Analysis
- max time kernel
150s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 01:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe
Resource
win7-20240611-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe
- Size 97KB
- Sample240613-cec8vatfqq
- SHA256 117b8eef5ffb7338bc4274151479827a5c4122a8f2c693aa9131ec64f808dbfd
- MD5 556ddbd27314523180e5e7faefaf5420
- SHA1 fa94434c140813c92b0a8be841670ed44c7f15f9
- SHA512 4c4316a555073c61803ff70317ec21a9ecda5c415c438615ddb6a6cad8751905e93f9c02c4c227807427a2fa050f6fb88c5b107fa9b5e4b31f46e066df7ac301
- SSDEEP 1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoIN:J8dfX7y9DZ+N7eB+tIN
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe - Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE - Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe - Executes dropped EXE 12 IoCs
pid Process 1500 SVCHOST.EXE 3516 SVCHOST.EXE 1168 SVCHOST.EXE 628 SVCHOST.EXE 3964 SVCHOST.EXE 2572 SPOOLSV.EXE 876 SVCHOST.EXE 4288 SVCHOST.EXE 1096 SPOOLSV.EXE 64 SPOOLSV.EXE 684 SVCHOST.EXE 4668 SPOOLSV.EXE - Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Recycled\desktop.ini 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe File opened for modification F:\Recycled\desktop.ini 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\J: 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\G: SPOOLSV.EXE File opened (read-only) \??\Z: 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\H: SPOOLSV.EXE File opened (read-only) \??\J: SPOOLSV.EXE File opened (read-only) \??\W: SPOOLSV.EXE File opened (read-only) \??\Y: SPOOLSV.EXE File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\Q: SPOOLSV.EXE File opened (read-only) \??\T: SPOOLSV.EXE File opened (read-only) \??\T: 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe File opened (read-only) \??\U: 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe File opened (read-only) \??\X: 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\Q: 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\V: SPOOLSV.EXE File opened (read-only) \??\R: 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\O: SPOOLSV.EXE File opened (read-only) \??\Z: SPOOLSV.EXE File opened (read-only) \??\L: 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe File opened (read-only) \??\Y: 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\N: 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\I: SPOOLSV.EXE File opened (read-only) \??\K: SPOOLSV.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\P: SPOOLSV.EXE File opened (read-only) \??\I: 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe File opened (read-only) \??\K: 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe File opened (read-only) \??\P: 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe File opened (read-only) \??\S: 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe File opened (read-only) \??\W: 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\R: SPOOLSV.EXE File opened (read-only) \??\O: 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe File opened (read-only) \??\V: 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\Root\VFS\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\docicon.exe 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Fonts\ Explorer.exe 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe File opened for modification C:\Windows\Fonts\ Explorer.exe SVCHOST.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe SVCHOST.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe SPOOLSV.EXE - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE - Modifies registry class 29 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG\COMMAND 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\*\QuickTip = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\*\InfoTip = "prop:Type;Write;Size" 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\*\QuickTip = "prop:Type;Size" 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SPOOLSV.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\*\TileInfo = "prop:Type;Size" 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\*\TileInfo = "prop:Type;Size" SPOOLSV.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL\COMMAND 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4424 WINWORD.EXE 4424 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1168 SVCHOST.EXE 1168 SVCHOST.EXE 1168 SVCHOST.EXE 1168 SVCHOST.EXE 1168 SVCHOST.EXE 1168 SVCHOST.EXE 1168 SVCHOST.EXE 1168 SVCHOST.EXE 1168 SVCHOST.EXE 1168 SVCHOST.EXE 1168 SVCHOST.EXE 1168 SVCHOST.EXE 1500 SVCHOST.EXE 1500 SVCHOST.EXE 1500 SVCHOST.EXE 1500 SVCHOST.EXE 1500 SVCHOST.EXE 1500 SVCHOST.EXE 1500 SVCHOST.EXE 1500 SVCHOST.EXE 1500 SVCHOST.EXE 1500 SVCHOST.EXE 1500 SVCHOST.EXE 1500 SVCHOST.EXE 4180 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe 4180 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe 4180 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe 4180 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe 4180 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe 4180 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe 4180 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe 4180 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe 4180 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe 4180 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe 4180 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe 4180 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe 2572 SPOOLSV.EXE 2572 SPOOLSV.EXE 2572 SPOOLSV.EXE 2572 SPOOLSV.EXE 2572 SPOOLSV.EXE 2572 SPOOLSV.EXE 2572 SPOOLSV.EXE 2572 SPOOLSV.EXE 2572 SPOOLSV.EXE 2572 SPOOLSV.EXE 2572 SPOOLSV.EXE 2572 SPOOLSV.EXE 1168 SVCHOST.EXE 1168 SVCHOST.EXE 1168 SVCHOST.EXE 1168 SVCHOST.EXE 1168 SVCHOST.EXE 1168 SVCHOST.EXE 1168 SVCHOST.EXE 1168 SVCHOST.EXE 1168 SVCHOST.EXE 1168 SVCHOST.EXE 1168 SVCHOST.EXE 1168 SVCHOST.EXE 1500 SVCHOST.EXE 1500 SVCHOST.EXE 1500 SVCHOST.EXE 1500 SVCHOST.EXE - Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 4180 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe 1500 SVCHOST.EXE 3516 SVCHOST.EXE 1168 SVCHOST.EXE 628 SVCHOST.EXE 3964 SVCHOST.EXE 2572 SPOOLSV.EXE 876 SVCHOST.EXE 4288 SVCHOST.EXE 1096 SPOOLSV.EXE 64 SPOOLSV.EXE 684 SVCHOST.EXE 4668 SPOOLSV.EXE 4424 WINWORD.EXE 4424 WINWORD.EXE 4424 WINWORD.EXE 4424 WINWORD.EXE 4424 WINWORD.EXE 4424 WINWORD.EXE 4424 WINWORD.EXE - Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 4180 wrote to memory of 1500 4180 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe 81 PID 4180 wrote to memory of 1500 4180 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe 81 PID 4180 wrote to memory of 1500 4180 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe 81 PID 1500 wrote to memory of 3516 1500 SVCHOST.EXE 82 PID 1500 wrote to memory of 3516 1500 SVCHOST.EXE 82 PID 1500 wrote to memory of 3516 1500 SVCHOST.EXE 82 PID 1500 wrote to memory of 1168 1500 SVCHOST.EXE 83 PID 1500 wrote to memory of 1168 1500 SVCHOST.EXE 83 PID 1500 wrote to memory of 1168 1500 SVCHOST.EXE 83 PID 1168 wrote to memory of 628 1168 SVCHOST.EXE 84 PID 1168 wrote to memory of 628 1168 SVCHOST.EXE 84 PID 1168 wrote to memory of 628 1168 SVCHOST.EXE 84 PID 1168 wrote to memory of 3964 1168 SVCHOST.EXE 85 PID 1168 wrote to memory of 3964 1168 SVCHOST.EXE 85 PID 1168 wrote to memory of 3964 1168 SVCHOST.EXE 85 PID 1168 wrote to memory of 2572 1168 SVCHOST.EXE 86 PID 1168 wrote to memory of 2572 1168 SVCHOST.EXE 86 PID 1168 wrote to memory of 2572 1168 SVCHOST.EXE 86 PID 2572 wrote to memory of 876 2572 SPOOLSV.EXE 87 PID 2572 wrote to memory of 876 2572 SPOOLSV.EXE 87 PID 2572 wrote to memory of 876 2572 SPOOLSV.EXE 87 PID 2572 wrote to memory of 4288 2572 SPOOLSV.EXE 88 PID 2572 wrote to memory of 4288 2572 SPOOLSV.EXE 88 PID 2572 wrote to memory of 4288 2572 SPOOLSV.EXE 88 PID 2572 wrote to memory of 1096 2572 SPOOLSV.EXE 89 PID 2572 wrote to memory of 1096 2572 SPOOLSV.EXE 89 PID 2572 wrote to memory of 1096 2572 SPOOLSV.EXE 89 PID 1500 wrote to memory of 64 1500 SVCHOST.EXE 90 PID 1500 wrote to memory of 64 1500 SVCHOST.EXE 90 PID 1500 wrote to memory of 64 1500 SVCHOST.EXE 90 PID 4180 wrote to memory of 684 4180 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe 91 PID 4180 wrote to memory of 684 4180 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe 91 PID 4180 wrote to memory of 684 4180 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe 91 PID 4180 wrote to memory of 4668 4180 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe 92 PID 4180 wrote to memory of 4668 4180 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe 92 PID 4180 wrote to memory of 4668 4180 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe 92 PID 4180 wrote to memory of 4424 4180 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe 93 PID 4180 wrote to memory of 4424 4180 556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3516
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:628
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3964
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:876
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4288
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1096
-
-
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:64
-
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:684
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4668
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\556ddbd27314523180e5e7faefaf5420_NeikiAnalytics.doc" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4424
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Recycled\SPOOLSV.EXE
- Size 97KB
- SHA256 6114de5ead14b17b465f45308444b63b30e8309ba473ea6c5d0e8476b9aa300a
- MD5 10cd503f4031273fff7c9096077555a5
- SHA1 072b5d09402185653ead3f182d0548eded5a5f50
- SHA512 f96378b3023ad8286cd1afcda54cc9f726a3d45eaea5badcb99a2dea7d61b8cef60407ab27626419bcd2671bf9fc8e1d9d65836f4ec7bcadc9283076477003dc
- SSDEEP 1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoI6:J8dfX7y9DZ+N7eB+tI6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Recycled\SVCHOST.EXE
- Size 97KB
- SHA256 cd3474a0c48c65d7b27cc70c8cd5915a773d8ece6440fea8281256ecfd27900c
- MD5 dcbedcf601bee8979f691cdb9faff4ca
- SHA1 327fa71aa6fadbe2b9412c58fb744f4c1ff02a80
- SHA512 5a4a9ba386783d1aa671866c53a2e725860764ca71661632a1c915ab6b5ea41357d30bc9f490ce88f5161d5039482ed77cfe9ea0a175dfc260c6b5d21319e468
- SSDEEP 1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoIi:J8dfX7y9DZ+N7eB+tIi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Flu Burung.txt
- Size 2KB
- SHA256 2661c05273f33efa4b7faa6ed8a6f7e69a13ad86077f69ee285ece9cba57e44c
- MD5 1a1dce35d60d2c70ca8894954fd5d384
- SHA1 58547dd65d506c892290755010d0232da34ee000
- SHA512 4abe37613145fabeb44ea4c28ecc827c8a0eb2b003e86ae7aef9be5687711fa7a294f17567ea0a70a6f14ab3cbe7886c83763a7c49278097fd53f0d11fd8154e
- MD5 SHA1 SHA512
- Path C:\Windows\Fonts\ Explorer.exe
- Size 97KB
- SHA256 fd0f63822e9fcb9c2d97410839af50c37f5a1f670e3d0f32f5966d36601dbc02
- MD5 32472d22696abc986ab9b2f8a8c89ee2
- SHA1 1da0407c08ea6f9122aa379130318e3c59af9c34
- SHA512 002048d2d4137fbbbee10e079d973567acc265b0d1e424577516dcd66a622120507861127a96d0085ddc6aba77d57b6f42ae5ba537dfd91ba310021b138054a0
- SSDEEP 1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoIF:J8dfX7y9DZ+N7eB+tIF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\ Explorer.exe
- Size 97KB
- SHA256 8bdf1c42dd605a10319409d9a34b31c2f9fd7ff8a0ad638a7d8b79747a076761
- MD5 807426dcc176790d1e601e64139929b9
- SHA1 e8d49103d5e55453c5dddc92ec51ae5d59a69c2e
- SHA512 5271fd922d1411704525fcbce50618e3025b65dc54ce8d348d232d524527fdf7d60c69e9a6f001fd7b9e7b25e95ac58524e0b1ac53ece755e995b7634fe8df1e
- SSDEEP 1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoI5:J8dfX7y9DZ+N7eB+tI5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\ Explorer.exe
- Size 97KB
- SHA256 10dcd22fa72a9f3c48e7eef139731e2f84338f017a034b701e43483cecb6bd0f
- MD5 19075879b5ad083e01463b49f5c99617
- SHA1 9238edfeb7ebcafb08e4933edde48853ec7befb1
- SHA512 018732e9ba607d3b2591af63bc285bfc1c012a73c444a2c114b71a25ec6fc15060658cdfeaa83c7c98488a29907c008e2d7f7ffc850efeb08d3f42e292ba115e
- SSDEEP 1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoIl:J8dfX7y9DZ+N7eB+tIl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\begolu.txt
- Size 2B
- SHA256 4658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
- MD5 2b9d4fa85c8e82132bde46b143040142
- SHA1 a02431cf7c501a5b368c91e41283419d8fa9fb03
- SHA512 c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
- MD5 SHA1 SHA512
- Path F:\Recycled\SVCHOST.EXE
- Size 97KB
- SHA256 a624823f11c7cf220b9ef464ecbf86f6e0ec41de0c34ae8d2b98ee8f0434b588
- MD5 f18083129d23c2f98006862aa6684cef
- SHA1 0043c0bd2f0eb9e4740aafe5e9df59e667d0ee25
- SHA512 e38637e09d53ebf84ce6e6f1fcca49d6bcc55296f48deac3173be3a46fbc7b3144f424a20da14766445969acfe3cbfc7c46eb4441e1c2a4e99dc4737db18770b
- SSDEEP 1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoIx:J8dfX7y9DZ+N7eB+tIx
- MD5 SHA1 SHA512 SSDEEP