Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
17/06/2024, 15:36
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe
Resource
win7-20240611-en
windows7-x64
3 signatures
150 seconds
General
- Target aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe
- Size 690KB
- Sample240617-s193psvfpd
- SHA256 71913f4406474f1c89fd6dc25aa56c747bed809bd347e84ed205313e616136cb
- MD5 aaaf561e6929980b5dd9263b940f55b0
- SHA1 0ecf1efff41fa45aab2c794a025e0abf5e8b38fc
- SHA512 bacd7dc349a2ec09c23b72808a9b2e4470e8b585f1d68339e94145b45707e495287501273eb715bacaca9875b2eda2a1c1ae9a47b4a490e086743b6568a6f454
- SSDEEP 12288:edmH3hRCjQuv0IUttVMSX98r/LbfjI6tuIoSRBEbCZQqXNr:edmH36cY0IstVMSNC/Lb7I2uSROCvXNr
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
-
http://www.klkjwre9fqwieluoi.info/
-
http://kukutrustnet777888.info/
-
http://klkjwre77638dfqwieuoi888.info/
Signatures
- Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe - Disables Task Manager via registry modification
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation cmd.exe -
resource yara_rule behavioral2/memory/1372-1-0x0000000003220000-0x00000000042AE000-memory.dmp upx behavioral2/memory/1372-4-0x0000000003220000-0x00000000042AE000-memory.dmp upx behavioral2/memory/1372-5-0x0000000003220000-0x00000000042AE000-memory.dmp upx behavioral2/memory/1372-13-0x0000000003220000-0x00000000042AE000-memory.dmp upx behavioral2/memory/1372-6-0x0000000003220000-0x00000000042AE000-memory.dmp upx behavioral2/memory/1372-7-0x0000000003220000-0x00000000042AE000-memory.dmp upx behavioral2/memory/1372-10-0x0000000003220000-0x00000000042AE000-memory.dmp upx behavioral2/memory/1372-11-0x0000000003220000-0x00000000042AE000-memory.dmp upx behavioral2/memory/1372-18-0x0000000003220000-0x00000000042AE000-memory.dmp upx behavioral2/memory/1372-19-0x0000000003220000-0x00000000042AE000-memory.dmp upx behavioral2/memory/1372-20-0x0000000003220000-0x00000000042AE000-memory.dmp upx behavioral2/memory/1372-21-0x0000000003220000-0x00000000042AE000-memory.dmp upx behavioral2/memory/1372-22-0x0000000003220000-0x00000000042AE000-memory.dmp upx behavioral2/memory/1372-23-0x0000000003220000-0x00000000042AE000-memory.dmp upx behavioral2/memory/1372-26-0x0000000003220000-0x00000000042AE000-memory.dmp upx behavioral2/memory/1372-27-0x0000000003220000-0x00000000042AE000-memory.dmp upx behavioral2/memory/1372-28-0x0000000003220000-0x00000000042AE000-memory.dmp upx behavioral2/memory/1372-30-0x0000000003220000-0x00000000042AE000-memory.dmp upx behavioral2/memory/1372-32-0x0000000003220000-0x00000000042AE000-memory.dmp upx behavioral2/memory/1372-35-0x0000000003220000-0x00000000042AE000-memory.dmp upx behavioral2/memory/1372-36-0x0000000003220000-0x00000000042AE000-memory.dmp upx behavioral2/memory/1372-45-0x0000000003220000-0x00000000042AE000-memory.dmp upx behavioral2/memory/1372-49-0x0000000003220000-0x00000000042AE000-memory.dmp upx behavioral2/memory/1372-50-0x0000000003220000-0x00000000042AE000-memory.dmp upx behavioral2/memory/1372-53-0x0000000003220000-0x00000000042AE000-memory.dmp upx behavioral2/memory/1372-55-0x0000000003220000-0x00000000042AE000-memory.dmp upx behavioral2/memory/1372-56-0x0000000003220000-0x00000000042AE000-memory.dmp upx behavioral2/memory/1372-65-0x0000000003220000-0x00000000042AE000-memory.dmp upx behavioral2/memory/1372-66-0x0000000003220000-0x00000000042AE000-memory.dmp upx behavioral2/memory/1372-68-0x0000000003220000-0x00000000042AE000-memory.dmp upx behavioral2/memory/1372-69-0x0000000003220000-0x00000000042AE000-memory.dmp upx behavioral2/memory/1372-72-0x0000000003220000-0x00000000042AE000-memory.dmp upx behavioral2/memory/1372-73-0x0000000003220000-0x00000000042AE000-memory.dmp upx behavioral2/memory/1372-74-0x0000000003220000-0x00000000042AE000-memory.dmp upx behavioral2/memory/1372-76-0x0000000003220000-0x00000000042AE000-memory.dmp upx behavioral2/memory/1372-83-0x0000000003220000-0x00000000042AE000-memory.dmp upx behavioral2/memory/1372-84-0x0000000003220000-0x00000000042AE000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe - AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/1372-0-0x0000000000400000-0x00000000004AE000-memory.dmp autoit_exe behavioral2/files/0x000600000001e830-38.dat autoit_exe - Drops file in Program Files directory 12 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\JAVA\JAVA UPDATE\JUSCHED.EXE aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings cmd.exe - Opens file in notepad (likely ransom note) 1 IoCs
pid Process 3624 NOTEPAD.EXE - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe Token: SeDebugPrivilege 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1372 wrote to memory of 768 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 8 PID 1372 wrote to memory of 776 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 9 PID 1372 wrote to memory of 376 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 13 PID 1372 wrote to memory of 2556 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 43 PID 1372 wrote to memory of 2652 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 45 PID 1372 wrote to memory of 2772 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 47 PID 1372 wrote to memory of 3548 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 56 PID 1372 wrote to memory of 3668 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 57 PID 1372 wrote to memory of 3844 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 58 PID 1372 wrote to memory of 3932 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 59 PID 1372 wrote to memory of 4008 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 60 PID 1372 wrote to memory of 716 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 61 PID 1372 wrote to memory of 4132 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 62 PID 1372 wrote to memory of 4448 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 64 PID 1372 wrote to memory of 5360 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 74 PID 1372 wrote to memory of 1632 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 78 PID 1372 wrote to memory of 5460 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 79 PID 1372 wrote to memory of 768 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 8 PID 1372 wrote to memory of 776 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 9 PID 1372 wrote to memory of 376 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 13 PID 1372 wrote to memory of 2556 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 43 PID 1372 wrote to memory of 2652 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 45 PID 1372 wrote to memory of 2772 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 47 PID 1372 wrote to memory of 3548 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 56 PID 1372 wrote to memory of 3668 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 57 PID 1372 wrote to memory of 3844 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 58 PID 1372 wrote to memory of 3932 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 59 PID 1372 wrote to memory of 4008 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 60 PID 1372 wrote to memory of 716 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 61 PID 1372 wrote to memory of 4132 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 62 PID 1372 wrote to memory of 4448 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 64 PID 1372 wrote to memory of 5360 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 74 PID 1372 wrote to memory of 1632 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 78 PID 1372 wrote to memory of 1284 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 82 PID 1372 wrote to memory of 916 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 83 PID 1372 wrote to memory of 3764 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 85 PID 1372 wrote to memory of 3764 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 85 PID 1372 wrote to memory of 3764 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 85 PID 3764 wrote to memory of 3624 3764 cmd.exe 87 PID 3764 wrote to memory of 3624 3764 cmd.exe 87 PID 3764 wrote to memory of 3624 3764 cmd.exe 87 PID 1372 wrote to memory of 768 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 8 PID 1372 wrote to memory of 776 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 9 PID 1372 wrote to memory of 376 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 13 PID 1372 wrote to memory of 2556 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 43 PID 1372 wrote to memory of 2652 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 45 PID 1372 wrote to memory of 2772 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 47 PID 1372 wrote to memory of 3548 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 56 PID 1372 wrote to memory of 3668 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 57 PID 1372 wrote to memory of 3844 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 58 PID 1372 wrote to memory of 3932 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 59 PID 1372 wrote to memory of 4008 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 60 PID 1372 wrote to memory of 716 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 61 PID 1372 wrote to memory of 4132 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 62 PID 1372 wrote to memory of 4448 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 64 PID 1372 wrote to memory of 5360 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 74 PID 1372 wrote to memory of 1632 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 78 PID 1372 wrote to memory of 1284 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 82 PID 1372 wrote to memory of 916 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 83 PID 1372 wrote to memory of 3764 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 85 PID 1372 wrote to memory of 3764 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 85 PID 1372 wrote to memory of 2100 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 86 PID 1372 wrote to memory of 3624 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 87 PID 1372 wrote to memory of 3624 1372 aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe 87 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:768
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:776
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:376
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2556
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2652
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2772
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.ini"3⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:2100
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.ini4⤵
- Opens file in notepad (likely ransom note)
PID:3624
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3668
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3844
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3932
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4008
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:716
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4132
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4448
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:5360
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:1632
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:5460
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1284
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:916
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:5044
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\0E5772A0_Rar\aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe
- Size 622KB
- SHA256 ceda224c28ecbdf23a5ea2180e62701fcf73a6d31dd1eccd37f6fbdd9fa99d20
- MD5 ef89f650aa5f28cd5d9a4c98444bf799
- SHA1 62c5b30ca858b667e6a85ef40d0840aea62e8ddd
- SHA512 87b73666bd042154a544ec9e1d1fa690ca3fdbe5e00d2b6c92210df8a9f7fe5375a5545b14ef3c3b09b59ba5a197235253955a2ed7d6d8f41fd5f7aa56657c88
- SSDEEP 12288:3dmH3hRCjQuv0IUttVMSX9Hr/LbfjI6tuIomCZQqXNr:3dmH36cY0IstVMSNL/Lb7I2umCvXNr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.ini
- Size 5KB
- SHA256 ed618f7a78c089b0234a4c538dd2c260d66705e1ed071ca05dd2fad2f0680fc4
- MD5 0141a67c35dbf34ac8a146bb08a1a101
- SHA1 6243844912ee2005ca05d7aa3f1a8ba0c263aac5
- SHA512 3189d7278fa78d3265fb2e514cdcf6a058c855b13ee187eedab666536faf454dfac57c008a54786454de6bba57004e47bd041663325c848f3d3f82ee9112afee
- SSDEEP 48:S4cVfXLsoIL+0XjwzqJmXbmImMl2ZyPx9KedErXmcwp7Mko5RZ7mhCg10EEBko5t:podVE/ZSSUojwp770EjGYovrmRezDxf
- MD5 SHA1 SHA512 SSDEEP