a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 19:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
Size

45KB
MD5

b8b4a2245272c28b4a94c423537bbf70
SHA1

b4027f0bb56cbd9a3db9eab0020af121de954727
SHA256

a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a
SHA512

22785a96bcc644e31d960f7310445b5055c6858716a7634217e2474fa4b3e87ad5a555315fa4093f90d11014ac103a2643c7da545b1d31b0899a67818f44af25
SSDEEP

768:8V5hy+7c6OXdfwEQ90NoZCi5TXbRzjEDta8jFqjsZvI2YxrQiP+ZRDd+RYTl/iUk:8h7xsCKosi5pzjIcdRiTpqMGxs3U

Score

8^/10

persistence

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\debugger = "ntsd -d"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\debugger = "ntsd -d"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\debugger = "ntsd -d"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe	reg.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe "	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	\??\c:\Windows\SysWOW64\regedit.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.EXE	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\INFOPATH.EXE	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Windows Mail\wabmig.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\microsoft shared\ink\mip.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\javap.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jre7\bin\jabswitch.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jre7\bin\rmid.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Microsoft Games\Solitaire\Solitaire.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmplayer.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Windows Defender\MpCmdRun.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\iediagcmd.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jre7\bin\ktab.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files (x86)\Windows Media Player\wmpconfig.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\DVD Maker\DVDMaker.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\setup_wm.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\java.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\vlc.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\WMPSideShowGadget.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jre7\bin\tnameserv.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\maintenanceservice.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jre7\bin\javaw.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	\??\c:\Windows\bfsvc.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Windows\fveupdate.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Windows\HelpPane.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Windows\notepad.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Windows\splwow64.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Windows\twunk_16.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Windows\twunk_32.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Windows\write.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Windows\explorer.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Windows\hh.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Windows\winhlp32.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
File opened for modification	\??\c:\Windows\Boot\PCAT\memtest.exe	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe "	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe "	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe "	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\zipfile	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.txt	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe "	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.txt \ = " exefile"	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2664	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2664	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2616	2664	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe	28
PID 2664 wrote to memory of 2616	2664	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe	28
PID 2664 wrote to memory of 2616	2664	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe	28
PID 2664 wrote to memory of 2616	2664	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe	28
PID 2664 wrote to memory of 4316	2664	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe	30
PID 2664 wrote to memory of 4316	2664	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe	30
PID 2664 wrote to memory of 4316	2664	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe	30
PID 2664 wrote to memory of 4316	2664	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe	30
PID 2664 wrote to memory of 4324	2664	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe	31
PID 2664 wrote to memory of 4324	2664	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe	31
PID 2664 wrote to memory of 4324	2664	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe	31
PID 2664 wrote to memory of 4324	2664	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe	31
PID 2664 wrote to memory of 4332	2664	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe	32
PID 2664 wrote to memory of 4332	2664	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe	32
PID 2664 wrote to memory of 4332	2664	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe	32
PID 2664 wrote to memory of 4332	2664	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe	32
PID 2664 wrote to memory of 4352	2664	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe	36
PID 2664 wrote to memory of 4352	2664	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe	36
PID 2664 wrote to memory of 4352	2664	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe	36
PID 2664 wrote to memory of 4352	2664	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe	36
PID 2664 wrote to memory of 4400	2664	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe	37
PID 2664 wrote to memory of 4400	2664	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe	37
PID 2664 wrote to memory of 4400	2664	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe	37
PID 2664 wrote to memory of 4400	2664	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe	37
PID 2664 wrote to memory of 4420	2664	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe	39
PID 2664 wrote to memory of 4420	2664	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe	39
PID 2664 wrote to memory of 4420	2664	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe	39
PID 2664 wrote to memory of 4420	2664	a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe	39
PID 4316 wrote to memory of 4484	4316	cmd.exe	42
PID 4316 wrote to memory of 4484	4316	cmd.exe	42
PID 4316 wrote to memory of 4484	4316	cmd.exe	42
PID 4316 wrote to memory of 4484	4316	cmd.exe	42
PID 4316 wrote to memory of 4492	4316	cmd.exe	43
PID 4316 wrote to memory of 4492	4316	cmd.exe	43
PID 4316 wrote to memory of 4492	4316	cmd.exe	43
PID 4316 wrote to memory of 4492	4316	cmd.exe	43
PID 4316 wrote to memory of 4500	4316	cmd.exe	44
PID 4316 wrote to memory of 4500	4316	cmd.exe	44
PID 4316 wrote to memory of 4500	4316	cmd.exe	44
PID 4316 wrote to memory of 4500	4316	cmd.exe	44

C:\Users\Admin\AppData\Local\Temp\a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:2616
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\123.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4316
- - C:\Windows\SysWOW64\reg.exe
    reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:4484
- - C:\Windows\SysWOW64\reg.exe
    reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:4492
- - C:\Windows\SysWOW64\reg.exe
    reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:4500
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c assoc .txt = exefile
  2⤵
  - Modifies registry class
  PID:4324
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ftype comfile=C:\Users\Admin\AppData\Local\Temp\a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
  2⤵
  - Modifies system executable filetype association
  - Modifies registry class
  PID:4332
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ftype zipfile=C:\Users\Admin\AppData\Local\Temp\a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
  2⤵
  - Modifies registry class
  PID:4352
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ftype jpgfile=C:\Users\Admin\AppData\Local\Temp\a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
  2⤵
  - Modifies registry class
  PID:4400
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ftype txtfile=C:\Users\Admin\AppData\Local\Temp\a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
  2⤵
  - Modifies registry class
  PID:4420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\123.bat

Filesize
443B

MD5
70170ba16a737a438223b88279dc6c85

SHA1
cc066efa0fca9bc9f44013660dea6b28ddfd6a24

SHA256
d3674f4b34a8ca8167160519aa5c66b6024eb09f4cb0c9278bc44370b0efec6a

SHA512
37cc8c954544374d0a1ca4d012c9bd0b47781bc9bb8d0c15a8a95b9934893db3bedee867b984c20edabe54c39574abf7250de433aade6c0d544b8dd2c972c6da

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
45KB

MD5
3fd4d8d6910bd52e72ff5e0277f6b441

SHA1
b7e1478c4acf28bf926d041173e2f18561106e5e

SHA256
839d0da23307aba9222feb32badc4bdedb61197230f2dd95ca6571cebc8f6249

SHA512
a421e520204bc7bee465fe19de32eb0c4230c6d8c3661b3c2ae5527a76f356b695610a603ad08f3e6f24827cc7fa972650280f645a1cad6a8ca7e9582bc931f5

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads