Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
29/06/2024, 23:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
-
Size
45KB
-
MD5
0cce11903b78f49e5bb4204dfa1a3ae0
-
SHA1
c9c9be3a81f62d52a92371396cd120470e14f0b8
-
SHA256
0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38
-
SHA512
d856fdfe3f7c85365fee19ecbf117bd1cfaa57ffb4dea46c3c09308c9488fae95b549b949074fb1ee4aea062a32d7bfcee02572a5168a64ccfdf9e974e7c7568
-
SSDEEP
768:8V5hy+7c6OXdfwEQ90NoZCi5TXbRzjEDta8jFqjsZvI2YxrQiP+ZRDd+RYTl/iUE:8h7xsCKosi5pzjIcdRiTpqMGxs30
Score
8/10
Malware Config
Signatures
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe reg.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe " cmd.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification \??\c:\Windows\SysWOW64\regedit.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmpnscfg.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Internet Explorer\iexplore.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Games\Mahjong\Mahjong.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\pingsender.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Windows Mail\wab.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Windows Media Player\wmlaunch.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\7-Zip\Uninstall.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Windows NT\Accessories\wordpad.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Internet Explorer\ExtExport.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\updater.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\javac.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\javaws.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\SETLANG.EXE 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\firefox.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmpconfig.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\java.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Windows Mail\wab.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\rmid.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Internet Explorer\iexplore.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\ssvagent.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\tnameserv.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Windows Mail\wabmig.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Internet Explorer\ieinstal.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Internet Explorer\ielowutil.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\vsta_ep32.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\OIS.EXE 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\mip.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.EXE 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\kinit.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\default-browser-agent.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Windows Photo Viewer\ImagingDevices.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification \??\c:\Windows\hh.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Windows\twunk_16.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Windows\twunk_32.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Windows\winhlp32.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Windows\fveupdate.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Windows\explorer.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Windows\HelpPane.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Windows\notepad.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Windows\splwow64.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Windows\write.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Windows\Boot\PCAT\memtest.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe File opened for modification \??\c:\Windows\bfsvc.exe 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe -
Modifies registry class 14 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.txt cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.txt \ = " exefile" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell cmd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2424 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2424 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 2424 wrote to memory of 1968 2424 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe 28 PID 2424 wrote to memory of 1968 2424 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe 28 PID 2424 wrote to memory of 1968 2424 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe 28 PID 2424 wrote to memory of 1968 2424 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe 28 PID 2424 wrote to memory of 4236 2424 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe 30 PID 2424 wrote to memory of 4236 2424 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe 30 PID 2424 wrote to memory of 4236 2424 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe 30 PID 2424 wrote to memory of 4236 2424 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe 30 PID 2424 wrote to memory of 4244 2424 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe 31 PID 2424 wrote to memory of 4244 2424 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe 31 PID 2424 wrote to memory of 4244 2424 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe 31 PID 2424 wrote to memory of 4244 2424 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe 31 PID 2424 wrote to memory of 4252 2424 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe 32 PID 2424 wrote to memory of 4252 2424 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe 32 PID 2424 wrote to memory of 4252 2424 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe 32 PID 2424 wrote to memory of 4252 2424 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe 32 PID 2424 wrote to memory of 4260 2424 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe 33 PID 2424 wrote to memory of 4260 2424 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe 33 PID 2424 wrote to memory of 4260 2424 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe 33 PID 2424 wrote to memory of 4260 2424 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe 33 PID 2424 wrote to memory of 4268 2424 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe 34 PID 2424 wrote to memory of 4268 2424 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe 34 PID 2424 wrote to memory of 4268 2424 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe 34 PID 2424 wrote to memory of 4268 2424 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe 34 PID 2424 wrote to memory of 4276 2424 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe 35 PID 2424 wrote to memory of 4276 2424 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe 35 PID 2424 wrote to memory of 4276 2424 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe 35 PID 2424 wrote to memory of 4276 2424 0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe 35 PID 4236 wrote to memory of 4396 4236 cmd.exe 42 PID 4236 wrote to memory of 4396 4236 cmd.exe 42 PID 4236 wrote to memory of 4396 4236 cmd.exe 42 PID 4236 wrote to memory of 4396 4236 cmd.exe 42 PID 4236 wrote to memory of 4404 4236 cmd.exe 43 PID 4236 wrote to memory of 4404 4236 cmd.exe 43 PID 4236 wrote to memory of 4404 4236 cmd.exe 43 PID 4236 wrote to memory of 4404 4236 cmd.exe 43 PID 4236 wrote to memory of 4412 4236 cmd.exe 44 PID 4236 wrote to memory of 4412 4236 cmd.exe 44 PID 4236 wrote to memory of 4412 4236 cmd.exe 44 PID 4236 wrote to memory of 4412 4236 cmd.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\SysWOW64\cmd.execmd.exe2⤵PID:1968
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\123.bat2⤵
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Event Triggered Execution: Image File Execution Options Injection
PID:4396
-
-
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Event Triggered Execution: Image File Execution Options Injection
PID:4404
-
-
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Event Triggered Execution: Image File Execution Options Injection
PID:4412
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c assoc .txt = exefile2⤵
- Modifies registry class
PID:4244
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype comfile=C:\Users\Admin\AppData\Local\Temp\0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe2⤵
- Modifies system executable filetype association
- Modifies registry class
PID:4252
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype zipfile=C:\Users\Admin\AppData\Local\Temp\0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe2⤵
- Modifies registry class
PID:4260
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype jpgfile=C:\Users\Admin\AppData\Local\Temp\0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe2⤵
- Modifies registry class
PID:4268
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype txtfile=C:\Users\Admin\AppData\Local\Temp\0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe2⤵
- Modifies registry class
PID:4276
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
443B
MD570170ba16a737a438223b88279dc6c85
SHA1cc066efa0fca9bc9f44013660dea6b28ddfd6a24
SHA256d3674f4b34a8ca8167160519aa5c66b6024eb09f4cb0c9278bc44370b0efec6a
SHA51237cc8c954544374d0a1ca4d012c9bd0b47781bc9bb8d0c15a8a95b9934893db3bedee867b984c20edabe54c39574abf7250de433aade6c0d544b8dd2c972c6da
-
Filesize
45KB
MD57785bbebb0e2a49d88b4c039fe8b0b15
SHA1bc31d870e4b94c74a573e494aaa0dcad2d97ffd5
SHA2562e4d85bdb6591c1bb68b2176ac3e48da0659fd3e5d7cbc60191498c0e7d6032c
SHA512ba6c99968d2f3ee56f703bbc5bc2d4a98643169647148ae4e35268b4094d2d78c55e12fb3b577524fb3afe331ed642336975bac80e5151b6c4ea23af2b49eb5c