Malware Analysis Report

2024-09-11 11:47

Sample ID 240616-3sfh8syarl
Target 1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe
SHA256 e696d43d3f37e1f007559b19733d86fa48e57f5f327dd024313dab38271d30a4
Tags
sality backdoor bootkit evasion persistence trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e696d43d3f37e1f007559b19733d86fa48e57f5f327dd024313dab38271d30a4

Threat Level: Known bad

The file 1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

sality backdoor bootkit evasion persistence trojan upx

Sality

Modifies firewall policy service

UAC bypass

Windows security bypass

UPX packed file

Windows security modification

Loads dropped DLL

Executes dropped EXE

Writes to the Master Boot Record (MBR)

Checks whether UAC is enabled

Drops file in System32 directory

Drops file in Windows directory

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Modifies Internet Explorer settings

Modifies registry class

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

System policy modification

Suspicious behavior: AddClipboardFormatListener

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Create or Modify System Process
T1543
Windows Service
T1543.003
Pre-OS Boot
T1542
Bootkit
T1542.003
Privilege Escalation
TA0004
Create or Modify System Process
T1543
Windows Service
T1543.003
Abuse Elevation Control Mechanism
T1548
Bypass User Account Control
T1548.002
Defense Evasion
TA0005
Modify Registry
T1112
Abuse Elevation Control Mechanism
T1548
Bypass User Account Control
T1548.002
Impair Defenses
T1562
Disable or Modify Tools
T1562.001
Pre-OS Boot
T1542
Bootkit
T1542.003
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-16 23:46

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-16 23:46

Reported

2024-06-16 23:48

Platform

win7-20240611-en

Max time kernel

117s

Max time network

118s

Command Line

"C:\Windows\system32\Dwm.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\70B97F\BFA1C7.EXE N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\SysWOW64\70B97F\BFA1C7.EXE N/A
N/A N/A C:\Windows\SysWOW64\70B97F\BFA1C7.EXE N/A
N/A N/A C:\Windows\SysWOW64\70B97F\BFA1C7.EXE N/A
N/A N/A C:\Windows\SysWOW64\70B97F\BFA1C7.EXE N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File opened for modification \??\PhysicalDrive0 C:\Windows\SysWOW64\70B97F\BFA1C7.EXE N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\70B97F C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\70B97F\cnvpe.fne C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File created C:\Windows\SysWOW64\70B97F\internet.fne C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\70B97F\com.run C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File created C:\Windows\SysWOW64\70B97F\BFA1C7.EXE C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File created C:\Windows\SysWOW64\70B97F\cnvpe.fne C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File created C:\Windows\SysWOW64\70B97F\krnln.fnr C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\70B97F\shell.fne C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\EBFA1C\A1C7046D.TXT C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File created C:\Windows\SysWOW64\70B97F\com.run C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File created C:\Windows\SysWOW64\70B97F\RegEx.fnr C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\70B97F\dp1.fne C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File created C:\Windows\SysWOW64\70B97F\shell.fne C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File created C:\Windows\SysWOW64\70B97F\spec.fne C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\70B97F\internet.fne C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\70B97F\RegEx.fnr C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\EBFA1C C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File created C:\Windows\SysWOW64\70B97F\dp1.fne C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File created C:\Windows\SysWOW64\70B97F\eAPI.fne C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\70B97F\eAPI.fne C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\70B97F\krnln.fnr C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File created C:\Windows\SysWOW64\EBFA1C\A1C7046D.TXT C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\70B97F\spec.fne C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\70B97F\BFA1C7.EXE C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\f7610d2 C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico C:\Windows\explorer.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Windows\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" C:\Windows\explorer.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\NavBar = 000000000000000000000000000000008b000000870000003153505305d5cdd59c2e1b10939708002b2cf9ae6b0000005a000000007b00360044003800420042003300440033002d0039004400380037002d0034004100390031002d0041004200350036002d003400460033003000430046004600450046004500390046007d005f0057006900640074006800000013000000f00000000000000000000000 C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 200000001a00eebbfe2300001000d09ad3fd8f23af46adb46c85480369c700000000 C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_Classes\Local Settings C:\Windows\explorer.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\SysWOW64\70B97F\BFA1C7.EXE N/A
N/A N/A C:\Windows\SysWOW64\70B97F\BFA1C7.EXE N/A
N/A N/A C:\Windows\SysWOW64\70B97F\BFA1C7.EXE N/A
N/A N/A C:\Windows\SysWOW64\70B97F\BFA1C7.EXE N/A
N/A N/A C:\Windows\SysWOW64\70B97F\BFA1C7.EXE N/A
N/A N/A C:\Windows\SysWOW64\70B97F\BFA1C7.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2860 wrote to memory of 1036 N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe C:\Windows\system32\Dwm.exe
PID 2860 wrote to memory of 1064 N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe C:\Windows\system32\taskhost.exe
PID 2860 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe C:\Windows\Explorer.EXE
PID 2860 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe C:\Windows\SysWOW64\explorer.exe
PID 2860 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe C:\Windows\SysWOW64\explorer.exe
PID 2860 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe C:\Windows\SysWOW64\explorer.exe
PID 2860 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe C:\Windows\SysWOW64\explorer.exe
PID 2860 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe C:\Windows\system32\DllHost.exe
PID 2860 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe C:\Windows\SysWOW64\explorer.exe
PID 2860 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe C:\Windows\SysWOW64\explorer.exe
PID 2860 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe C:\Windows\SysWOW64\70B97F\BFA1C7.EXE
PID 2860 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe C:\Windows\SysWOW64\70B97F\BFA1C7.EXE
PID 2860 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe C:\Windows\SysWOW64\70B97F\BFA1C7.EXE
PID 2860 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe C:\Windows\SysWOW64\70B97F\BFA1C7.EXE

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A

Processes

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe"

C:\Windows\SysWOW64\explorer.exe

explorer C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics

C:\Windows\explorer.exe

C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding

C:\Windows\SysWOW64\70B97F\BFA1C7.EXE

C:\Windows\system32\70B97F\BFA1C7.EXE

Network

N/A

Files

memory/2860-0-0x0000000000400000-0x0000000000481000-memory.dmp

\Users\Admin\AppData\Local\Temp\E_N4\krnln.fnr

MD5 ff283a1787b18a6ce439b322c52a59bc
SHA1 c7ecc722f4b244e96752fa240737bd2913022250
SHA256 15eff8fb187b95997699e0ed68dfa046498f3fe7589ab153c5517f30bea0551a
SHA512 152f7c9113a2a9cd79c218a0b8fba82e507a3d6892ce8a315dd3c59dbcf2b64e628df41b64b8db408f8eb73c8c44a09f4b58fe43db61e538db75e40e4ec05853

memory/2860-11-0x0000000001D30000-0x0000000002DEA000-memory.dmp

memory/2860-12-0x0000000010000000-0x000000001011D000-memory.dmp

memory/2944-39-0x0000000000090000-0x0000000000091000-memory.dmp

memory/2860-35-0x0000000002EF0000-0x0000000002EF1000-memory.dmp

memory/2860-33-0x0000000002EF0000-0x0000000002EF1000-memory.dmp

memory/2860-32-0x00000000004F0000-0x00000000004F2000-memory.dmp

memory/1036-23-0x0000000002190000-0x0000000002192000-memory.dmp

memory/2860-14-0x0000000001D30000-0x0000000002DEA000-memory.dmp

memory/2860-22-0x0000000001D30000-0x0000000002DEA000-memory.dmp

memory/2860-15-0x0000000001D30000-0x0000000002DEA000-memory.dmp

memory/2860-18-0x0000000001D30000-0x0000000002DEA000-memory.dmp

memory/2860-20-0x0000000001D30000-0x0000000002DEA000-memory.dmp

memory/2860-19-0x0000000001D30000-0x0000000002DEA000-memory.dmp

memory/2860-16-0x0000000001D30000-0x0000000002DEA000-memory.dmp

memory/2944-40-0x0000000000080000-0x0000000000082000-memory.dmp

memory/2944-41-0x0000000000080000-0x0000000000082000-memory.dmp

memory/2860-21-0x0000000001D30000-0x0000000002DEA000-memory.dmp

memory/2860-43-0x00000000004F0000-0x00000000004F2000-memory.dmp

memory/2860-44-0x00000000004F0000-0x00000000004F2000-memory.dmp

memory/2860-51-0x0000000003550000-0x0000000003561000-memory.dmp

memory/2860-54-0x0000000004630000-0x000000000464E000-memory.dmp

C:\Windows\SysWOW64\70B97F\shell.fne

MD5 95562d803715a307c6a20a7a20d9ad98
SHA1 1a93395ee85df3e53657e0469266fdc7f28f2f89
SHA256 d4bc005c6ce57b8f2ba16dd20b5b2c13f3d924e192cbe333efb4b3a6d21847ef
SHA512 fce0839590358380ac4a41bb5122474a38156b4fd3123efaaad94f8647224fb8039222dd1f6b3d0608de0902654176a8a55e65f74701cade58476871e58ad0b4

C:\Windows\SysWOW64\70B97F\dp1.fne

MD5 84f9ffd52c17ed38ff7ecd7a6574a0c1
SHA1 52956fcacf67baf0e4564e10a2d9e6b532fa2f16
SHA256 91403fbf6e93b1a08d032c4ac68f471f3b02f6188bd450a90272b986fc1a5dc3
SHA512 884ab45b4df1834bbcb40d1e19577ca71edc16b7c37a157751eb6f40439fe444b375c9b86e6d757e5981788b8794458fe099baf43d7ac53e84ea755e58e67d86

C:\Windows\SysWOW64\70B97F\BFA1C7.EXE

MD5 227f2d4100f744b8a2c8487ecbd7ec4e
SHA1 54050b2fc438ba24dff9a66b59162912f5c87429
SHA256 334541d91357297cb62b875feb145a076520a51d14ee37a4abf8d038ad2855e2
SHA512 4168677d2c7e70f01ca30406d5469ee5085f49ebcf6e793f3ed86d2a27249b6fca6f38722374dd1be37568497c813fcc06a762ae856132b9c738ed03adf87e59

memory/1604-98-0x0000000010000000-0x000000001011D000-memory.dmp

memory/1604-104-0x00000000003B0000-0x00000000003FA000-memory.dmp

\Windows\SysWOW64\70B97F\com.run

MD5 ce2f773275d3fe8b78f4cf067d5e6a0f
SHA1 b7135e34d46eb4303147492d5cee5e1ef7b392ab
SHA256 eb8099c0ad2d82d9d80530443e2909f3b34be0844d445e844f1c994476c86d2d
SHA512 d733dc01c047be56680629a385abdd2aa1598a2b5459269028446da9097b6f6c1e7ade5b74e3ac3809dd8a3f8d1cbbe7fd669f2762be61f9c38fd4a2cca9e063

memory/2716-106-0x0000000003A90000-0x0000000003AA0000-memory.dmp

memory/1604-97-0x0000000000400000-0x000000000041F400-memory.dmp

memory/1604-112-0x0000000000440000-0x000000000045E000-memory.dmp

memory/2860-126-0x0000000010000000-0x000000001011D000-memory.dmp

memory/2860-125-0x0000000000400000-0x0000000000481000-memory.dmp

memory/1604-109-0x0000000000420000-0x0000000000431000-memory.dmp

memory/2860-96-0x0000000004670000-0x0000000004690000-memory.dmp

memory/2860-95-0x0000000001D30000-0x0000000002DEA000-memory.dmp

memory/2860-87-0x0000000004670000-0x0000000004690000-memory.dmp

memory/2860-86-0x0000000004650000-0x0000000004665000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\E_N4\cnvpe.fne

MD5 95594f191d8bff9c8fff6d4fbcea1cce
SHA1 17ef3602ad028aab4b35b806b1e1fc584feb02ef
SHA256 d56e9300078890f716791673f7b0c625ad1273155799dda75f10eec622e55c7a
SHA512 e25f866b787d713569d2e6c56e9bb7d46cd0afbeebd0888ef24b6541010ec0507714b8d23b3efe7511c9951d1652e2efe105e2e0b4338548ecfe8396e08ff301

memory/2860-17-0x0000000001D30000-0x0000000002DEA000-memory.dmp

memory/1604-127-0x0000000010000000-0x000000001011D000-memory.dmp

memory/1604-128-0x0000000000400000-0x000000000041F400-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-16 23:46

Reported

2024-06-16 23:48

Platform

win10v2004-20240611-en

Max time kernel

125s

Max time network

128s

Command Line

"fontdrvhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\70B97F\BFA1C7.EXE N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\SysWOW64\70B97F\BFA1C7.EXE N/A
N/A N/A C:\Windows\SysWOW64\70B97F\BFA1C7.EXE N/A
N/A N/A C:\Windows\SysWOW64\70B97F\BFA1C7.EXE N/A
N/A N/A C:\Windows\SysWOW64\70B97F\BFA1C7.EXE N/A
N/A N/A C:\Windows\SysWOW64\70B97F\BFA1C7.EXE N/A
N/A N/A C:\Windows\SysWOW64\70B97F\BFA1C7.EXE N/A
N/A N/A C:\Windows\SysWOW64\70B97F\BFA1C7.EXE N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File opened for modification \??\PhysicalDrive0 C:\Windows\SysWOW64\70B97F\BFA1C7.EXE N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\70B97F\BFA1C7.EXE C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\70B97F\BFA1C7.EXE C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\70B97F\eAPI.fne C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\70B97F\krnln.fnr C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\70B97F\shell.fne C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\EBFA1C\A1C7046D.TXT C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File created C:\Windows\SysWOW64\70B97F\internet.fne C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File created C:\Windows\SysWOW64\70B97F\RegEx.fnr C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\70B97F\cnvpe.fne C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File created C:\Windows\SysWOW64\70B97F\eAPI.fne C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File created C:\Windows\SysWOW64\70B97F\krnln.fnr C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File created C:\Windows\SysWOW64\70B97F\spec.fne C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\70B97F\spec.fne C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\EBFA1C C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File created C:\Windows\SysWOW64\70B97F\dp1.fne C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File created C:\Windows\SysWOW64\70B97F\shell.fne C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File created C:\Windows\SysWOW64\70B97F\com.run C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\70B97F\com.run C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\70B97F\internet.fne C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\70B97F C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File created C:\Windows\SysWOW64\70B97F\cnvpe.fne C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\70B97F\dp1.fne C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File created C:\Windows\SysWOW64\EBFA1C\A1C7046D.TXT C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\70B97F\RegEx.fnr C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\e58ac97 C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Windows\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\explorer.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 C:\Windows\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff C:\Windows\explorer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\NavBar = 000000000000000000000000000000008b000000870000003153505305d5cdd59c2e1b10939708002b2cf9ae6b0000005a000000007b00360044003800420042003300440033002d0039004400380037002d0034004100390031002d0041004200350036002d003400460033003000430046004600450046004500390046007d005f0057006900640074006800000013000000cc0000000000000000000000 C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000 C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders C:\Windows\explorer.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Windows\explorer.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\SysWOW64\70B97F\BFA1C7.EXE N/A
N/A N/A C:\Windows\SysWOW64\70B97F\BFA1C7.EXE N/A
N/A N/A C:\Windows\SysWOW64\70B97F\BFA1C7.EXE N/A
N/A N/A C:\Windows\SysWOW64\70B97F\BFA1C7.EXE N/A
N/A N/A C:\Windows\SysWOW64\70B97F\BFA1C7.EXE N/A
N/A N/A C:\Windows\SysWOW64\70B97F\BFA1C7.EXE N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2004 wrote to memory of 232 N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe C:\Windows\SysWOW64\explorer.exe
PID 2004 wrote to memory of 232 N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe C:\Windows\SysWOW64\explorer.exe
PID 2004 wrote to memory of 232 N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe C:\Windows\SysWOW64\explorer.exe
PID 2004 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe C:\Windows\system32\fontdrvhost.exe
PID 2004 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe C:\Windows\system32\fontdrvhost.exe
PID 2004 wrote to memory of 336 N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe C:\Windows\system32\dwm.exe
PID 2004 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe C:\Windows\system32\sihost.exe
PID 2004 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 2004 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe C:\Windows\system32\taskhostw.exe
PID 2004 wrote to memory of 3588 N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe C:\Windows\Explorer.EXE
PID 2004 wrote to memory of 3728 N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 2004 wrote to memory of 3932 N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe C:\Windows\system32\DllHost.exe
PID 2004 wrote to memory of 440 N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 2004 wrote to memory of 3152 N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe C:\Windows\System32\RuntimeBroker.exe
PID 2004 wrote to memory of 3256 N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 2004 wrote to memory of 4232 N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe C:\Windows\System32\RuntimeBroker.exe
PID 2004 wrote to memory of 4920 N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe C:\Windows\System32\RuntimeBroker.exe
PID 2004 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 2004 wrote to memory of 3716 N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2004 wrote to memory of 3720 N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2004 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2004 wrote to memory of 4680 N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2004 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2004 wrote to memory of 3104 N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe C:\Windows\System32\RuntimeBroker.exe
PID 2004 wrote to memory of 4648 N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe C:\Windows\System32\RuntimeBroker.exe
PID 2004 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe C:\Windows\system32\backgroundTaskHost.exe
PID 2004 wrote to memory of 4368 N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe C:\Windows\system32\backgroundTaskHost.exe
PID 2004 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe C:\Windows\SysWOW64\70B97F\BFA1C7.EXE
PID 2004 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe C:\Windows\SysWOW64\70B97F\BFA1C7.EXE
PID 2004 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe C:\Windows\SysWOW64\70B97F\BFA1C7.EXE

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe N/A

Processes

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=125.0.6422.142 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=125.0.2535.92 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffefdb94ef8,0x7ffefdb94f04,0x7ffefdb94f10

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2320,i,5229431749694857451,16836185654682871752,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1868,i,5229431749694857451,16836185654682871752,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2432,i,5229431749694857451,16836185654682871752,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:8

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca

C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics.exe"

C:\Windows\SysWOW64\explorer.exe

explorer C:\Users\Admin\AppData\Local\Temp\1f61fab5db3a78a214f4b48ddd779c00_NeikiAnalytics

C:\Windows\explorer.exe

C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding

C:\Windows\SysWOW64\70B97F\BFA1C7.EXE

C:\Windows\system32\70B97F\BFA1C7.EXE

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1520,i,5229431749694857451,16836185654682871752,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
BE 88.221.83.219:443 www.bing.com tcp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 219.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp

Files

memory/2004-0-0x0000000000400000-0x0000000000481000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\E_N4\krnln.fnr

MD5 ff283a1787b18a6ce439b322c52a59bc
SHA1 c7ecc722f4b244e96752fa240737bd2913022250
SHA256 15eff8fb187b95997699e0ed68dfa046498f3fe7589ab153c5517f30bea0551a
SHA512 152f7c9113a2a9cd79c218a0b8fba82e507a3d6892ce8a315dd3c59dbcf2b64e628df41b64b8db408f8eb73c8c44a09f4b58fe43db61e538db75e40e4ec05853

memory/2004-1-0x0000000002240000-0x00000000032FA000-memory.dmp

memory/2004-13-0x0000000002240000-0x00000000032FA000-memory.dmp

memory/2004-16-0x0000000002240000-0x00000000032FA000-memory.dmp

memory/2004-15-0x0000000002240000-0x00000000032FA000-memory.dmp

memory/2004-27-0x0000000000790000-0x0000000000792000-memory.dmp

memory/2004-26-0x0000000002240000-0x00000000032FA000-memory.dmp

memory/2004-30-0x0000000002240000-0x00000000032FA000-memory.dmp

memory/2004-31-0x0000000002240000-0x00000000032FA000-memory.dmp

memory/2004-28-0x0000000002240000-0x00000000032FA000-memory.dmp

memory/2004-32-0x0000000002240000-0x00000000032FA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\E_N4\shell.fne

MD5 95562d803715a307c6a20a7a20d9ad98
SHA1 1a93395ee85df3e53657e0469266fdc7f28f2f89
SHA256 d4bc005c6ce57b8f2ba16dd20b5b2c13f3d924e192cbe333efb4b3a6d21847ef
SHA512 fce0839590358380ac4a41bb5122474a38156b4fd3123efaaad94f8647224fb8039222dd1f6b3d0608de0902654176a8a55e65f74701cade58476871e58ad0b4

C:\Windows\SysWOW64\70B97F\cnvpe.fne

MD5 95594f191d8bff9c8fff6d4fbcea1cce
SHA1 17ef3602ad028aab4b35b806b1e1fc584feb02ef
SHA256 d56e9300078890f716791673f7b0c625ad1273155799dda75f10eec622e55c7a
SHA512 e25f866b787d713569d2e6c56e9bb7d46cd0afbeebd0888ef24b6541010ec0507714b8d23b3efe7511c9951d1652e2efe105e2e0b4338548ecfe8396e08ff301

C:\Users\Admin\AppData\Local\Temp\E_N4\dp1.fne

MD5 84f9ffd52c17ed38ff7ecd7a6574a0c1
SHA1 52956fcacf67baf0e4564e10a2d9e6b532fa2f16
SHA256 91403fbf6e93b1a08d032c4ac68f471f3b02f6188bd450a90272b986fc1a5dc3
SHA512 884ab45b4df1834bbcb40d1e19577ca71edc16b7c37a157751eb6f40439fe444b375c9b86e6d757e5981788b8794458fe099baf43d7ac53e84ea755e58e67d86

C:\Windows\SysWOW64\70B97F\eAPI.fne

MD5 92181e5c006445da1a4122eafb662bac
SHA1 eb078212ce033ee7179d96a4fd2fa6aae3e03fc2
SHA256 70c32e7530dc3058271ec545389f1ca3668b41902f39c0735f7dbf4ac919985b
SHA512 bceadd9535c1e80105a2e949e664e18041a38a2ccec42035ff473b5e7bee784c0acb992530f0b8d0ef6e505de384ed093208af8c1919524a65069bfb3d721bc9

C:\Windows\SysWOW64\70B97F\BFA1C7.EXE

MD5 3d41ff569d4124a5672d4fbc32bd5669
SHA1 31353b7ff5ac0a9e3af467287fbe48dceea30b24
SHA256 8732ad6bbf5e810927820f0e0fe90fccfbb7da86a4d7d7643d598d3163ec544d
SHA512 fbaca4f540412755ca88f211d4ad71767271da1dd2b916644e7dc607159b2287c7d06b40ca0d0650a8b58eba7ffee394ddc07fa91b8139f1b1cb46387bebcaa3

memory/2004-87-0x0000000003940000-0x0000000003955000-memory.dmp

C:\Windows\SysWOW64\70B97F\com.run

MD5 ce2f773275d3fe8b78f4cf067d5e6a0f
SHA1 b7135e34d46eb4303147492d5cee5e1ef7b392ab
SHA256 eb8099c0ad2d82d9d80530443e2909f3b34be0844d445e844f1c994476c86d2d
SHA512 d733dc01c047be56680629a385abdd2aa1598a2b5459269028446da9097b6f6c1e7ade5b74e3ac3809dd8a3f8d1cbbe7fd669f2762be61f9c38fd4a2cca9e063

memory/3284-93-0x0000000002040000-0x000000000208A000-memory.dmp

memory/3284-89-0x0000000010000000-0x000000001011D000-memory.dmp

memory/3284-88-0x0000000000400000-0x000000000041F400-memory.dmp

memory/2004-64-0x0000000003400000-0x000000000341E000-memory.dmp

memory/3284-102-0x0000000002D90000-0x0000000002DAE000-memory.dmp

memory/3284-101-0x0000000002510000-0x0000000002521000-memory.dmp

memory/2004-63-0x00000000033C0000-0x00000000033D1000-memory.dmp

memory/2004-18-0x0000000002240000-0x00000000032FA000-memory.dmp

memory/2004-29-0x0000000000790000-0x0000000000792000-memory.dmp

memory/2004-20-0x0000000003340000-0x0000000003341000-memory.dmp

memory/2004-19-0x0000000000790000-0x0000000000792000-memory.dmp

memory/2004-14-0x0000000002240000-0x00000000032FA000-memory.dmp

memory/2004-17-0x0000000010000000-0x000000001011D000-memory.dmp

memory/2004-103-0x0000000002240000-0x00000000032FA000-memory.dmp

memory/2004-104-0x0000000002240000-0x00000000032FA000-memory.dmp

memory/2004-111-0x0000000000790000-0x0000000000792000-memory.dmp

memory/2004-106-0x0000000002240000-0x00000000032FA000-memory.dmp

memory/2004-120-0x0000000010000000-0x000000001011D000-memory.dmp

memory/2004-119-0x0000000000400000-0x0000000000481000-memory.dmp

memory/3284-121-0x0000000000400000-0x000000000041F400-memory.dmp

memory/3284-122-0x0000000010000000-0x000000001011D000-memory.dmp