0000-0x00000000005F2000-memory.dmp

memory/3264-117-0x0000000002140000-0x0000000002142000-memory.dmp

memory/408-114-0x00000000006C0000-0x00000000006C2000-memory.dmp

memory/1772-113-0x0000000000640000-0x0000000000642000-memory.dmp

memory/4848-109-0x00000000004A0000-0x00000000004A2000-memory.dmp

memory/3264-108-0x0000000002190000-0x0000000002191000-memory.dmp

memory/2384-116-0x00000000004E0000-0x00000000004E2000-memory.dmp

memory/408-104-0x0000000002150000-0x0000000002151000-memory.dmp

memory/1772-102-0x0000000002110000-0x0000000002111000-memory.dmp

memory/1568-100-0x0000000000530000-0x0000000000531000-memory.dmp

memory/1136-98-0x0000000002090000-0x0000000002091000-memory.dmp

memory/3996-96-0x0000000000770000-0x0000000000771000-memory.dmp

memory/4848-94-0x00000000005F0000-0x00000000005F1000-memory.dmp

memory/1568-112-0x0000000000510000-0x0000000000512000-memory.dmp

memory/3712-92-0x0000000000590000-0x0000000000592000-memory.dmp

memory/2384-106-0x0000000002190000-0x0000000002191000-memory.dmp

memory/4280-144-0x0000000000400000-0x000000000043B000-memory.dmp

memory/3876-148-0x0000000000400000-0x000000000043B000-memory.dmp

memory/4616-143-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4616-165-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4616-186-0x0000000002410000-0x000000000349E000-memory.dmp

memory/1140-189-0x0000000000400000-0x000000000043B000-memory.dmp

memory/4616-188-0x0000000002410000-0x000000000349E000-memory.dmp

memory/652-191-0x0000000000400000-0x000000000043B000-memory.dmp

memory/4616-190-0x0000000002410000-0x000000000349E000-memory.dmp

memory/1560-193-0x0000000000400000-0x000000000043B000-memory.dmp

memory/4616-194-0x0000000002410000-0x000000000349E000-memory.dmp

memory/852-196-0x0000000000400000-0x000000000043B000-memory.dmp

memory/4616-197-0x0000000002410000-0x000000000349E000-memory.dmp

memory/3616-200-0x0000000000400000-0x000000000043B000-memory.dmp

memory/4616-201-0x0000000002410000-0x000000000349E000-memory.dmp

memory/1496-203-0x0000000000400000-0x000000000043B000-memory.dmp

memory/3308-242-0x0000000000400000-0x000000000043B000-memory.dmp

memory/392-248-0x0000000000400000-0x000000000043B000-memory.dmp

memory/3876-254-0x0000000000400000-0x000000000043B000-memory.dmp

memory/4280-260-0x0000000000400000-0x000000000043B000-memory.dmp

memory/4872-266-0x0000000000400000-0x000000000043B000-memory.dmp

memory/3444-272-0x0000000000400000-0x000000000043B000-memory.dmp

memory/2984-283-0x0000000000400000-0x000000000043B000-memory.dmp

memory/4372-289-0x0000000000400000-0x000000000043B000-memory.dmp

memory/3488-295-0x0000000000400000-0x000000000043B000-memory.dmp

memory/4576-301-0x0000000000400000-0x000000000043B000-memory.dmp

memory/3264-329-0x0000000000400000-0x000000000043B000-memory.dmp

memory/3300-333-0x0000000000400000-0x000000000043B000-memory.dmp

memory/3352-325-0x0000000000400000-0x000000000043B000-memory.dmp

memory/4616-334-0x0000000002410000-0x000000000349E000-memory.dmp

memory/4616-321-0x0000000000400000-0x000000000043B000-memory.dmp

memory/2384-338-0x0000000000400000-0x000000000043B000-memory.dmp

memory/408-342-0x0000000000400000-0x000000000043B000-memory.dmp

C:\Windows\SYSTEM.INI

MD5 0b549b087e11b745950cc2a84c50e495
SHA1 f935e7e1b675853bc73ebc1fdc3bc29cfe66dc2d
SHA256 20a873b7363d188893e913b30ac934801615e9236c70e2e7906815e59bfa1571
SHA512 ecf07ec3e39a71c02cbf0970eaeb22af1122fd06b7252119f7622a9b32f3b207a9aa6c41fa38a6d16f6f8b81200816b7e957d4166c04f9f18367e1783352aabe

memory/1772-356-0x0000000000400000-0x000000000043B000-memory.dmp

memory/1568-362-0x0000000000400000-0x000000000043B000-memory.dmp

memory/1136-367-0x0000000000400000-0x000000000043B000-memory.dmp

memory/3996-373-0x0000000000400000-0x000000000043B000-memory.dmp

memory/4848-378-0x0000000000400000-0x000000000043B000-memory.dmp

memory/3712-382-0x0000000000400000-0x000000000043B000-memory.dmp

memory/8-383-0x0000000000400000-0x000000000043B000-memory.dmp

C:\tsxqic.pif

MD5 4f7e6283c0fb3c55207e426b42cd885b
SHA1 5961e39016510a8ad5b77fb90c2a596c88b3f38e
SHA256 e7812594e90d213bf2709662fc8d1193151268609ab7bc94c3c0a81fb230bdb0
SHA512 f5e787732796d59c4e126a13116c6cc8e1308a360cbc61a6767a9b93fc29ea1852b77f0f55d4275af1143679cf644c49fad430c9f9081b26f9aec6921e3cd861