Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
125s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27/06/2024, 22:18
Static task
static1
Behavioral task
behavioral1
Sample
2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe
-
Size
45KB
-
MD5
2aa109c3e110bff5fac3af1de57b0180
-
SHA1
65081591e301d5375b6d9b9970f1846ae8f54704
-
SHA256
2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7
-
SHA512
2be9a9aa86519418c9fbfdf0579bf2d351b9d15b0025dfe642ca0105ed2f64f7df8f1744e410509b5abf1066f54fc7eda1b813ce8265502192e14fccb9285e48
-
SSDEEP
768:8V5hy+7c6OXdfwEQ90NoZCi5TXbRzjEDta8jFqjsZvI2YxrQiP+ZRDd+RYTl/iUz:8h7xsCKosi5pzjIcdRiTpqMGxs3j
Malware Config
Signatures
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\debugger = "ntsd -d" reg.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe " cmd.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jar.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\idlj.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\klist.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jhat.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Internet Explorer\iediagcmd.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Internet Explorer\iexplore.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\unpack200.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jdb.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javacpl.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\keytool.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jps.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jstack.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\rmid.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\pack200.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Internet Explorer\ieinstal.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jstat.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe -
Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.txt cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.txt \ = " exefile" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe " cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open cmd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2800 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2800 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2800 wrote to memory of 380 2800 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 89 PID 2800 wrote to memory of 380 2800 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 89 PID 2800 wrote to memory of 380 2800 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 89 PID 2800 wrote to memory of 5024 2800 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 91 PID 2800 wrote to memory of 5024 2800 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 91 PID 2800 wrote to memory of 5024 2800 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 91 PID 2800 wrote to memory of 2052 2800 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 92 PID 2800 wrote to memory of 2052 2800 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 92 PID 2800 wrote to memory of 2052 2800 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 92 PID 2800 wrote to memory of 3468 2800 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 93 PID 2800 wrote to memory of 3468 2800 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 93 PID 2800 wrote to memory of 3468 2800 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 93 PID 2800 wrote to memory of 4184 2800 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 94 PID 2800 wrote to memory of 4184 2800 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 94 PID 2800 wrote to memory of 4184 2800 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 94 PID 2800 wrote to memory of 3372 2800 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 96 PID 2800 wrote to memory of 3372 2800 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 96 PID 2800 wrote to memory of 3372 2800 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 96 PID 2800 wrote to memory of 4504 2800 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 97 PID 2800 wrote to memory of 4504 2800 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 97 PID 2800 wrote to memory of 4504 2800 2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe 97 PID 5024 wrote to memory of 848 5024 cmd.exe 103 PID 5024 wrote to memory of 848 5024 cmd.exe 103 PID 5024 wrote to memory of 848 5024 cmd.exe 103 PID 5024 wrote to memory of 3648 5024 cmd.exe 104 PID 5024 wrote to memory of 3648 5024 cmd.exe 104 PID 5024 wrote to memory of 3648 5024 cmd.exe 104 PID 5024 wrote to memory of 3292 5024 cmd.exe 105 PID 5024 wrote to memory of 3292 5024 cmd.exe 105 PID 5024 wrote to memory of 3292 5024 cmd.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\SysWOW64\cmd.execmd.exe2⤵PID:380
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\123.bat2⤵
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Event Triggered Execution: Image File Execution Options Injection
PID:848
-
-
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Event Triggered Execution: Image File Execution Options Injection
PID:3648
-
-
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Event Triggered Execution: Image File Execution Options Injection
PID:3292
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c assoc .txt = exefile2⤵
- Modifies registry class
PID:2052
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype comfile=C:\Users\Admin\AppData\Local\Temp\2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe2⤵
- Modifies system executable filetype association
- Modifies registry class
PID:3468
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype zipfile=C:\Users\Admin\AppData\Local\Temp\2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe2⤵
- Modifies registry class
PID:4184
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype jpgfile=C:\Users\Admin\AppData\Local\Temp\2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe2⤵
- Modifies registry class
PID:3372
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype txtfile=C:\Users\Admin\AppData\Local\Temp\2c7f9fafaec14b93d89d451acefc2a501bfb0a065a0857888cb392994c9020c7_NeikiAnalytics.exe2⤵
- Modifies registry class
PID:4504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4036,i,17096020621006928097,15544233752327415349,262144 --variations-seed-version --mojo-platform-channel-handle=1320 /prefetch:81⤵PID:1776
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
443B
MD570170ba16a737a438223b88279dc6c85
SHA1cc066efa0fca9bc9f44013660dea6b28ddfd6a24
SHA256d3674f4b34a8ca8167160519aa5c66b6024eb09f4cb0c9278bc44370b0efec6a
SHA51237cc8c954544374d0a1ca4d012c9bd0b47781bc9bb8d0c15a8a95b9934893db3bedee867b984c20edabe54c39574abf7250de433aade6c0d544b8dd2c972c6da
-
Filesize
45KB
MD57ba6337cb322c46e96822dbe231c8445
SHA1dbe31b7e5c5be0132ad59592f3c2ef8ebb1b25c1
SHA256eedc9e6e8cca940e0b1c859090c39a9b647515009de0316e9e4f2ce6dd39a048
SHA512a6b4bc69a74cd9d5c3a9f03412e225bf2342e54cf49786fcb2e649b34025963e3f77e2eb1246deb0f4eff5dd1312d761543b2c310cf319b7a2173653793f165a