Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/06/2024, 19:18
Static task
static1
Behavioral task
behavioral1
Sample
a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
-
Size
45KB
-
MD5
b8b4a2245272c28b4a94c423537bbf70
-
SHA1
b4027f0bb56cbd9a3db9eab0020af121de954727
-
SHA256
a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a
-
SHA512
22785a96bcc644e31d960f7310445b5055c6858716a7634217e2474fa4b3e87ad5a555315fa4093f90d11014ac103a2643c7da545b1d31b0899a67818f44af25
-
SSDEEP
768:8V5hy+7c6OXdfwEQ90NoZCi5TXbRzjEDta8jFqjsZvI2YxrQiP+ZRDd+RYTl/iUk:8h7xsCKosi5pzjIcdRiTpqMGxs3U
Malware Config
Signatures
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe reg.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe " cmd.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification \??\c:\Windows\SysWOW64\regedit.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.EXE a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\INFOPATH.EXE a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Windows Mail\wabmig.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\ink\mip.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\javap.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\jabswitch.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\rmid.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Games\Solitaire\Solitaire.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmplayer.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Windows Defender\MpCmdRun.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Internet Explorer\iediagcmd.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\ktab.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Windows Media Player\wmpconfig.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\DVD Maker\DVDMaker.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Windows Media Player\setup_wm.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\java.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\VideoLAN\VLC\vlc.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Windows Media Player\WMPSideShowGadget.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\tnameserv.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\maintenanceservice.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\javaw.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification \??\c:\Windows\bfsvc.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Windows\fveupdate.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Windows\HelpPane.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Windows\notepad.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Windows\splwow64.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Windows\twunk_16.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Windows\twunk_32.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Windows\write.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Windows\explorer.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Windows\hh.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Windows\winhlp32.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Windows\Boot\PCAT\memtest.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe -
Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe " cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.txt cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe " cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.txt \ = " exefile" cmd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2664 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2664 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 2664 wrote to memory of 2616 2664 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 28 PID 2664 wrote to memory of 2616 2664 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 28 PID 2664 wrote to memory of 2616 2664 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 28 PID 2664 wrote to memory of 2616 2664 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 28 PID 2664 wrote to memory of 4316 2664 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 30 PID 2664 wrote to memory of 4316 2664 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 30 PID 2664 wrote to memory of 4316 2664 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 30 PID 2664 wrote to memory of 4316 2664 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 30 PID 2664 wrote to memory of 4324 2664 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 31 PID 2664 wrote to memory of 4324 2664 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 31 PID 2664 wrote to memory of 4324 2664 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 31 PID 2664 wrote to memory of 4324 2664 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 31 PID 2664 wrote to memory of 4332 2664 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 32 PID 2664 wrote to memory of 4332 2664 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 32 PID 2664 wrote to memory of 4332 2664 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 32 PID 2664 wrote to memory of 4332 2664 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 32 PID 2664 wrote to memory of 4352 2664 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 36 PID 2664 wrote to memory of 4352 2664 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 36 PID 2664 wrote to memory of 4352 2664 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 36 PID 2664 wrote to memory of 4352 2664 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 36 PID 2664 wrote to memory of 4400 2664 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 37 PID 2664 wrote to memory of 4400 2664 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 37 PID 2664 wrote to memory of 4400 2664 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 37 PID 2664 wrote to memory of 4400 2664 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 37 PID 2664 wrote to memory of 4420 2664 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 39 PID 2664 wrote to memory of 4420 2664 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 39 PID 2664 wrote to memory of 4420 2664 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 39 PID 2664 wrote to memory of 4420 2664 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 39 PID 4316 wrote to memory of 4484 4316 cmd.exe 42 PID 4316 wrote to memory of 4484 4316 cmd.exe 42 PID 4316 wrote to memory of 4484 4316 cmd.exe 42 PID 4316 wrote to memory of 4484 4316 cmd.exe 42 PID 4316 wrote to memory of 4492 4316 cmd.exe 43 PID 4316 wrote to memory of 4492 4316 cmd.exe 43 PID 4316 wrote to memory of 4492 4316 cmd.exe 43 PID 4316 wrote to memory of 4492 4316 cmd.exe 43 PID 4316 wrote to memory of 4500 4316 cmd.exe 44 PID 4316 wrote to memory of 4500 4316 cmd.exe 44 PID 4316 wrote to memory of 4500 4316 cmd.exe 44 PID 4316 wrote to memory of 4500 4316 cmd.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\cmd.execmd.exe2⤵PID:2616
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\123.bat2⤵
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Event Triggered Execution: Image File Execution Options Injection
PID:4484
-
-
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Event Triggered Execution: Image File Execution Options Injection
PID:4492
-
-
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Event Triggered Execution: Image File Execution Options Injection
PID:4500
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c assoc .txt = exefile2⤵
- Modifies registry class
PID:4324
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype comfile=C:\Users\Admin\AppData\Local\Temp\a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe2⤵
- Modifies system executable filetype association
- Modifies registry class
PID:4332
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype zipfile=C:\Users\Admin\AppData\Local\Temp\a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe2⤵
- Modifies registry class
PID:4352
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype jpgfile=C:\Users\Admin\AppData\Local\Temp\a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe2⤵
- Modifies registry class
PID:4400
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype txtfile=C:\Users\Admin\AppData\Local\Temp\a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe2⤵
- Modifies registry class
PID:4420
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
443B
MD570170ba16a737a438223b88279dc6c85
SHA1cc066efa0fca9bc9f44013660dea6b28ddfd6a24
SHA256d3674f4b34a8ca8167160519aa5c66b6024eb09f4cb0c9278bc44370b0efec6a
SHA51237cc8c954544374d0a1ca4d012c9bd0b47781bc9bb8d0c15a8a95b9934893db3bedee867b984c20edabe54c39574abf7250de433aade6c0d544b8dd2c972c6da
-
Filesize
45KB
MD53fd4d8d6910bd52e72ff5e0277f6b441
SHA1b7e1478c4acf28bf926d041173e2f18561106e5e
SHA256839d0da23307aba9222feb32badc4bdedb61197230f2dd95ca6571cebc8f6249
SHA512a421e520204bc7bee465fe19de32eb0c4230c6d8c3661b3c2ae5527a76f356b695610a603ad08f3e6f24827cc7fa972650280f645a1cad6a8ca7e9582bc931f5