d233dc1c042d433e935b0f98f06985c13eb6eed41e3d60fb169f7460dca85107

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 04:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
Size 91KB
Sample240614-envklaycmj
SHA256 d233dc1c042d433e935b0f98f06985c13eb6eed41e3d60fb169f7460dca85107
MD5 a0f7c22a863f681a55c0f86018051ac0
SHA1 97eff444183a626578dd2f3bfe87885d8e71c246
SHA512 5d1467db44a54c7ace9c17d2de4cd8905178ed64c40de5a7f221ff2fc511b6fad3c9cc852fccf38350d3f63e536a23fba0e4413cfb37f50f68863e1ee13c9b99
SSDEEP 1536:zAwEmBZ04faWmtN4nic+6G+AwEmBZ04faWmtN4nic+6Gf:zGms4Eton0+Gms4Eton0f
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 14 IoCs

pid	Process
2192	xk.exe
3800	IExplorer.exe
1380	WINLOGON.EXE
884	CSRSS.EXE
4480	SERVICES.EXE
2872	LSASS.EXE
1504	SMSS.EXE
5108	xk.exe
1652	IExplorer.exe
4580	WINLOGON.EXE
1732	CSRSS.EXE
1360	SERVICES.EXE
2100	LSASS.EXE
1004	SMSS.EXE

Modifies system executable filetype association 2 TTPs 13 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe"	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	C:\desktop.ini	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
File created	C:\desktop.ini	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
File opened for modification	F:\desktop.ini	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
File created	F:\desktop.ini	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
File opened (read-only)	\??\X:	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
File opened (read-only)	\??\K:	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
File opened (read-only)	\??\N:	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
File opened (read-only)	\??\O:	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
File opened (read-only)	\??\Q:	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
File opened (read-only)	\??\S:	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
File opened (read-only)	\??\B:	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
File opened (read-only)	\??\H:	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
File opened (read-only)	\??\L:	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
File opened (read-only)	\??\R:	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
File opened (read-only)	\??\T:	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
File opened (read-only)	\??\E:	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
File opened (read-only)	\??\P:	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
File opened (read-only)	\??\W:	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
File opened (read-only)	\??\Z:	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
File opened (read-only)	\??\Y:	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
File opened (read-only)	\??\G:	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
File opened (read-only)	\??\I:	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
File opened (read-only)	\??\J:	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
File opened (read-only)	\??\M:	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
File opened (read-only)	\??\U:	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Mig2.scr	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\shell.exe	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Mig2.scr	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\xk.exe	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
File created	C:\Windows\xk.exe	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR"	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe

Modifies registry class 15 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2272	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
2272	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
2272	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
2192	xk.exe
3800	IExplorer.exe
1380	WINLOGON.EXE
884	CSRSS.EXE
4480	SERVICES.EXE
2872	LSASS.EXE
1504	SMSS.EXE
5108	xk.exe
1652	IExplorer.exe
4580	WINLOGON.EXE
1732	CSRSS.EXE
1360	SERVICES.EXE
2100	LSASS.EXE
1004	SMSS.EXE

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2192	2272	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe	91
PID 2272 wrote to memory of 2192	2272	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe	91
PID 2272 wrote to memory of 2192	2272	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe	91
PID 2272 wrote to memory of 3800	2272	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe	92
PID 2272 wrote to memory of 3800	2272	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe	92
PID 2272 wrote to memory of 3800	2272	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe	92
PID 2272 wrote to memory of 1380	2272	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe	93
PID 2272 wrote to memory of 1380	2272	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe	93
PID 2272 wrote to memory of 1380	2272	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe	93
PID 2272 wrote to memory of 884	2272	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe	94
PID 2272 wrote to memory of 884	2272	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe	94
PID 2272 wrote to memory of 884	2272	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe	94
PID 2272 wrote to memory of 4480	2272	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe	95
PID 2272 wrote to memory of 4480	2272	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe	95
PID 2272 wrote to memory of 4480	2272	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe	95
PID 2272 wrote to memory of 2872	2272	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe	96
PID 2272 wrote to memory of 2872	2272	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe	96
PID 2272 wrote to memory of 2872	2272	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe	96
PID 2272 wrote to memory of 1504	2272	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe	97
PID 2272 wrote to memory of 1504	2272	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe	97
PID 2272 wrote to memory of 1504	2272	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe	97
PID 2272 wrote to memory of 5108	2272	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe	103
PID 2272 wrote to memory of 5108	2272	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe	103
PID 2272 wrote to memory of 5108	2272	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe	103
PID 2272 wrote to memory of 1652	2272	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe	104
PID 2272 wrote to memory of 1652	2272	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe	104
PID 2272 wrote to memory of 1652	2272	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe	104
PID 2272 wrote to memory of 4580	2272	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe	105
PID 2272 wrote to memory of 4580	2272	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe	105
PID 2272 wrote to memory of 4580	2272	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe	105
PID 2272 wrote to memory of 1732	2272	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe	106
PID 2272 wrote to memory of 1732	2272	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe	106
PID 2272 wrote to memory of 1732	2272	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe	106
PID 2272 wrote to memory of 1360	2272	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe	107
PID 2272 wrote to memory of 1360	2272	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe	107
PID 2272 wrote to memory of 1360	2272	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe	107
PID 2272 wrote to memory of 2100	2272	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe	108
PID 2272 wrote to memory of 2100	2272	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe	108
PID 2272 wrote to memory of 2100	2272	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe	108
PID 2272 wrote to memory of 1004	2272	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe	109
PID 2272 wrote to memory of 1004	2272	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe	109
PID 2272 wrote to memory of 1004	2272	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe	109

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Modifies system executable filetype association
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2272
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2192
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3800
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1380
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:884
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4480
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2872
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1504
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5108
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1652
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4580
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1732
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1360
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2100
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4068 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:4624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

CSRSS.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE
Size 91KB
SHA256 17f9154e8b057a6a5e348aa370dc34093b0cb2653100b31a13e7c03011f84185
MD5 c03f2f6edd8dfabb94929c1865a515a9
SHA1 df08140d0d1e2f3c0ddf3ee30260929b46cb41c6
SHA512 145086f2e9f8efe672874e9ebcc0e7a630421a284878055fdb3333cffdc87a7c08d69cff429fb5a46e054f65a3aa04b728251c4126a61b072465648d4b8a7694
SSDEEP 1536:zAwEmBZ04faWmtN4nic+6G2AwEmBZ04faWmtN4nic+6Gf:zGms4Eton02Gms4Eton0f
MD5 SHA1 SHA512 SSDEEP

Submit Download

LSASS.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE
Size 91KB
SHA256 d20984cde6c15129731cb8102c1c6aa3b7bbabcb2957ad035441873161f0809f
MD5 81db2d0ba3ca1635be2264169b96b54d
SHA1 9dd290e4a4a7665d4672a01a3996c319ddec51b7
SHA512 937c41e3b0079e3f8e12a3689c52d715bd89dd6c71593382d4251743526ef14bc723e891eba3532d0fcf372071c93305dfd650129435a0df67ab5d0df2215c52
SSDEEP 1536:zAwEmBZ04faWmtN4nic+6GdAwEmBZ04faWmtN4nic+6Gf:zGms4Eton0dGms4Eton0f
MD5 SHA1 SHA512 SSDEEP

Submit Download

LSASS.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE
Size 91KB
SHA256 124af05d72e001e5bce8c0c6db66b7ead2c9bf957fe5d83bf13802c181eeb059
MD5 d178230d8f68b78cae71fca06d0d8d05
SHA1 7b175464acdf67397f12ed00ab6183293db60837
SHA512 7448d1c473d4ae09a9d624df0df65ea5261b7d75eaae6849e3b94fcdffa6ba1eafdfd99093f85e6b27d35789991be9669ce298af2ba64ba9a582a3573d0dbf89
SSDEEP 1536:zAwEmBZ04faWmtN4nic+6GpAwEmBZ04faWmtN4nic+6Gf:zGms4Eton0pGms4Eton0f
MD5 SHA1 SHA512 SSDEEP

Submit Download

SERVICES.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
Size 91KB
SHA256 3b001194941450645e86ae5cf67f6adbe0547ea8956c27326d661a7dd9c2cbd9
MD5 0f5f6b80e313a9c196df1c7737c9d1ae
SHA1 21f1fb32506d0994a8716a23632ca57656a2f89a
SHA512 08089608db1339428b58ef210d39e37d1d91a9e2f896f70826e8a41bffbb718069c15d59bff39a0e13e3147734bc981707b55075994f93258a7e71c918c4a618
SSDEEP 1536:zAwEmBZ04faWmtN4nic+6GmAwEmBZ04faWmtN4nic+6Gf:zGms4Eton0mGms4Eton0f
MD5 SHA1 SHA512 SSDEEP

Submit Download

SERVICES.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
Size 91KB
SHA256 26b55e6e2e1ea540ff34317afd5abcb0da0f0885505604b092aff2805b763b68
MD5 cd203e679318d31d8335953646160a9c
SHA1 ded4d4f4b7c34a7ad8ddaa450bb18c813f3327ae
SHA512 f2feb61df771a9b1b8b4906e7956f964d4a8481109dcec0d919e2b7ce71575a3a08b9cdb58493260853b4f57dd3a7ec35a85d6fd4feffddc610b5aa1c4fa03e5
SSDEEP 1536:zAwEmBZ04faWmtN4nic+6GQAwEmBZ04faWmtN4nic+6Gf:zGms4Eton0QGms4Eton0f
MD5 SHA1 SHA512 SSDEEP

Submit Download

SMSS.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE
Size 91KB
SHA256 a016ac01c735f251eb806e6b4d5d509f22d3413f270917e42affb20d40b170d8
MD5 6b3a39ca2005a67a9d9875e4b6c11cb6
SHA1 8cfc4df19f617aa8d0b5229201bbcaba0d4f5784
SHA512 9033ac731cb29fc08aa9a4775c81bdb1988ea95537b9007d6c2214157443f4b2be155de498aac6f750164d613edeaacbeae1049b230c2fc8ba6b07867ed74226
SSDEEP 1536:zAwEmBZ04faWmtN4nic+6GiAwEmBZ04faWmtN4nic+6Gf:zGms4Eton0iGms4Eton0f
MD5 SHA1 SHA512 SSDEEP

Submit Download

SMSS.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE
Size 91KB
SHA256 9c9629454af919d04a60c31685e07e9993c3542e69fe0272318f987c8da30078
MD5 94a96090f1269031dbeb1fc5d1cc2046
SHA1 a260196bfcf772dd5190c36a00c4cc93328230ac
SHA512 8f2d82031d0e041a941204b428e921d7e1f307ee4c5d078ba3a10c9f353bd88b80cfebc502c515b875c5e77debb59f60e803e18246dcd6ce3d24e1baaf8c6ea4
SSDEEP 1536:zAwEmBZ04faWmtN4nic+6GCAwEmBZ04faWmtN4nic+6Gf:zGms4Eton0CGms4Eton0f
MD5 SHA1 SHA512 SSDEEP

Submit Download

WINLOGON.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
Size 91KB
SHA256 f71121e4b8e8c3367e1ed8e06545eef7375f39df3195d5c9076105d743e0f89a
MD5 224d7657aa0eb89f41d237ba2604052f
SHA1 78597312a40ac3b4da25930fcf8b1c46cfaf57c2
SHA512 7130e062bf68cf20e72a5854b202446002f50e9be750ae1a4996f1ae79c44cc6c292c7eff0b9eed7e19c16617b8fa812d7820be7b285ea91de2ee74eb791b21c
SSDEEP 1536:zAwEmBZ04faWmtN4nic+6GHAwEmBZ04faWmtN4nic+6Gf:zGms4Eton0HGms4Eton0f
MD5 SHA1 SHA512 SSDEEP

Submit Download

WINLOGON.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
Size 91KB
SHA256 ab119654d0f69d7796b13aa8a17406b984867a55617990773fa81db5768b3bb2
MD5 24dab1fe576795fb01b8709a2bc4f1f9
SHA1 588cbbb1b4757f7bf6c06abcd2588b836af1f78b
SHA512 9636c64fdb8f0254e35a950e69ade0941d7545e30b3a22de8a6ffd8ed63a03597541e014a856073e25a0a7773bfb291732d50559d995dd91f280d755b4116c7b
SSDEEP 1536:zAwEmBZ04faWmtN4nic+6GPAwEmBZ04faWmtN4nic+6Gf:zGms4Eton0PGms4Eton0f
MD5 SHA1 SHA512 SSDEEP

Submit Download

CSRSS.EXE

Path C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
Size 91KB
SHA256 a8ad708ec6c3e77c3ede42c2196e7a11ee10d20a4c3f3bcb0d757e776f69d43a
MD5 7810d5c650fcbed39ee84e1712f44103
SHA1 40484b998bba4b12f1f910fe6dd6d304ee03dab2
SHA512 d8994987e537d3bcdf226fac76666d525583f1bca856d0381876b3d9996df39d6882f191d1617487ec052753cd4375223db39c1cc0a2f868634a9812e521d84c
SSDEEP 1536:zAwEmBZ04faWmtN4nic+6G+AwEmBZ04faWmtN4nic+6Gf:zGms4Eton0+Gms4Eton0f
MD5 SHA1 SHA512 SSDEEP

Submit Download

IExplorer.exe

Path C:\Windows\SysWOW64\IExplorer.exe
Size 91KB
SHA256 1b6f7d636faeaf91e289414c2bc8c9640d4de1d9b52121bc2b03ed1ce1a6fa03
MD5 087669473733b504e570e1a6db72f00f
SHA1 445a7d357afe694d601eb9036220ad312917ff68
SHA512 7959adf04524a3a2401f1b0314136936437e072e70f833af4c0ff9739315de7d5a1956a1ae361add6612324ebceb63c88ad09584d55e9ea2e10721b0cb9d2aff
SSDEEP 1536:zAwEmBZ04faWmtN4nic+6GyAwEmBZ04faWmtN4nic+6Gf:zGms4Eton0yGms4Eton0f
MD5 SHA1 SHA512 SSDEEP

Submit Download

IExplorer.exe

Path C:\Windows\SysWOW64\IExplorer.exe
Size 91KB
SHA256 f0a486d16dfa2b23b98ce7479f2913caf12746c92169dd4603da6af42dc8ec45
MD5 4d9c20634ccce3db5069a462a13caff8
SHA1 4f0ff0a874ee7102ee3749020e6bed5adb0ac6bb
SHA512 72ac0be58f369d9f605237974bb89d89f01ec3a18094a1ba8c1efee04d0beaf6a64c298149a034a4453e347ba7cc3408575ae8ad57a8c546d789e8c8672b7e17
SSDEEP 1536:zAwEmBZ04faWmtN4nic+6GfAwEmBZ04faWmtN4nic+6Gf:zGms4Eton0fGms4Eton0f
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mig2.scr

Path C:\Windows\SysWOW64\Mig2.scr
Size 91KB
SHA256 d233dc1c042d433e935b0f98f06985c13eb6eed41e3d60fb169f7460dca85107
MD5 a0f7c22a863f681a55c0f86018051ac0
SHA1 97eff444183a626578dd2f3bfe87885d8e71c246
SHA512 5d1467db44a54c7ace9c17d2de4cd8905178ed64c40de5a7f221ff2fc511b6fad3c9cc852fccf38350d3f63e536a23fba0e4413cfb37f50f68863e1ee13c9b99
SSDEEP 1536:zAwEmBZ04faWmtN4nic+6G+AwEmBZ04faWmtN4nic+6Gf:zGms4Eton0+Gms4Eton0f
MD5 SHA1 SHA512 SSDEEP

Submit Download

xk.exe

Path C:\Windows\xk.exe
Size 91KB
SHA256 c986e6382d1829e8c908a0d1483bff7a21a154b0b2442fe297af65aa629a948a
MD5 ae0d37e9d5d94bcaa0b640b1f4b61b20
SHA1 e6bc9759106c5f6f5cb97e4833910a3440a3a81a
SHA512 788b9dcec59086cae075b6006178eec1e913db15b446387b2258ef5b040a7d4c6b2a5c385d8b8c50a1d62e44a5d615d25890dcd52d80f794224c12d4ee5e7639
SSDEEP 1536:zAwEmBZ04faWmtN4nic+6GQ6AwEmBZ04faWmtN4nic+6Gf:zGms4Eton0Q6Gms4Eton0f
MD5 SHA1 SHA512 SSDEEP

Submit Download

xk.exe

Path C:\Windows\xk.exe
Size 91KB
SHA256 32a18b2956316bca047175d0d302796c1b3151073375609b5e1a5c74ad45e1d4
MD5 a7ca9a9cdb3c1333eefc889ccac8a102
SHA1 e529a6cff15eed86e54ba8b4ad33f3af215ec763
SHA512 1f4b086444ab6a1558349df647c99e54e2b2cb8d7d9d8bc6e2229c9b173349ec17eac6a6b36b13f40677b1815339d65fd90706cb3e5b4b42588bcf212627a25c
SSDEEP 1536:zAwEmBZ04faWmtN4nic+6GfAwEmBZ04faWmtN4nic+6Gf:zGms4Eton0fGms4Eton0f
MD5 SHA1 SHA512 SSDEEP

Submit Download

Folder.htt

Path C:\XK\Folder.htt
Size 640B
SHA256 fe222b08327bbfb35cbd627c0526ba7b5755b02ce0a95823a4c0bf58e601d061
MD5 5d142e7978321fde49abd9a068b64d97
SHA1 70020fcf7f3d6dafb6c8cd7a55395196a487bef4
SHA512 2351284652a9a1b35006baf4727a85199406e464ac33cb4701a6182e1076aaff022c227dbe4ad6e916eba15ebad08b10719a8e86d5a0f89844a163a7d4a7bbf9
MD5 SHA1 SHA512

Submit Download

desktop.ini

Path C:\desktop.ini
Size 217B
SHA256 52fb776a91b260bf196016ecb195550cdd9084058fe7b4dd3fe2d4fda1b6470e
MD5 c00d8433fe598abff197e690231531e0
SHA1 4f6b87a4327ff5343e9e87275d505b9f145a7e42
SHA512 a71523ec2bd711e381a37baabd89517dff6c6530a435f4382b7f4056f98aff5d6014e85ce3b79bd1f02fdd6adc925cd3fc051752c1069e9eb511a465cd9908e1
MD5 SHA1 SHA512

Submit Download

memory/884-72-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1004-275-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1360-253-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1380-66-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1504-94-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1652-237-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1732-250-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2100-260-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2192-56-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2272-0-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2272-120-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2272-295-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/2872-87-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3800-59-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4480-80-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4480-76-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/4580-242-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5108-231-0x0000000000400000-0x000000000042E000-memory.dmp

Download