Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 09:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe
Resource
win7-20240611-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe
- Size 97KB
- Sample240613-lv3ccatdnf
- SHA256 d7d57203952c0d287558ff2c1b137b99f1a6d0ebc073b4e236420762138223c1
- MD5 71ff8da5d651ffd6d345c01e81344820
- SHA1 b409a635ee7f52cb45db4ec30d4ff9c49b0454de
- SHA512 468557bb3802070d9cea4cf69f98669a359bcf28bd31ed43b25fb861ee150689e07023f4accbb96756c32ba12c7a0b6ee6b890577d9aaaa7b7c4f583fb57150e
- SSDEEP 1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoIt:J8dfX7y9DZ+N7eB+tIt
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SPOOLSV.EXE - Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SPOOLSV.EXE - Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SPOOLSV.EXE - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe - Executes dropped EXE 12 IoCs
pid Process 1544 SVCHOST.EXE 1752 SVCHOST.EXE 3900 SVCHOST.EXE 3052 SVCHOST.EXE 2128 SVCHOST.EXE 2204 SPOOLSV.EXE 3116 SVCHOST.EXE 4844 SVCHOST.EXE 992 SPOOLSV.EXE 3520 SPOOLSV.EXE 4180 SVCHOST.EXE 3656 SPOOLSV.EXE - Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Recycled\desktop.ini 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe File opened for modification F:\Recycled\desktop.ini 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\L: SPOOLSV.EXE File opened (read-only) \??\R: 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe File opened (read-only) \??\T: 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\Q: SPOOLSV.EXE File opened (read-only) \??\L: 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe File opened (read-only) \??\V: 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\P: SPOOLSV.EXE File opened (read-only) \??\W: 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\N: SPOOLSV.EXE File opened (read-only) \??\Y: SPOOLSV.EXE File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\G: SPOOLSV.EXE File opened (read-only) \??\K: 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe File opened (read-only) \??\U: 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe File opened (read-only) \??\H: SPOOLSV.EXE File opened (read-only) \??\R: SPOOLSV.EXE File opened (read-only) \??\V: SPOOLSV.EXE File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\H: 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe File opened (read-only) \??\P: 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe File opened (read-only) \??\Q: 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\I: 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe File opened (read-only) \??\N: 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe File opened (read-only) \??\X: 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\T: SPOOLSV.EXE File opened (read-only) \??\S: 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\S: SPOOLSV.EXE File opened (read-only) \??\Y: 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe File opened (read-only) \??\Z: 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\O: SPOOLSV.EXE File opened (read-only) \??\E: 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe File opened (read-only) \??\M: SPOOLSV.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\Root\VFS\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\docicon.exe 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Fonts\ Explorer.exe 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe File opened for modification C:\Windows\Fonts\ Explorer.exe SVCHOST.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe SVCHOST.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe SPOOLSV.EXE - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 29 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\*\QuickTip = "prop:Type;Size" 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG\COMMAND 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\*\TileInfo = "prop:Type;Size" 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\*\TileInfo = "prop:Type;Size" SPOOLSV.EXE Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SPOOLSV.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\*\InfoTip = "prop:Type;Write;Size" 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL\COMMAND 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\*\QuickTip = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 724 WINWORD.EXE 724 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1544 SVCHOST.EXE 1544 SVCHOST.EXE 1544 SVCHOST.EXE 1544 SVCHOST.EXE 1544 SVCHOST.EXE 1544 SVCHOST.EXE 1544 SVCHOST.EXE 1544 SVCHOST.EXE 1544 SVCHOST.EXE 1544 SVCHOST.EXE 1544 SVCHOST.EXE 1544 SVCHOST.EXE 3900 SVCHOST.EXE 3900 SVCHOST.EXE 3900 SVCHOST.EXE 3900 SVCHOST.EXE 3900 SVCHOST.EXE 3900 SVCHOST.EXE 3900 SVCHOST.EXE 3900 SVCHOST.EXE 3900 SVCHOST.EXE 3900 SVCHOST.EXE 3900 SVCHOST.EXE 3900 SVCHOST.EXE 2156 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe 2156 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe 2156 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe 2156 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe 2156 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe 2156 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe 2156 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe 2156 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe 2156 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe 2156 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe 2156 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe 2156 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe 2204 SPOOLSV.EXE 2204 SPOOLSV.EXE 2204 SPOOLSV.EXE 2204 SPOOLSV.EXE 2204 SPOOLSV.EXE 2204 SPOOLSV.EXE 2204 SPOOLSV.EXE 2204 SPOOLSV.EXE 2204 SPOOLSV.EXE 2204 SPOOLSV.EXE 2204 SPOOLSV.EXE 2204 SPOOLSV.EXE 1544 SVCHOST.EXE 1544 SVCHOST.EXE 1544 SVCHOST.EXE 1544 SVCHOST.EXE 1544 SVCHOST.EXE 1544 SVCHOST.EXE 1544 SVCHOST.EXE 1544 SVCHOST.EXE 1544 SVCHOST.EXE 1544 SVCHOST.EXE 1544 SVCHOST.EXE 1544 SVCHOST.EXE 3900 SVCHOST.EXE 3900 SVCHOST.EXE 3900 SVCHOST.EXE 3900 SVCHOST.EXE - Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 2156 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe 1544 SVCHOST.EXE 1752 SVCHOST.EXE 3900 SVCHOST.EXE 3052 SVCHOST.EXE 2128 SVCHOST.EXE 2204 SPOOLSV.EXE 3116 SVCHOST.EXE 4844 SVCHOST.EXE 992 SPOOLSV.EXE 3520 SPOOLSV.EXE 4180 SVCHOST.EXE 3656 SPOOLSV.EXE 724 WINWORD.EXE 724 WINWORD.EXE 724 WINWORD.EXE 724 WINWORD.EXE 724 WINWORD.EXE 724 WINWORD.EXE 724 WINWORD.EXE - Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2156 wrote to memory of 1544 2156 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe 81 PID 2156 wrote to memory of 1544 2156 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe 81 PID 2156 wrote to memory of 1544 2156 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe 81 PID 1544 wrote to memory of 1752 1544 SVCHOST.EXE 82 PID 1544 wrote to memory of 1752 1544 SVCHOST.EXE 82 PID 1544 wrote to memory of 1752 1544 SVCHOST.EXE 82 PID 1544 wrote to memory of 3900 1544 SVCHOST.EXE 84 PID 1544 wrote to memory of 3900 1544 SVCHOST.EXE 84 PID 1544 wrote to memory of 3900 1544 SVCHOST.EXE 84 PID 3900 wrote to memory of 3052 3900 SVCHOST.EXE 85 PID 3900 wrote to memory of 3052 3900 SVCHOST.EXE 85 PID 3900 wrote to memory of 3052 3900 SVCHOST.EXE 85 PID 3900 wrote to memory of 2128 3900 SVCHOST.EXE 86 PID 3900 wrote to memory of 2128 3900 SVCHOST.EXE 86 PID 3900 wrote to memory of 2128 3900 SVCHOST.EXE 86 PID 3900 wrote to memory of 2204 3900 SVCHOST.EXE 87 PID 3900 wrote to memory of 2204 3900 SVCHOST.EXE 87 PID 3900 wrote to memory of 2204 3900 SVCHOST.EXE 87 PID 2204 wrote to memory of 3116 2204 SPOOLSV.EXE 89 PID 2204 wrote to memory of 3116 2204 SPOOLSV.EXE 89 PID 2204 wrote to memory of 3116 2204 SPOOLSV.EXE 89 PID 2204 wrote to memory of 4844 2204 SPOOLSV.EXE 91 PID 2204 wrote to memory of 4844 2204 SPOOLSV.EXE 91 PID 2204 wrote to memory of 4844 2204 SPOOLSV.EXE 91 PID 2204 wrote to memory of 992 2204 SPOOLSV.EXE 92 PID 2204 wrote to memory of 992 2204 SPOOLSV.EXE 92 PID 2204 wrote to memory of 992 2204 SPOOLSV.EXE 92 PID 1544 wrote to memory of 3520 1544 SVCHOST.EXE 93 PID 1544 wrote to memory of 3520 1544 SVCHOST.EXE 93 PID 1544 wrote to memory of 3520 1544 SVCHOST.EXE 93 PID 2156 wrote to memory of 4180 2156 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe 94 PID 2156 wrote to memory of 4180 2156 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe 94 PID 2156 wrote to memory of 4180 2156 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe 94 PID 2156 wrote to memory of 3656 2156 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe 95 PID 2156 wrote to memory of 3656 2156 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe 95 PID 2156 wrote to memory of 3656 2156 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe 95 PID 2156 wrote to memory of 724 2156 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe 96 PID 2156 wrote to memory of 724 2156 71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1752
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3052
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2128
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3116
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4844
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:992
-
-
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3520
-
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4180
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3656
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\71ff8da5d651ffd6d345c01e81344820_NeikiAnalytics.doc" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:724
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Recycled\SPOOLSV.EXE
- Size 97KB
- SHA256 d72fd96eadfafe9b6743faf814116a0ed7ee283b374bca8c102b948e35c57abc
- MD5 1274a1c1aba659ff47eff3b2b7e94331
- SHA1 6dfd7431c681913bbdd2cc18a2c90a1da06281af
- SHA512 f39d93da2b888f3d2e4d23b6bcca5b75cf89d0c9983d70fe9a17b5c4ed9671c1d1794e8c180a61742e1c73f9638c28bdfdf44aa1fb9fce9410a2374ef3e765cc
- SSDEEP 1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoIs:J8dfX7y9DZ+N7eB+tIs
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Recycled\SVCHOST.EXE
- Size 97KB
- SHA256 da7cb7964af92ef6f00b28cacb1b2bee14807aadf4d87dabc8850aab2358a1de
- MD5 09506e9a7db40176a3179176da907678
- SHA1 63ecb57829032dbed1c2609d905c95a79780c562
- SHA512 04ffd79a015fe988029f165a604c52f0a0c46b27208559d5e266c0ff245788eb1601721c1ac9dea9acd8d323b06e94f429b1ec29f7692a21a610f98590802148
- SSDEEP 1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoIb:J8dfX7y9DZ+N7eB+tIb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Flu Burung.txt
- Size 2KB
- SHA256 2661c05273f33efa4b7faa6ed8a6f7e69a13ad86077f69ee285ece9cba57e44c
- MD5 1a1dce35d60d2c70ca8894954fd5d384
- SHA1 58547dd65d506c892290755010d0232da34ee000
- SHA512 4abe37613145fabeb44ea4c28ecc827c8a0eb2b003e86ae7aef9be5687711fa7a294f17567ea0a70a6f14ab3cbe7886c83763a7c49278097fd53f0d11fd8154e
- MD5 SHA1 SHA512
- Path C:\Windows\Fonts\ Explorer.exe
- Size 97KB
- SHA256 1555c2f53f1ae3b81a815334d0f3525652a9dceb3eb8c922adb6eb67e4b6d2a8
- MD5 2ed4167f342717b0d67262b38a9cf400
- SHA1 1285f01c18a39f1b0cfc0e71c43d936d8ba861da
- SHA512 9ae71d5feec2fd352dabcf51a1587b3b4684825558f1517f2417e5ec98c2600514f424f6ef24f63ab03e31e989bdbcda8ffa802a76a41ea769c63e97a4575528
- SSDEEP 1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoI9:J8dfX7y9DZ+N7eB+tI9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\ Explorer.exe
- Size 97KB
- SHA256 fd5d1530c16e78b2cce33f045bb501777fa80880b196e0b9b1a6ca86b6543b91
- MD5 da320672f25feb01cbe973f98aaef470
- SHA1 a31fe66be6b20d6678cbb45aeb5d6408ee8ea10e
- SHA512 4954e0a9da62ae1ac3cc8394b8bd9d758fc29ac51878e529cc43bec65143284e22bd1b2e73f9d331b8970f1d188e918ec0a1fd3da58e1319c7f91b07d166b88a
- SSDEEP 1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoIU:J8dfX7y9DZ+N7eB+tIU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\ Explorer.exe
- Size 97KB
- SHA256 9c7af3ec58d55d4aa6644ca192581f8614b61d1b140c4be46ddb286d0093ba3e
- MD5 494975feb2b085509657bae1f9126a25
- SHA1 c1e84fcf37968d1316ec2eba978d05b8092dc170
- SHA512 873ad1f3475a4f4714ad100e180d72fda229d298f056ea779683ae6ac6e661e21664be21d9030af874f5e4eb0045940a8c0d42f3cdba92479fff75645bb75c6d
- SSDEEP 1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoI5:J8dfX7y9DZ+N7eB+tI5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\begolu.txt
- Size 2B
- SHA256 4658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
- MD5 2b9d4fa85c8e82132bde46b143040142
- SHA1 a02431cf7c501a5b368c91e41283419d8fa9fb03
- SHA512 c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
- MD5 SHA1 SHA512
- Path F:\Recycled\SVCHOST.EXE
- Size 97KB
- SHA256 1b32f1089d9f44da43db7c0b7eed6b73164dde1a0a9b688c9230e5d7cb92fa24
- MD5 3bb4baab3399801f9e44e18d7244db49
- SHA1 6c816984cf88bf2e86cd31dd61e4b5279a2045eb
- SHA512 98cc35113c385b092adf82911553551352f27776b5964409166936187898649caaf873e0e1819500edfe26753cf42a331f7961ce469e2ae2b6a1ef48906f62f9
- SSDEEP 1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoIi:J8dfX7y9DZ+N7eB+tIi
- MD5 SHA1 SHA512 SSDEEP