Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01/07/2024, 21:23
Static task
static1
Behavioral task
behavioral1
Sample
0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe
-
Size
45KB
-
MD5
f3d21fdcbcaf3c599398191a31c9c5e0
-
SHA1
9fb680981ca1b31f641991b1014df6093a0753e3
-
SHA256
0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a
-
SHA512
aa4cd6032c257c7ecbf0453dddfd758bfb393f5d1c0906e392bfcf631ec16f36398b92d123856dfae8fb8bd6e01325bfa6b988ca5bbaffef5964f2c97b3bc0d5
-
SSDEEP
768:8V5hy+7c6OXdfwEQ90NoZCi5TXbRzjEDta8jFqjsZvI2YxrQiP+ZRDd+RYTl/iU7:8h7xsCKosi5pzjIcdRiTpqMGxs3Eq
Malware Config
Signatures
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe reg.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe " cmd.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javaw.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jdb.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\7-Zip\7zG.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jdeps.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Internet Explorer\ieinstal.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javap.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\extcheck.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javaws.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\orbd.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\rmid.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msoasb.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\pack200.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\wsgen.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\java-rmi.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jhat.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\7-Zip\7z.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\java.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javadoc.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\klist.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msoia.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\unpack200.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\orbd.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jjs.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\rmic.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\java.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\7-Zip\Uninstall.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jmap.exe 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe -
Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe " cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.txt cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.txt \ = " exefile" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell cmd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1760 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1760 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 1760 wrote to memory of 2932 1760 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe 81 PID 1760 wrote to memory of 2932 1760 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe 81 PID 1760 wrote to memory of 2932 1760 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe 81 PID 1760 wrote to memory of 1036 1760 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe 83 PID 1760 wrote to memory of 1036 1760 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe 83 PID 1760 wrote to memory of 1036 1760 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe 83 PID 1760 wrote to memory of 2284 1760 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe 84 PID 1760 wrote to memory of 2284 1760 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe 84 PID 1760 wrote to memory of 2284 1760 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe 84 PID 1760 wrote to memory of 2660 1760 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe 85 PID 1760 wrote to memory of 2660 1760 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe 85 PID 1760 wrote to memory of 2660 1760 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe 85 PID 1760 wrote to memory of 1196 1760 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe 86 PID 1760 wrote to memory of 1196 1760 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe 86 PID 1760 wrote to memory of 1196 1760 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe 86 PID 1760 wrote to memory of 4964 1760 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe 87 PID 1760 wrote to memory of 4964 1760 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe 87 PID 1760 wrote to memory of 4964 1760 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe 87 PID 1760 wrote to memory of 3216 1760 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe 88 PID 1760 wrote to memory of 3216 1760 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe 88 PID 1760 wrote to memory of 3216 1760 0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe 88 PID 1036 wrote to memory of 436 1036 cmd.exe 95 PID 1036 wrote to memory of 436 1036 cmd.exe 95 PID 1036 wrote to memory of 436 1036 cmd.exe 95 PID 1036 wrote to memory of 2984 1036 cmd.exe 96 PID 1036 wrote to memory of 2984 1036 cmd.exe 96 PID 1036 wrote to memory of 2984 1036 cmd.exe 96 PID 1036 wrote to memory of 3196 1036 cmd.exe 97 PID 1036 wrote to memory of 3196 1036 cmd.exe 97 PID 1036 wrote to memory of 3196 1036 cmd.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\cmd.execmd.exe2⤵PID:2932
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\123.bat2⤵
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Event Triggered Execution: Image File Execution Options Injection
PID:436
-
-
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Event Triggered Execution: Image File Execution Options Injection
PID:2984
-
-
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Event Triggered Execution: Image File Execution Options Injection
PID:3196
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c assoc .txt = exefile2⤵
- Modifies registry class
PID:2284
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype comfile=C:\Users\Admin\AppData\Local\Temp\0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe2⤵
- Modifies system executable filetype association
- Modifies registry class
PID:2660
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype zipfile=C:\Users\Admin\AppData\Local\Temp\0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe2⤵
- Modifies registry class
PID:1196
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype jpgfile=C:\Users\Admin\AppData\Local\Temp\0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe2⤵
- Modifies registry class
PID:4964
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype txtfile=C:\Users\Admin\AppData\Local\Temp\0a1888db2c58e6f7b782f6649008cecf75bd64a8ca1e02ef9507a8c729ca015a_NeikiAnalytics.exe2⤵
- Modifies registry class
PID:3216
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
443B
MD570170ba16a737a438223b88279dc6c85
SHA1cc066efa0fca9bc9f44013660dea6b28ddfd6a24
SHA256d3674f4b34a8ca8167160519aa5c66b6024eb09f4cb0c9278bc44370b0efec6a
SHA51237cc8c954544374d0a1ca4d012c9bd0b47781bc9bb8d0c15a8a95b9934893db3bedee867b984c20edabe54c39574abf7250de433aade6c0d544b8dd2c972c6da
-
Filesize
45KB
MD5d0e3226eec5b8f6858fa0e675a2d0fb7
SHA1cc1c06bc04c08d0f5465631f60bd8c68328e58bd
SHA25683f1b668f2ade3d20ba12ae5f899190c0ec18f2f945d0da55efc89e6904bcce0
SHA512aec756d580d98782debdf76ef2814811e441858b19584dc3d418c62d37cf675e651e55dd9e0f74e3da7339bcae3939c534a7fd7c01bec13a7eda36fb205ea3c5