Analysis
-
max time kernel
119s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
27/06/2024, 22:18
Static task
static1
Behavioral task
behavioral1
Sample
2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe
-
Size
45KB
-
MD5
2aa109c3e110bff5fac3af1de57b0180
-
SHA1
65081591e301d5375b6d9b9970f1846ae8f54704
-
SHA256
2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7
-
SHA512
2be9a9aa86519418c9fbfdf0579bf2d351b9d15b0025dfe642ca0105ed2f64f7df8f1744e410509b5abf1066f54fc7eda1b813ce8265502192e14fccb9285e48
-
SSDEEP
768:8V5hy+7c6OXdfwEQ90NoZCi5TXbRzjEDta8jFqjsZvI2YxrQiP+ZRDd+RYTl/iUz:8h7xsCKosi5pzjIcdRiTpqMGxs3j
Malware Config
Signatures
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe reg.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe " cmd.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification \??\c:\Windows\SysWOW64\regedit.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jar.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\java.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\private_browsing.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmpconfig.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmprph.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmpshare.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\7-Zip\Uninstall.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\jp2launcher.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\ink\mip.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Windows NT\Accessories\wordpad.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\javaws.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\pingsender.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Windows Media Player\WMPDMC.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\javap.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\WORDICON.EXE 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Windows Media Player\setup_wm.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\7-Zip\7zG.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\javah.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\klist.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\klist.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\unpack200.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\Install\{5889422B-4E7B-4F63-944F-9F172CF77CBB}\chrome_installer.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\MSOUC.EXE 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification \??\c:\Windows\hh.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Windows\twunk_16.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Windows\twunk_32.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Windows\winhlp32.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Windows\Boot\PCAT\memtest.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Windows\bfsvc.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Windows\HelpPane.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Windows\notepad.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Windows\splwow64.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Windows\write.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Windows\explorer.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Windows\fveupdate.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe -
Modifies registry class 14 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe " cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.txt \ = " exefile" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.txt cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe " cmd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2248 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2248 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 2248 wrote to memory of 1348 2248 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 28 PID 2248 wrote to memory of 1348 2248 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 28 PID 2248 wrote to memory of 1348 2248 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 28 PID 2248 wrote to memory of 1348 2248 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 28 PID 2248 wrote to memory of 1164 2248 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 30 PID 2248 wrote to memory of 1164 2248 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 30 PID 2248 wrote to memory of 1164 2248 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 30 PID 2248 wrote to memory of 1164 2248 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 30 PID 2248 wrote to memory of 1792 2248 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 31 PID 2248 wrote to memory of 1792 2248 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 31 PID 2248 wrote to memory of 1792 2248 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 31 PID 2248 wrote to memory of 1792 2248 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 31 PID 2248 wrote to memory of 1976 2248 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 33 PID 2248 wrote to memory of 1976 2248 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 33 PID 2248 wrote to memory of 1976 2248 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 33 PID 2248 wrote to memory of 1976 2248 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 33 PID 2248 wrote to memory of 2816 2248 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 34 PID 2248 wrote to memory of 2816 2248 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 34 PID 2248 wrote to memory of 2816 2248 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 34 PID 2248 wrote to memory of 2816 2248 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 34 PID 2248 wrote to memory of 1580 2248 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 35 PID 2248 wrote to memory of 1580 2248 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 35 PID 2248 wrote to memory of 1580 2248 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 35 PID 2248 wrote to memory of 1580 2248 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 35 PID 2248 wrote to memory of 2312 2248 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 39 PID 2248 wrote to memory of 2312 2248 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 39 PID 2248 wrote to memory of 2312 2248 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 39 PID 2248 wrote to memory of 2312 2248 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 39 PID 1164 wrote to memory of 688 1164 cmd.exe 41 PID 1164 wrote to memory of 688 1164 cmd.exe 41 PID 1164 wrote to memory of 688 1164 cmd.exe 41 PID 1164 wrote to memory of 688 1164 cmd.exe 41 PID 1164 wrote to memory of 916 1164 cmd.exe 43 PID 1164 wrote to memory of 916 1164 cmd.exe 43 PID 1164 wrote to memory of 916 1164 cmd.exe 43 PID 1164 wrote to memory of 916 1164 cmd.exe 43 PID 1164 wrote to memory of 560 1164 cmd.exe 44 PID 1164 wrote to memory of 560 1164 cmd.exe 44 PID 1164 wrote to memory of 560 1164 cmd.exe 44 PID 1164 wrote to memory of 560 1164 cmd.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\SysWOW64\cmd.execmd.exe2⤵PID:1348
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\123.bat2⤵
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Event Triggered Execution: Image File Execution Options Injection
PID:688
-
-
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Event Triggered Execution: Image File Execution Options Injection
PID:916
-
-
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Event Triggered Execution: Image File Execution Options Injection
PID:560
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c assoc .txt = exefile2⤵
- Modifies registry class
PID:1792
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype comfile=C:\Users\Admin\AppData\Local\Temp\2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe2⤵
- Modifies system executable filetype association
- Modifies registry class
PID:1976
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype zipfile=C:\Users\Admin\AppData\Local\Temp\2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe2⤵
- Modifies registry class
PID:2816
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype jpgfile=C:\Users\Admin\AppData\Local\Temp\2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe2⤵
- Modifies registry class
PID:1580
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype txtfile=C:\Users\Admin\AppData\Local\Temp\2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe2⤵
- Modifies registry class
PID:2312
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
443B
MD570170ba16a737a438223b88279dc6c85
SHA1cc066efa0fca9bc9f44013660dea6b28ddfd6a24
SHA256d3674f4b34a8ca8167160519aa5c66b6024eb09f4cb0c9278bc44370b0efec6a
SHA51237cc8c954544374d0a1ca4d012c9bd0b47781bc9bb8d0c15a8a95b9934893db3bedee867b984c20edabe54c39574abf7250de433aade6c0d544b8dd2c972c6da
-
Filesize
45KB
MD56d3ce88c65dd1f010421e12962470c1e
SHA1f93ddb704390fd3f3acdbd372c842d22234801f6
SHA256d49f5f8b00d0b16b77f8cf79341303a194971e6e22429880491743356937d8ee
SHA5125b7aa59e90ce6ab42e88400279c35b51fe0270e868e60e1b89e67b5b605967fd0e2901e60cb2c5956aefe1ec04f3b1be3821337f3123c3de563067b2ed4bf675