sality | 4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1

Analysis

max time kernel
134s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
26/06/2024, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Size 991KB
Sample240626-e75vnsvgkg
SHA256 4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1
MD5 7ac758e9329a03885bf2fa006898ba10
SHA1 f78098c3680822f45217d684b7981788f1bf98a2
SHA512 bf0a7b584a92a32eed247a5e02ec0f7e5a3f1bdbd6350634c3e1359ffeae35bcad567959506bb4c5931a4d26e289e1c893fc0e359e024065d90807961523effa
SSDEEP 12288:AWdhMJuzCUjpaSG3Cv0/Z0nQU10nVLCDFiopRCkkjAs3yDal1+hjTCZSol:AWdOorBG3zqWgpiGRCjviDalohYfl
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 3 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3840-7-0x00000000023E0000-0x000000000349A000-memory.dmp	upx
behavioral2/memory/3840-6-0x00000000023E0000-0x000000000349A000-memory.dmp	upx
behavioral2/memory/3840-5-0x00000000023E0000-0x000000000349A000-memory.dmp	upx
behavioral2/memory/3840-4-0x00000000023E0000-0x000000000349A000-memory.dmp	upx
behavioral2/memory/3840-3-0x00000000023E0000-0x000000000349A000-memory.dmp	upx
behavioral2/memory/3840-1-0x00000000023E0000-0x000000000349A000-memory.dmp	upx
behavioral2/memory/3840-18-0x00000000023E0000-0x000000000349A000-memory.dmp	upx

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\e5731dd	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
File opened for modification	C:\Windows\SYSTEM.INI	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
File opened for modification	C:\Windows\UNINSTAL.tmp	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
Token: SeDebugPrivilege	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 788	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe	8
PID 3840 wrote to memory of 796	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe	9
PID 3840 wrote to memory of 336	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe	13
PID 3840 wrote to memory of 2628	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe	45
PID 3840 wrote to memory of 2672	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe	46
PID 3840 wrote to memory of 2824	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe	49
PID 3840 wrote to memory of 3456	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe	56
PID 3840 wrote to memory of 3636	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe	57
PID 3840 wrote to memory of 3824	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe	58
PID 3840 wrote to memory of 3928	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe	59
PID 3840 wrote to memory of 3988	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe	60
PID 3840 wrote to memory of 4072	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe	61
PID 3840 wrote to memory of 3672	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe	62
PID 3840 wrote to memory of 4560	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe	74
PID 3840 wrote to memory of 2404	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe	75
PID 3840 wrote to memory of 1068	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe	80
PID 3840 wrote to memory of 4896	3840	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe	81

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:788

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:796

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:336

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2672

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2824

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3456
- C:\Users\Admin\AppData\Local\Temp\4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\4e119d24956ed33a7c6556a52b0587da27e9812254e60e37bb1832eaf89c8ef1_NeikiAnalytics.exe"
  2⤵
  - Modifies firewall policy service
  - UAC bypass
  - Windows security bypass
  - Windows security modification
  - Checks whether UAC is enabled
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3636

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3824

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3928

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3988

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4072

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3672

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:4560

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2404

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:1068

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:4896