0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38

Analysis

max time kernel
134s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2024, 23:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
Size

45KB
MD5

0cce11903b78f49e5bb4204dfa1a3ae0
SHA1

c9c9be3a81f62d52a92371396cd120470e14f0b8
SHA256

0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38
SHA512

d856fdfe3f7c85365fee19ecbf117bd1cfaa57ffb4dea46c3c09308c9488fae95b549b949074fb1ee4aea062a32d7bfcee02572a5168a64ccfdf9e974e7c7568
SSDEEP

768:8V5hy+7c6OXdfwEQ90NoZCi5TXbRzjEDta8jFqjsZvI2YxrQiP+ZRDd+RYTl/iUE:8h7xsCKosi5pzjIcdRiTpqMGxs30

Score

8^/10

persistence

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\debugger = "ntsd -d"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\debugger = "ntsd -d"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\debugger = "ntsd -d"	reg.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe "	cmd.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\bin\java-rmi.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\javaws.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\jar.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\bin\javaws.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\bin\jabswitch.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\javapackager.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\keytool.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\7-Zip\7z.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\bin\rmid.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\xjc.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zG.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\iexplore.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\kinit.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\javaw.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\rmic.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\java.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\jconsole.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\jdeps.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\orbd.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\iediagcmd.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\ielowutil.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\javac.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\jmap.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\schemagen.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\bin\ktab.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.txt	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.txt \ = " exefile"	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe "	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\zipfile	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe "	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe "	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe "	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2628	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2628	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 2816	2628	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe	82
PID 2628 wrote to memory of 2816	2628	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe	82
PID 2628 wrote to memory of 2816	2628	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe	82
PID 2628 wrote to memory of 408	2628	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe	88
PID 2628 wrote to memory of 408	2628	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe	88
PID 2628 wrote to memory of 408	2628	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe	88
PID 2628 wrote to memory of 1244	2628	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe	89
PID 2628 wrote to memory of 1244	2628	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe	89
PID 2628 wrote to memory of 1244	2628	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe	89
PID 2628 wrote to memory of 8	2628	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe	90
PID 2628 wrote to memory of 8	2628	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe	90
PID 2628 wrote to memory of 8	2628	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe	90
PID 2628 wrote to memory of 4580	2628	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe	91
PID 2628 wrote to memory of 4580	2628	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe	91
PID 2628 wrote to memory of 4580	2628	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe	91
PID 2628 wrote to memory of 3376	2628	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe	92
PID 2628 wrote to memory of 3376	2628	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe	92
PID 2628 wrote to memory of 3376	2628	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe	92
PID 2628 wrote to memory of 1576	2628	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe	93
PID 2628 wrote to memory of 1576	2628	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe	93
PID 2628 wrote to memory of 1576	2628	0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe	93
PID 408 wrote to memory of 924	408	cmd.exe	100
PID 408 wrote to memory of 924	408	cmd.exe	100
PID 408 wrote to memory of 924	408	cmd.exe	100
PID 408 wrote to memory of 2052	408	cmd.exe	101
PID 408 wrote to memory of 2052	408	cmd.exe	101
PID 408 wrote to memory of 2052	408	cmd.exe	101
PID 408 wrote to memory of 4468	408	cmd.exe	102
PID 408 wrote to memory of 4468	408	cmd.exe	102
PID 408 wrote to memory of 4468	408	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe
  2⤵
  PID:2816
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\123.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:408
- - C:\Windows\SysWOW64\reg.exe
    reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:924
- - C:\Windows\SysWOW64\reg.exe
    reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:2052
- - C:\Windows\SysWOW64\reg.exe
    reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:4468
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c assoc .txt = exefile
  2⤵
  - Modifies registry class
  PID:1244
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ftype comfile=C:\Users\Admin\AppData\Local\Temp\0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
  2⤵
  - Modifies system executable filetype association
  - Modifies registry class
  PID:8
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ftype zipfile=C:\Users\Admin\AppData\Local\Temp\0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
  2⤵
  - Modifies registry class
  PID:4580
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ftype jpgfile=C:\Users\Admin\AppData\Local\Temp\0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
  2⤵
  - Modifies registry class
  PID:3376
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ftype txtfile=C:\Users\Admin\AppData\Local\Temp\0e88708b89aaab3073ef5dbd8dc252bd5e8c21bcefdfd2cb4ab68c38b906ac38_NeikiAnalytics.exe
  2⤵
  - Modifies registry class
  PID:1576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\123.bat

Filesize
443B

MD5
70170ba16a737a438223b88279dc6c85

SHA1
cc066efa0fca9bc9f44013660dea6b28ddfd6a24

SHA256
d3674f4b34a8ca8167160519aa5c66b6024eb09f4cb0c9278bc44370b0efec6a

SHA512
37cc8c954544374d0a1ca4d012c9bd0b47781bc9bb8d0c15a8a95b9934893db3bedee867b984c20edabe54c39574abf7250de433aade6c0d544b8dd2c972c6da

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
45KB

MD5
392f9134d10bbc0f5d5405fb6878a8f2

SHA1
61c7a54488569e704ae29c5552cba16843822b6f

SHA256
dd7937413745e5b0954e00ff72573b57e1ca309ffe0bde0c5bbb76517aebe958

SHA512
5a9f9d586d78a23c5c0e67e6ff91f9599c4f8a2891481780c3a5f6ce1f55e09a5f664c5affd3de8636858b5968cd24fdf39dfd228fe0d84ff6016bb044a15953

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads