Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28/06/2024, 13:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe
Resource
win7-20240611-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe
-
Size
2.6MB
-
MD5
6011884027c7190e27d8394a06de6ab0
-
SHA1
4bf3aa2fe0d732e0de1e484baf5c7d28045cc2b7
-
SHA256
9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e
-
SHA512
04b6350cd22974d830c81400cac432b40877c8ffd431ddb15e46af7bf1c39eaad9344370115e6fc8e683970bce8037a448a525e9668203d0e698a36f7ec59c89
-
SSDEEP
49152:dT17pq/X+p1y+kGd7mpHg0KB4O8b8ITDnl1Zka:dTtpZjy+77O
Score
7/10
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rWNzSc.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rWNzSc.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JEDI = "C:\\Windows\\w5ja2TA5Gxe.exe" 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\l: 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened (read-only) \??\m: 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened (read-only) \??\q: 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened (read-only) \??\r: 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened (read-only) \??\u: 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened (read-only) \??\v: 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened (read-only) \??\k: 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened (read-only) \??\y: 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened (read-only) \??\z: 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened (read-only) \??\h: 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened (read-only) \??\i: 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened (read-only) \??\n: 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened (read-only) \??\t: 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened (read-only) \??\w: 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened (read-only) \??\e: 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened (read-only) \??\g: 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened (read-only) \??\j: 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened (read-only) \??\o: 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened (read-only) \??\p: 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened (read-only) \??\s: 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened (read-only) \??\x: 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe -
Modifies WinLogon 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification \??\c:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File created \??\c:\Windows\SysWOW64\shutdown.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened for modification \??\c:\Windows\SysWOW64\shutdown.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File created \??\c:\Windows\SysWOW64\takeown.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened for modification \??\c:\Windows\SysWOW64\takeown.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File created \??\c:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe -
Drops file in Windows directory 36 IoCs
description ioc Process File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-shutdown-event-tracker_31bf3856ad364e35_10.0.19041.1_none_c319cf869bb64064\shutdown.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-shutdown-event-tracker_31bf3856ad364e35_10.0.19041.1_none_c319cf869bb64064\shutdown.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.19041.1081_none_f28ba6a10743aebc\SpeechModelDownload.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.19041.264_none_5b8f61a9b1063622\SpeechModelDownload.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-p..-personalizationcsp_31bf3856ad364e35_10.0.19041.746_none_1eeb97b23978a488\r\desktopimgdownldr.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.19041.264_none_513ab7577ca57427\SpeechModelDownload.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-takeown_31bf3856ad364e35_10.0.19041.1_none_afdc734db4fba076\takeown.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.19041.1081_none_f28ba6a10743aebc\SpeechModelDownload.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.19041.1081_none_f28ba6a10743aebc\f\SpeechModelDownload.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.19041.264_none_5b8f61a9b1063622\SpeechModelDownload.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened for modification C:\Windows\w5ja2TA5Gxe.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.19041.1081_none_e836fc4ed2e2ecc1\f\SpeechModelDownload.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-takeown_31bf3856ad364e35_10.0.19041.1_none_afdc734db4fba076\takeown.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-p..-personalizationcsp_31bf3856ad364e35_10.0.19041.746_none_1eeb97b23978a488\desktopimgdownldr.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-p..-personalizationcsp_31bf3856ad364e35_10.0.19041.746_none_1eeb97b23978a488\r\desktopimgdownldr.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-shutdown-event-tracker_31bf3856ad364e35_10.0.19041.1_none_b8c5253467557e69\shutdown.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.19041.1081_none_e836fc4ed2e2ecc1\SpeechModelDownload.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.19041.1081_none_e836fc4ed2e2ecc1\SpeechModelDownload.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-takeown_31bf3856ad364e35_10.0.19041.1_none_ba311d9fe95c6271\takeown.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-p..-personalizationcsp_31bf3856ad364e35_10.0.19041.746_none_1eeb97b23978a488\desktopimgdownldr.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-slidetoshutdown_31bf3856ad364e35_10.0.19041.1_none_4a1699e73b1ad297\SlideToShutDown.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.19041.1081_none_e836fc4ed2e2ecc1\f\SpeechModelDownload.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File created C:\Windows\w5ja2TA5Gxe.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-p..-personalizationcsp_31bf3856ad364e35_10.0.19041.1_none_f6e35a697a06e63e\desktopimgdownldr.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-takeown_31bf3856ad364e35_10.0.19041.1_none_ba311d9fe95c6271\takeown.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-p..-personalizationcsp_31bf3856ad364e35_10.0.19041.1_none_f6e35a697a06e63e\desktopimgdownldr.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-slidetoshutdown_31bf3856ad364e35_10.0.19041.1_none_4a1699e73b1ad297\SlideToShutDown.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.19041.1081_none_e836fc4ed2e2ecc1\r\SpeechModelDownload.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.19041.264_none_513ab7577ca57427\SpeechModelDownload.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.19041.1081_none_f28ba6a10743aebc\f\SpeechModelDownload.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-p..-personalizationcsp_31bf3856ad364e35_10.0.19041.746_none_1eeb97b23978a488\f\desktopimgdownldr.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-shutdown-event-tracker_31bf3856ad364e35_10.0.19041.1_none_b8c5253467557e69\shutdown.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.19041.1081_none_e836fc4ed2e2ecc1\r\SpeechModelDownload.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.19041.1081_none_f28ba6a10743aebc\r\SpeechModelDownload.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.19041.1081_none_f28ba6a10743aebc\r\SpeechModelDownload.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-p..-personalizationcsp_31bf3856ad364e35_10.0.19041.746_none_1eeb97b23978a488\f\desktopimgdownldr.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 4968 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4968
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD512308d442b94de389c087f6551eedc28
SHA1b765de7de71e7b679a8ca10141f4d951d7b08f32
SHA256004a1c3623c76aa8352bc2a48688fa163d2ed188c5a12032b6d90cf9e2ca22fc
SHA5127be01e0b134ea6dc27735d788b1c58da9c95344e123b17211793422d7fd55329edf2b78949a2c7a490bd695412cef10d2c6aadd688ff4275e2c6c9688a72f6a5