Malware Analysis Report

2025-01-06 11:57

Sample ID 240614-envklaycmj
Target a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe
SHA256 d233dc1c042d433e935b0f98f06985c13eb6eed41e3d60fb169f7460dca85107
Tags
evasion persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d233dc1c042d433e935b0f98f06985c13eb6eed41e3d60fb169f7460dca85107

Threat Level: Known bad

The file a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

evasion persistence

Modifies visiblity of hidden/system files in Explorer

Modifies WinLogon for persistence

Modifies visibility of file extensions in Explorer

Disables RegEdit via registry modification

Disables use of System Restore points

Loads dropped DLL

Executes dropped EXE

Modifies system executable filetype association

Drops desktop.ini file(s)

Adds Run key to start application

Enumerates connected drives

Drops file in System32 directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: AddClipboardFormatListener

Modifies Internet Explorer settings

Suspicious use of SetWindowsHookEx

Suspicious use of FindShellTrayWindow

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

Modifies Control Panel

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of SendNotifyMessage

System policy modification

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-14 04:05

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 04:05

Reported

2024-06-14 04:08

Platform

win10v2004-20240226-en

Max time kernel

142s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\"" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A

Disables use of System Restore points

evasion

Modifies system executable filetype association

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\Mig2.scr C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\shell.exe C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File created C:\Windows\SysWOW64\shell.exe C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File created C:\Windows\SysWOW64\Mig2.scr C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File created C:\Windows\SysWOW64\IExplorer.exe C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\IExplorer.exe C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\xk.exe C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File created C:\Windows\xk.exe C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\ C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2272 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Windows\xk.exe
PID 2272 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Windows\xk.exe
PID 2272 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Windows\xk.exe
PID 2272 wrote to memory of 3800 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Windows\SysWOW64\IExplorer.exe
PID 2272 wrote to memory of 3800 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Windows\SysWOW64\IExplorer.exe
PID 2272 wrote to memory of 3800 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Windows\SysWOW64\IExplorer.exe
PID 2272 wrote to memory of 1380 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
PID 2272 wrote to memory of 1380 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
PID 2272 wrote to memory of 1380 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
PID 2272 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
PID 2272 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
PID 2272 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
PID 2272 wrote to memory of 4480 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
PID 2272 wrote to memory of 4480 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
PID 2272 wrote to memory of 4480 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
PID 2272 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
PID 2272 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
PID 2272 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
PID 2272 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
PID 2272 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
PID 2272 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
PID 2272 wrote to memory of 5108 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Windows\xk.exe
PID 2272 wrote to memory of 5108 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Windows\xk.exe
PID 2272 wrote to memory of 5108 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Windows\xk.exe
PID 2272 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Windows\SysWOW64\IExplorer.exe
PID 2272 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Windows\SysWOW64\IExplorer.exe
PID 2272 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Windows\SysWOW64\IExplorer.exe
PID 2272 wrote to memory of 4580 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
PID 2272 wrote to memory of 4580 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
PID 2272 wrote to memory of 4580 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
PID 2272 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
PID 2272 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
PID 2272 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
PID 2272 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
PID 2272 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
PID 2272 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
PID 2272 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
PID 2272 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
PID 2272 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
PID 2272 wrote to memory of 1004 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
PID 2272 wrote to memory of 1004 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
PID 2272 wrote to memory of 1004 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe"

C:\Windows\xk.exe

C:\Windows\xk.exe

C:\Windows\SysWOW64\IExplorer.exe

C:\Windows\system32\IExplorer.exe

C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE

"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"

C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE

"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"

C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE

"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"

C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE

"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"

C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE

"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"

C:\Windows\xk.exe

C:\Windows\xk.exe

C:\Windows\SysWOW64\IExplorer.exe

C:\Windows\system32\IExplorer.exe

C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE

"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"

C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE

"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"

C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE

"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"

C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE

"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"

C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE

"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4068 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 20.231.121.79:80 tcp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 102.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 174.117.168.52.in-addr.arpa udp

Files

memory/2272-0-0x0000000000400000-0x000000000042E000-memory.dmp

C:\Windows\SysWOW64\Mig2.scr

MD5 a0f7c22a863f681a55c0f86018051ac0
SHA1 97eff444183a626578dd2f3bfe87885d8e71c246
SHA256 d233dc1c042d433e935b0f98f06985c13eb6eed41e3d60fb169f7460dca85107
SHA512 5d1467db44a54c7ace9c17d2de4cd8905178ed64c40de5a7f221ff2fc511b6fad3c9cc852fccf38350d3f63e536a23fba0e4413cfb37f50f68863e1ee13c9b99

C:\Windows\xk.exe

MD5 a7ca9a9cdb3c1333eefc889ccac8a102
SHA1 e529a6cff15eed86e54ba8b4ad33f3af215ec763
SHA256 32a18b2956316bca047175d0d302796c1b3151073375609b5e1a5c74ad45e1d4
SHA512 1f4b086444ab6a1558349df647c99e54e2b2cb8d7d9d8bc6e2229c9b173349ec17eac6a6b36b13f40677b1815339d65fd90706cb3e5b4b42588bcf212627a25c

C:\Windows\SysWOW64\IExplorer.exe

MD5 4d9c20634ccce3db5069a462a13caff8
SHA1 4f0ff0a874ee7102ee3749020e6bed5adb0ac6bb
SHA256 f0a486d16dfa2b23b98ce7479f2913caf12746c92169dd4603da6af42dc8ec45
SHA512 72ac0be58f369d9f605237974bb89d89f01ec3a18094a1ba8c1efee04d0beaf6a64c298149a034a4453e347ba7cc3408575ae8ad57a8c546d789e8c8672b7e17

memory/2192-56-0x0000000000400000-0x000000000042E000-memory.dmp

memory/3800-59-0x0000000000400000-0x000000000042E000-memory.dmp

C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

MD5 24dab1fe576795fb01b8709a2bc4f1f9
SHA1 588cbbb1b4757f7bf6c06abcd2588b836af1f78b
SHA256 ab119654d0f69d7796b13aa8a17406b984867a55617990773fa81db5768b3bb2
SHA512 9636c64fdb8f0254e35a950e69ade0941d7545e30b3a22de8a6ffd8ed63a03597541e014a856073e25a0a7773bfb291732d50559d995dd91f280d755b4116c7b

memory/1380-66-0x0000000000400000-0x000000000042E000-memory.dmp

C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE

MD5 7810d5c650fcbed39ee84e1712f44103
SHA1 40484b998bba4b12f1f910fe6dd6d304ee03dab2
SHA256 a8ad708ec6c3e77c3ede42c2196e7a11ee10d20a4c3f3bcb0d757e776f69d43a
SHA512 d8994987e537d3bcdf226fac76666d525583f1bca856d0381876b3d9996df39d6882f191d1617487ec052753cd4375223db39c1cc0a2f868634a9812e521d84c

memory/884-72-0x0000000000400000-0x000000000042E000-memory.dmp

C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

MD5 cd203e679318d31d8335953646160a9c
SHA1 ded4d4f4b7c34a7ad8ddaa450bb18c813f3327ae
SHA256 26b55e6e2e1ea540ff34317afd5abcb0da0f0885505604b092aff2805b763b68
SHA512 f2feb61df771a9b1b8b4906e7956f964d4a8481109dcec0d919e2b7ce71575a3a08b9cdb58493260853b4f57dd3a7ec35a85d6fd4feffddc610b5aa1c4fa03e5

memory/4480-76-0x0000000000400000-0x000000000042E000-memory.dmp

memory/4480-80-0x0000000000400000-0x000000000042E000-memory.dmp

C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE

MD5 d178230d8f68b78cae71fca06d0d8d05
SHA1 7b175464acdf67397f12ed00ab6183293db60837
SHA256 124af05d72e001e5bce8c0c6db66b7ead2c9bf957fe5d83bf13802c181eeb059
SHA512 7448d1c473d4ae09a9d624df0df65ea5261b7d75eaae6849e3b94fcdffa6ba1eafdfd99093f85e6b27d35789991be9669ce298af2ba64ba9a582a3573d0dbf89

memory/2872-87-0x0000000000400000-0x000000000042E000-memory.dmp

C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE

MD5 94a96090f1269031dbeb1fc5d1cc2046
SHA1 a260196bfcf772dd5190c36a00c4cc93328230ac
SHA256 9c9629454af919d04a60c31685e07e9993c3542e69fe0272318f987c8da30078
SHA512 8f2d82031d0e041a941204b428e921d7e1f307ee4c5d078ba3a10c9f353bd88b80cfebc502c515b875c5e77debb59f60e803e18246dcd6ce3d24e1baaf8c6ea4

memory/1504-94-0x0000000000400000-0x000000000042E000-memory.dmp

memory/2272-120-0x0000000000400000-0x000000000042E000-memory.dmp

C:\Windows\xk.exe

MD5 ae0d37e9d5d94bcaa0b640b1f4b61b20
SHA1 e6bc9759106c5f6f5cb97e4833910a3440a3a81a
SHA256 c986e6382d1829e8c908a0d1483bff7a21a154b0b2442fe297af65aa629a948a
SHA512 788b9dcec59086cae075b6006178eec1e913db15b446387b2258ef5b040a7d4c6b2a5c385d8b8c50a1d62e44a5d615d25890dcd52d80f794224c12d4ee5e7639

C:\Windows\SysWOW64\IExplorer.exe

MD5 087669473733b504e570e1a6db72f00f
SHA1 445a7d357afe694d601eb9036220ad312917ff68
SHA256 1b6f7d636faeaf91e289414c2bc8c9640d4de1d9b52121bc2b03ed1ce1a6fa03
SHA512 7959adf04524a3a2401f1b0314136936437e072e70f833af4c0ff9739315de7d5a1956a1ae361add6612324ebceb63c88ad09584d55e9ea2e10721b0cb9d2aff

memory/5108-231-0x0000000000400000-0x000000000042E000-memory.dmp

C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

MD5 224d7657aa0eb89f41d237ba2604052f
SHA1 78597312a40ac3b4da25930fcf8b1c46cfaf57c2
SHA256 f71121e4b8e8c3367e1ed8e06545eef7375f39df3195d5c9076105d743e0f89a
SHA512 7130e062bf68cf20e72a5854b202446002f50e9be750ae1a4996f1ae79c44cc6c292c7eff0b9eed7e19c16617b8fa812d7820be7b285ea91de2ee74eb791b21c

memory/1652-237-0x0000000000400000-0x000000000042E000-memory.dmp

memory/4580-242-0x0000000000400000-0x000000000042E000-memory.dmp

C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE

MD5 c03f2f6edd8dfabb94929c1865a515a9
SHA1 df08140d0d1e2f3c0ddf3ee30260929b46cb41c6
SHA256 17f9154e8b057a6a5e348aa370dc34093b0cb2653100b31a13e7c03011f84185
SHA512 145086f2e9f8efe672874e9ebcc0e7a630421a284878055fdb3333cffdc87a7c08d69cff429fb5a46e054f65a3aa04b728251c4126a61b072465648d4b8a7694

C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

MD5 0f5f6b80e313a9c196df1c7737c9d1ae
SHA1 21f1fb32506d0994a8716a23632ca57656a2f89a
SHA256 3b001194941450645e86ae5cf67f6adbe0547ea8956c27326d661a7dd9c2cbd9
SHA512 08089608db1339428b58ef210d39e37d1d91a9e2f896f70826e8a41bffbb718069c15d59bff39a0e13e3147734bc981707b55075994f93258a7e71c918c4a618

memory/1732-250-0x0000000000400000-0x000000000042E000-memory.dmp

memory/1360-253-0x0000000000400000-0x000000000042E000-memory.dmp

C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE

MD5 81db2d0ba3ca1635be2264169b96b54d
SHA1 9dd290e4a4a7665d4672a01a3996c319ddec51b7
SHA256 d20984cde6c15129731cb8102c1c6aa3b7bbabcb2957ad035441873161f0809f
SHA512 937c41e3b0079e3f8e12a3689c52d715bd89dd6c71593382d4251743526ef14bc723e891eba3532d0fcf372071c93305dfd650129435a0df67ab5d0df2215c52

memory/2100-260-0x0000000000400000-0x000000000042E000-memory.dmp

C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE

MD5 6b3a39ca2005a67a9d9875e4b6c11cb6
SHA1 8cfc4df19f617aa8d0b5229201bbcaba0d4f5784
SHA256 a016ac01c735f251eb806e6b4d5d509f22d3413f270917e42affb20d40b170d8
SHA512 9033ac731cb29fc08aa9a4775c81bdb1988ea95537b9007d6c2214157443f4b2be155de498aac6f750164d613edeaacbeae1049b230c2fc8ba6b07867ed74226

C:\desktop.ini

MD5 c00d8433fe598abff197e690231531e0
SHA1 4f6b87a4327ff5343e9e87275d505b9f145a7e42
SHA256 52fb776a91b260bf196016ecb195550cdd9084058fe7b4dd3fe2d4fda1b6470e
SHA512 a71523ec2bd711e381a37baabd89517dff6c6530a435f4382b7f4056f98aff5d6014e85ce3b79bd1f02fdd6adc925cd3fc051752c1069e9eb511a465cd9908e1

C:\XK\Folder.htt

MD5 5d142e7978321fde49abd9a068b64d97
SHA1 70020fcf7f3d6dafb6c8cd7a55395196a487bef4
SHA256 fe222b08327bbfb35cbd627c0526ba7b5755b02ce0a95823a4c0bf58e601d061
SHA512 2351284652a9a1b35006baf4727a85199406e464ac33cb4701a6182e1076aaff022c227dbe4ad6e916eba15ebad08b10719a8e86d5a0f89844a163a7d4a7bbf9

memory/1004-275-0x0000000000400000-0x000000000042E000-memory.dmp

memory/2272-295-0x0000000000400000-0x000000000042E000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 04:05

Reported

2024-06-14 04:08

Platform

win7-20240611-en

Max time kernel

140s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\"" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A

Disables use of System Restore points

evasion

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\Mig2.scr C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File created C:\Windows\system32\perfh009.dat C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
File created C:\Windows\system32\perfh00A.dat C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
File created C:\Windows\system32\perfc00C.dat C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
File created C:\Windows\system32\perfc010.dat C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
File created C:\Windows\SysWOW64\PerfStringBackup.TMP C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
File opened for modification C:\Windows\SysWOW64\PerfStringBackup.INI C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
File created C:\Windows\system32\perfh007.dat C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
File created C:\Windows\SysWOW64\IExplorer.exe C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\IExplorer.exe C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File created C:\Windows\system32\perfc007.dat C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
File created C:\Windows\system32\perfc009.dat C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
File created C:\Windows\system32\perfh00C.dat C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
File created C:\Windows\system32\perfh011.dat C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
File opened for modification C:\Windows\SysWOW64\shell.exe C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File created C:\Windows\SysWOW64\shell.exe C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File created C:\Windows\SysWOW64\Mig2.scr C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File created C:\Windows\system32\perfc00A.dat C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
File created C:\Windows\system32\perfh010.dat C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
File created C:\Windows\system32\perfc011.dat C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\xk.exe C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
File created C:\Windows\inf\Outlook\outlperf.h C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
File opened for modification C:\Windows\inf\Outlook\outlperf.h C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
File created C:\Windows\inf\Outlook\0009\outlperf.ini C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
File opened for modification C:\Windows\xk.exe C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A

Enumerates physical storage devices

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Control Panel\Desktop\ C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MenuExt C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672DB-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630DC-0000-0000-C000-000000000046}\ = "_CategoryRuleCondition" C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630FC-0000-0000-C000-000000000046}\TypeLib C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006307B-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063107-0000-0000-C000-000000000046}\ = "_ConversationHeader" C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672E4-0000-0000-C000-000000000046} C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672F6-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006304A-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630CE-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063081-0000-0000-C000-000000000046} C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063039-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063021-0000-0000-C000-000000000046}\TypeLib C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006304C-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063077-0000-0000-C000-000000000046}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630F0-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672E0-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672FA-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E8-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006308D-0000-0000-C000-000000000046}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006307F-0000-0000-C000-000000000046}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630F2-0000-0000-C000-000000000046}\ = "_NavigationFolder" C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063003-0000-0000-C000-000000000046}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630CD-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006309A-0000-0000-C000-000000000046}\TypeLib C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630EE-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672F6-0000-0000-C000-000000000046}\TypeLib C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E8-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E3-0000-0000-C000-000000000046}\TypeLib C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006300C-0000-0000-C000-000000000046}\TypeLib C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063080-0000-0000-C000-000000000046}\ = "PropertyPages" C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063078-0000-0000-C000-000000000046}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063038-0000-0000-C000-000000000046}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672E1-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672E3-0000-0000-C000-000000000046}\TypeLib C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006304C-0000-0000-C000-000000000046}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630EF-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063024-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063036-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630EA-0000-0000-C000-000000000046}\ = "_CalendarModule" C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672E4-0000-0000-C000-000000000046}\ = "OlkListBoxEvents" C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006302D-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630CE-0000-0000-C000-000000000046}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006308D-0000-0000-C000-000000000046} C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006300B-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006307C-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630C5-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063102-0000-0000-C000-000000000046} C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063086-0000-0000-C000-000000000046}\TypeLib C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063078-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063025-0000-0000-C000-000000000046} C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E6-0000-0000-C000-000000000046}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630D9-0000-0000-C000-000000000046}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630CA-0000-0000-C000-000000000046}\ = "_ExchangeDistributionList" C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630B1-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006305B-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672E1-0000-0000-C000-000000000046}\ = "OlkOptionButtonEvents" C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672E1-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630CC-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630B0-0000-0000-C000-000000000046}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006309D-0000-0000-C000-000000000046}\TypeLib C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063023-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006F026-0000-0000-C000-000000000046}\TypeLib C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063003-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2436 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Windows\xk.exe
PID 2436 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Windows\xk.exe
PID 2436 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Windows\xk.exe
PID 2436 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Windows\xk.exe
PID 2436 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Windows\SysWOW64\IExplorer.exe
PID 2436 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Windows\SysWOW64\IExplorer.exe
PID 2436 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Windows\SysWOW64\IExplorer.exe
PID 2436 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Windows\SysWOW64\IExplorer.exe
PID 2436 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
PID 2436 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
PID 2436 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
PID 2436 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
PID 2436 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
PID 2436 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
PID 2436 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
PID 2436 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
PID 2436 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
PID 2436 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
PID 2436 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
PID 2436 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
PID 2436 wrote to memory of 1280 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
PID 2436 wrote to memory of 1280 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
PID 2436 wrote to memory of 1280 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
PID 2436 wrote to memory of 1280 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
PID 2436 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
PID 2436 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
PID 2436 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
PID 2436 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
PID 2436 wrote to memory of 604 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Windows\xk.exe
PID 2436 wrote to memory of 604 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Windows\xk.exe
PID 2436 wrote to memory of 604 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Windows\xk.exe
PID 2436 wrote to memory of 604 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Windows\xk.exe
PID 2436 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Windows\SysWOW64\IExplorer.exe
PID 2436 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Windows\SysWOW64\IExplorer.exe
PID 2436 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Windows\SysWOW64\IExplorer.exe
PID 2436 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Windows\SysWOW64\IExplorer.exe
PID 2436 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
PID 2436 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
PID 2436 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
PID 2436 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
PID 2436 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
PID 2436 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
PID 2436 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
PID 2436 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
PID 2436 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
PID 2436 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
PID 2436 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
PID 2436 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
PID 2436 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
PID 2436 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
PID 2436 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
PID 2436 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
PID 2436 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
PID 2436 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
PID 2436 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
PID 2436 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\a0f7c22a863f681a55c0f86018051ac0_NeikiAnalytics.exe"

C:\Windows\xk.exe

C:\Windows\xk.exe

C:\Windows\SysWOW64\IExplorer.exe

C:\Windows\system32\IExplorer.exe

C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE

"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"

C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE

"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"

C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE

"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"

C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE

"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"

C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE

"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"

C:\Windows\xk.exe

C:\Windows\xk.exe

C:\Windows\SysWOW64\IExplorer.exe

C:\Windows\system32\IExplorer.exe

C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE

"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"

C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE

"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"

C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE

"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"

C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE

"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"

C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE

"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"

C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE" -Embedding

Network

N/A

Files

memory/2436-0-0x0000000000400000-0x000000000042E000-memory.dmp

C:\Users\Admin\AppData\Local\winlogon.exe

MD5 a0f7c22a863f681a55c0f86018051ac0
SHA1 97eff444183a626578dd2f3bfe87885d8e71c246
SHA256 d233dc1c042d433e935b0f98f06985c13eb6eed41e3d60fb169f7460dca85107
SHA512 5d1467db44a54c7ace9c17d2de4cd8905178ed64c40de5a7f221ff2fc511b6fad3c9cc852fccf38350d3f63e536a23fba0e4413cfb37f50f68863e1ee13c9b99

C:\Windows\xk.exe

MD5 29e92fa800eac77fd093447d2b09ec82
SHA1 de7ddc2d73999f21d3485959ad0e41e756d8c303
SHA256 7bf4b0ddb4038415e7a24aa256fac4de8b87bf3188f205811a91a91eb9092534
SHA512 de05edd3f0e0072e4f6e565de6ed4df460b562676753089f096a82432d1d25a7c2fac0792646d460963e29d860ec0fb3cd229ea40021a087e406b58a35c26a29

memory/2436-110-0x0000000000510000-0x000000000053E000-memory.dmp

memory/2436-109-0x0000000000510000-0x000000000053E000-memory.dmp

memory/768-112-0x0000000000400000-0x000000000042E000-memory.dmp

\Windows\SysWOW64\IExplorer.exe

MD5 c4d5c209c0580250798e650f51e986d6
SHA1 a294045c753b54b214603a2bf87f8a8af455b2dd
SHA256 0256c2ee93b24289d52ab22bbf878fbf1505ed32bf0859057858e1cbef175877
SHA512 8efaaff0ad0f3f55e77fc36fca9e4e7c76563544d1e763b9aa3e8aa126b95d6a9ed6f5372007cfbe80e39542901d03fbe886929771f63a8e5d0de1037dc54c3a

memory/768-115-0x0000000000400000-0x000000000042E000-memory.dmp

memory/2788-123-0x0000000000400000-0x000000000042E000-memory.dmp

memory/2788-127-0x0000000000400000-0x000000000042E000-memory.dmp

\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

MD5 cb691a204fbd951cec93d34b4eae0e9c
SHA1 471b31a65443c4c288c10c535fb8847102cba2b1
SHA256 9cce75421f8a6b95c1a4a4c8bcb383b13f98f4ea19f3d7022bfa93d6958566de
SHA512 0ae8c6ec572bab114f5feb26bfdbbc7052c43d6426557f9b02035ace1d74cea7c79af1de360e2dfcd9ef870c9b2e8aa236611d554b6540d78699cfc729e3f7ce

C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE

MD5 1d663bbd0015a5a5b09beb92a2d194d0
SHA1 eb13d98b85834d11c4c71b47391261d3a53c3ff2
SHA256 eb3fd18f0abdbfc568ecee754153a9f5c736ac633e7484b0d0c160f0462d61fe
SHA512 ed08e13977376ee3a4a1e57e3ae9813c6a33783ecb1e457a629eb4a7ecd40831b6da8f44a9b424d060e476e55b6edb39a45212974a0df87988736cc4484a006a

memory/2836-144-0x0000000000400000-0x000000000042E000-memory.dmp

memory/2436-147-0x0000000000510000-0x000000000053E000-memory.dmp

memory/932-146-0x0000000000400000-0x000000000042E000-memory.dmp

memory/932-151-0x0000000000400000-0x000000000042E000-memory.dmp

\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

MD5 ab2fd28ea05e4521e3cd36eb0763fbe2
SHA1 eae16adf05ecf5dbb5ff15a04758f6eed823c0a3
SHA256 252198731cd9341248222796b2f5375b76e725b19713e3033917873a8ebbb664
SHA512 0042f5d3a51148a484ac4b5259f7214ab402d5b4bf79261bef06defedddfbf482352bcfb6376146c7220e3821e44ebb82d8ab0f85034efabaac117105150e743

memory/2436-159-0x0000000000400000-0x000000000042E000-memory.dmp

\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE

MD5 27cecef5e29d8eed73188d8ca2a19dc9
SHA1 95edca64a8953bcdd1886a3041226e61a3eeb31d
SHA256 36f6ae6943de526ae06ceecdcd3217cfbe2b3384cd263e3a59016537d21d5c1b
SHA512 9f079f2f078f0f9de962c8016977c2cf8573bdcb5103e16b2d5557c1355656c5ecb55b9d0156f18fbeb10acdcac0563d9662d6226832916cfb510ee9c5b1d4b5

memory/1280-173-0x0000000000400000-0x000000000042E000-memory.dmp

C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE

MD5 95f66c423a20690faebc9d064cd44c8c
SHA1 ec06df6b59185c1266b18fc2b5174b4282175d5b
SHA256 efa8cad3cee23313a63550313d1449b4b18ef8986334644baeaa6b8a5efd22c6
SHA512 78d8e104d964f8e4e707978d25340541a953c16f5f86e6aa2dd4b871c0912e139f55b0101e269835c7c2e24b64d4b4e0c737532c6624dc85a6307c9d17631342

memory/2704-184-0x0000000000400000-0x000000000042E000-memory.dmp

C:\Windows\xk.exe

MD5 e2da2f4d663691fa37cba169af798ae5
SHA1 fc20c5aaf545a581f7b039fca33a9491b583124a
SHA256 8fb0d33303fa9cd1b4d6bd2876af346bbe0c3ffede3d9b47a068ef1f79f489cb
SHA512 78bfc65c5ff1bd885c53c875471a0feccd0c49b181c84c1460614cfe96a0e7b4b26048002b95f2b3aa07ac1ae676a4d0569d2aec2b513d49efda721b24f26f97

memory/2436-241-0x0000000000510000-0x000000000053E000-memory.dmp

\Windows\SysWOW64\IExplorer.exe

MD5 6a1b84520c970d65906e5e39a8dc3217
SHA1 efcb6a3c0eb76d45c5ac625aaecc113c3d6f0770
SHA256 5456edfb85c29042f964eb9e5124f1c63bd5919bbc52ffc4d8d8b0bef0799bd3
SHA512 1bf3804fda79da3613bbe81eeef162b1a999cb615ccc3ff24e538943327445e8b29be3a12f966fcbe7b9fbec17d90312cbe80185a17128ead523452f307bc053

memory/2436-253-0x0000000000510000-0x000000000053E000-memory.dmp

memory/604-251-0x0000000000400000-0x000000000042E000-memory.dmp

\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

MD5 e5d92962ecbc942f8a62358d909e68c9
SHA1 7403054ab9d0bfa06111bbf9c77942745e7f4fcc
SHA256 83346f2536d9caef882bc43ece9973c96a16f1e91f13916ab37a8464fd67a30b
SHA512 f80177302cca548576ee3ffb957a90ab9cbadb951dbab1cb4a074d007e2091188f52f9785e56740bab1cebf05c22e7ef6962ff55aa6c42f6536ad476239a3de3

memory/2436-265-0x0000000000510000-0x000000000053E000-memory.dmp

memory/1804-262-0x0000000000400000-0x000000000042E000-memory.dmp

\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE

MD5 3ad087c85606441f7689f042ab7218cb
SHA1 68d1fc12da301cbc679489ea7ae091b426ee50cd
SHA256 66bd961624a95ca39d858bae04e67580c4383bf659fd9a1fbbd3588baaebccdb
SHA512 8371e01e2cc5aac70065fba92ab86f0ecfb4e5c7717dd4166c7b7685680f6e2f615924459c3b97722b94aa9b0d038b6e614e0406cc6b5d4007d1de4af57387b7

memory/2012-271-0x0000000000400000-0x000000000042E000-memory.dmp

\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

MD5 77e79eea876491cbb22c56f23f9f761a
SHA1 e13ac5545a3c26b4acdd023abd048e24c575b4f0
SHA256 d7a4797ae5438e8017692cca076fdd4287b79418b914a05f7c5a4a51a42b48f9
SHA512 be3d2182019276903b37ff40dd870fe1f9003682ca7a66a64bbd28354e2b4a2fd78d3800b965694767c259bf101bfdd6a71f25e259c62751dec811bed251d299

memory/1556-291-0x0000000000400000-0x000000000042E000-memory.dmp

\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE

MD5 8237ede36761c23b649f22106c20faa1
SHA1 be665c469bc851ac058064a27171e92e7a4438f9
SHA256 acce0c08dac33ad6a2e12f298d7621440933510dd698470f8bebf56e9da5ce98
SHA512 e484a39b1f5046f6a5462149a5df330c3e139a46bd6eca3a55fb4b0fef5f5c9c7259d5fe4b39b3a542995f764f0071990ffc3f65b191a0da316306ddec88840f

memory/2436-299-0x0000000000510000-0x000000000053E000-memory.dmp

memory/1624-289-0x0000000000400000-0x000000000042E000-memory.dmp

memory/1972-302-0x0000000000400000-0x000000000042E000-memory.dmp

C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE

MD5 18822d9c4fecfb35d5ff92190bcaad22
SHA1 a1c4669346d37797e27eb7204407c0e63a8e3934
SHA256 24ee07de940f0623a1788791d3453576199aceff0df6d7e996cf4cb74755a599
SHA512 3da06d2c7e1d7099b0702c66fb373d058df8204c050983317b35d2431166f97900b32eda6d7748d67dc875d80fb904ba3dcc38c1ba9b76f5f3cade66a5847328

memory/316-313-0x0000000000400000-0x000000000042E000-memory.dmp

memory/1992-338-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/2436-377-0x0000000000510000-0x000000000053E000-memory.dmp

memory/2436-439-0x0000000000510000-0x000000000053E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Outlook\mapisvc.inf

MD5 48dd6cae43ce26b992c35799fcd76898
SHA1 8e600544df0250da7d634599ce6ee50da11c0355
SHA256 7bfe1f3691e2b4fb4d61fbf5e9f7782fbe49da1342dbd32201c2cc8e540dbd1a
SHA512 c1b9322c900f5be0ad166ddcfec9146918fb2589a17607d61490fd816602123f3af310a3e6d98a37d16000d4acbbcd599236f03c3c7f9376aeba7a489b329f31

memory/2436-465-0x0000000000400000-0x000000000042E000-memory.dmp

memory/2436-467-0x0000000000510000-0x000000000053E000-memory.dmp