Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
28/06/2024, 19:18
Static task
static1
Behavioral task
behavioral1
Sample
a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe
-
Size
45KB
-
MD5
b8b4a2245272c28b4a94c423537bbf70
-
SHA1
b4027f0bb56cbd9a3db9eab0020af121de954727
-
SHA256
a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a
-
SHA512
22785a96bcc644e31d960f7310445b5055c6858716a7634217e2474fa4b3e87ad5a555315fa4093f90d11014ac103a2643c7da545b1d31b0899a67818f44af25
-
SSDEEP
768:8V5hy+7c6OXdfwEQ90NoZCi5TXbRzjEDta8jFqjsZvI2YxrQiP+ZRDd+RYTl/iUk:8h7xsCKosi5pzjIcdRiTpqMGxs3U
Malware Config
Signatures
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe reg.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe " cmd.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jjs.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jstatd.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javaws.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jrunscript.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\java-rmi.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jhat.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jinfo.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jps.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\pack200.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\excelcnv.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\7-Zip\7z.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jconsole.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\wsgen.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jdeps.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Internet Explorer\ielowutil.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\keytool.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\jabswitch.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\orbd.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\unpack200.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\mip.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javaw.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\Wordconv.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Internet Explorer\iexplore.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\java.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\serialver.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\wsimport.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\jp2launcher.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\7-Zip\7zFM.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jdb.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe -
Modifies registry class 14 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe " cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe " cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.txt \ = " exefile" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.txt cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe " cmd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5040 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5040 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 5040 wrote to memory of 2740 5040 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 83 PID 5040 wrote to memory of 2740 5040 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 83 PID 5040 wrote to memory of 2740 5040 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 83 PID 5040 wrote to memory of 4368 5040 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 89 PID 5040 wrote to memory of 4368 5040 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 89 PID 5040 wrote to memory of 4368 5040 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 89 PID 5040 wrote to memory of 3148 5040 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 90 PID 5040 wrote to memory of 3148 5040 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 90 PID 5040 wrote to memory of 3148 5040 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 90 PID 5040 wrote to memory of 3512 5040 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 91 PID 5040 wrote to memory of 3512 5040 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 91 PID 5040 wrote to memory of 3512 5040 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 91 PID 5040 wrote to memory of 1052 5040 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 92 PID 5040 wrote to memory of 1052 5040 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 92 PID 5040 wrote to memory of 1052 5040 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 92 PID 5040 wrote to memory of 4996 5040 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 93 PID 5040 wrote to memory of 4996 5040 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 93 PID 5040 wrote to memory of 4996 5040 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 93 PID 5040 wrote to memory of 1740 5040 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 95 PID 5040 wrote to memory of 1740 5040 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 95 PID 5040 wrote to memory of 1740 5040 a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe 95 PID 4368 wrote to memory of 4640 4368 cmd.exe 101 PID 4368 wrote to memory of 4640 4368 cmd.exe 101 PID 4368 wrote to memory of 4640 4368 cmd.exe 101 PID 4368 wrote to memory of 2616 4368 cmd.exe 102 PID 4368 wrote to memory of 2616 4368 cmd.exe 102 PID 4368 wrote to memory of 2616 4368 cmd.exe 102 PID 4368 wrote to memory of 2976 4368 cmd.exe 103 PID 4368 wrote to memory of 2976 4368 cmd.exe 103 PID 4368 wrote to memory of 2976 4368 cmd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\SysWOW64\cmd.execmd.exe2⤵PID:2740
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\123.bat2⤵
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Event Triggered Execution: Image File Execution Options Injection
PID:4640
-
-
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Event Triggered Execution: Image File Execution Options Injection
PID:2616
-
-
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Event Triggered Execution: Image File Execution Options Injection
PID:2976
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c assoc .txt = exefile2⤵
- Modifies registry class
PID:3148
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype comfile=C:\Users\Admin\AppData\Local\Temp\a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe2⤵
- Modifies system executable filetype association
- Modifies registry class
PID:3512
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype zipfile=C:\Users\Admin\AppData\Local\Temp\a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe2⤵
- Modifies registry class
PID:1052
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype jpgfile=C:\Users\Admin\AppData\Local\Temp\a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe2⤵
- Modifies registry class
PID:4996
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype txtfile=C:\Users\Admin\AppData\Local\Temp\a7548abba5753f7b63d67e04c9b2a8f43387dd2ca437d772527acbaaa989ba4a_NeikiAnalytics.exe2⤵
- Modifies registry class
PID:1740
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
443B
MD570170ba16a737a438223b88279dc6c85
SHA1cc066efa0fca9bc9f44013660dea6b28ddfd6a24
SHA256d3674f4b34a8ca8167160519aa5c66b6024eb09f4cb0c9278bc44370b0efec6a
SHA51237cc8c954544374d0a1ca4d012c9bd0b47781bc9bb8d0c15a8a95b9934893db3bedee867b984c20edabe54c39574abf7250de433aade6c0d544b8dd2c972c6da
-
Filesize
45KB
MD5ca75b3e20aa3e889ecee62f75bad073c
SHA1f98866c71d93f1e0c18245b3379b7db3a9e58229
SHA2561ee78246142a6db012cc508f5fed31acc9cd7ab4c603e767e90b60cc79bd2c14
SHA512887a90121d3fea666162ec7eb3d7529967909f76ab490b7b8ca823cdaf3840e9fc3df352303dd598d4c3f33aea1036cf371de5143cff1d17a84849e19d7efc8d