Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28/06/2024, 02:40
Static task
static1
Behavioral task
behavioral1
Sample
6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe
-
Size
45KB
-
MD5
c8a3b04070ff8613e8330d2907736410
-
SHA1
07f1dd3024bc0356fb46ba3260a238401e83a186
-
SHA256
6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342
-
SHA512
88ac33c8c3240c61bdf5f61708254aad2a36da1441c7f4e60ccef7b709a4bbdedcc065c9b3b48ef5b93643b4068bfcc87a85e4d887d8ad2df7cde5e7fb7e032c
-
SSDEEP
768:8V5hy+7c6OXdfwEQ90NoZCi5TXbRzjEDta8jFqjsZvI2YxrQiP+ZRDd+RYTl/iUn:8h7xsCKosi5pzjIcdRiTpqMGxs3X
Malware Config
Signatures
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\debugger = "ntsd -d" reg.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe " cmd.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jdb.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Internet Explorer\ieinstal.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Client\AppVLP.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javacpl.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\unpack200.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jinfo.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\policytool.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javap.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jcmd.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javaw.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\jjs.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\servertool.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\java.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\klist.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msoev.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javaws.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\servertool.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\misc.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Internet Explorer\iexplore.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\java.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\ktab.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jconsole.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\klist.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\orbd.exe 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe -
Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe " cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.txt \ = " exefile" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.txt cmd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1184 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1184 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 1184 wrote to memory of 2448 1184 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe 90 PID 1184 wrote to memory of 2448 1184 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe 90 PID 1184 wrote to memory of 2448 1184 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe 90 PID 1184 wrote to memory of 4788 1184 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe 92 PID 1184 wrote to memory of 4788 1184 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe 92 PID 1184 wrote to memory of 4788 1184 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe 92 PID 1184 wrote to memory of 1388 1184 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe 93 PID 1184 wrote to memory of 1388 1184 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe 93 PID 1184 wrote to memory of 1388 1184 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe 93 PID 1184 wrote to memory of 4604 1184 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe 94 PID 1184 wrote to memory of 4604 1184 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe 94 PID 1184 wrote to memory of 4604 1184 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe 94 PID 1184 wrote to memory of 5092 1184 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe 95 PID 1184 wrote to memory of 5092 1184 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe 95 PID 1184 wrote to memory of 5092 1184 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe 95 PID 1184 wrote to memory of 1764 1184 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe 96 PID 1184 wrote to memory of 1764 1184 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe 96 PID 1184 wrote to memory of 1764 1184 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe 96 PID 1184 wrote to memory of 1020 1184 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe 98 PID 1184 wrote to memory of 1020 1184 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe 98 PID 1184 wrote to memory of 1020 1184 6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe 98 PID 4788 wrote to memory of 4760 4788 cmd.exe 104 PID 4788 wrote to memory of 4760 4788 cmd.exe 104 PID 4788 wrote to memory of 4760 4788 cmd.exe 104 PID 4788 wrote to memory of 2796 4788 cmd.exe 105 PID 4788 wrote to memory of 2796 4788 cmd.exe 105 PID 4788 wrote to memory of 2796 4788 cmd.exe 105 PID 4788 wrote to memory of 2452 4788 cmd.exe 106 PID 4788 wrote to memory of 2452 4788 cmd.exe 106 PID 4788 wrote to memory of 2452 4788 cmd.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\SysWOW64\cmd.execmd.exe2⤵PID:2448
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\123.bat2⤵
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Event Triggered Execution: Image File Execution Options Injection
PID:4760
-
-
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Event Triggered Execution: Image File Execution Options Injection
PID:2796
-
-
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Event Triggered Execution: Image File Execution Options Injection
PID:2452
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c assoc .txt = exefile2⤵
- Modifies registry class
PID:1388
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype comfile=C:\Users\Admin\AppData\Local\Temp\6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe2⤵
- Modifies system executable filetype association
- Modifies registry class
PID:4604
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype zipfile=C:\Users\Admin\AppData\Local\Temp\6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe2⤵
- Modifies registry class
PID:5092
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype jpgfile=C:\Users\Admin\AppData\Local\Temp\6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe2⤵
- Modifies registry class
PID:1764
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype txtfile=C:\Users\Admin\AppData\Local\Temp\6a67ccc27210b3c8f7da38980ba84354c98a091acfad0f1d5d95f4a41a56b342_NeikiAnalytics.exe2⤵
- Modifies registry class
PID:1020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3752 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:81⤵PID:3776
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
443B
MD570170ba16a737a438223b88279dc6c85
SHA1cc066efa0fca9bc9f44013660dea6b28ddfd6a24
SHA256d3674f4b34a8ca8167160519aa5c66b6024eb09f4cb0c9278bc44370b0efec6a
SHA51237cc8c954544374d0a1ca4d012c9bd0b47781bc9bb8d0c15a8a95b9934893db3bedee867b984c20edabe54c39574abf7250de433aade6c0d544b8dd2c972c6da
-
Filesize
45KB
MD51ac23e41c3f6b4f9947415331ee4991e
SHA1667944e4e3641ff35213e441807473ae11d921bf
SHA25619090f6be55cb9d6039d6b80d626a25a7c0e46977435e1487739b3c831a7c508
SHA51299c890a8a3461c1cb391ec480173d09b6ece79e4a6c301d82d1db2a78a28fe4b0fd74cd965762ea5fb729dd11b056ab44983ef13222f9a92f0020cdc35d59a26