Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 23:17
Static task
static1
Behavioral task
behavioral1
Sample
2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe
-
Size
370KB
-
MD5
9c3c4d283a975c929162148393b3c9b0
-
SHA1
61146483732ef46dbc420462f7597f79b879e9de
-
SHA256
2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a
-
SHA512
49112ee34249644b9aad0f999c056ca6952c15d1de5ffc4ed4df2be661f76da2d2b6b9be3c03edf77e77d020fe77221f0bd8fa87eb3dbd94cf036687df700317
-
SSDEEP
6144:Ddj0ha2IjEQzrpX+ZahGWm2GWm2GWmDdJJLVHyRUdUhBeAjkyjC3ukMR/:Zj0h3IjoD5MYUhYEky23uR
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 7 IoCs
Processes:
2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe:*:enabled:@shell32.dll,-1" 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe -
Processes:
2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe -
Processes:
2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe -
Processes:
resource yara_rule behavioral2/memory/740-1-0x0000000002280000-0x000000000330E000-memory.dmp upx behavioral2/memory/740-3-0x0000000002280000-0x000000000330E000-memory.dmp upx behavioral2/memory/740-6-0x0000000002280000-0x000000000330E000-memory.dmp upx behavioral2/memory/740-4-0x0000000002280000-0x000000000330E000-memory.dmp upx behavioral2/memory/740-7-0x0000000002280000-0x000000000330E000-memory.dmp upx behavioral2/memory/740-9-0x0000000002280000-0x000000000330E000-memory.dmp upx behavioral2/memory/740-8-0x0000000002280000-0x000000000330E000-memory.dmp upx behavioral2/memory/740-10-0x0000000002280000-0x000000000330E000-memory.dmp upx behavioral2/memory/740-5-0x0000000002280000-0x000000000330E000-memory.dmp upx behavioral2/memory/740-11-0x0000000002280000-0x000000000330E000-memory.dmp upx behavioral2/memory/740-12-0x0000000002280000-0x000000000330E000-memory.dmp upx behavioral2/memory/740-13-0x0000000002280000-0x000000000330E000-memory.dmp upx behavioral2/memory/740-19-0x0000000002280000-0x000000000330E000-memory.dmp upx behavioral2/memory/740-22-0x0000000002280000-0x000000000330E000-memory.dmp upx behavioral2/memory/740-23-0x0000000002280000-0x000000000330E000-memory.dmp upx behavioral2/memory/740-28-0x0000000002280000-0x000000000330E000-memory.dmp upx behavioral2/memory/740-31-0x0000000002280000-0x000000000330E000-memory.dmp upx behavioral2/memory/740-32-0x0000000002280000-0x000000000330E000-memory.dmp upx behavioral2/memory/740-34-0x0000000002280000-0x000000000330E000-memory.dmp upx -
Processes:
2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe -
Processes:
2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe -
Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exedescription ioc process File opened (read-only) \??\E: 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe File opened (read-only) \??\G: 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe File opened (read-only) \??\H: 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe -
Drops file in Windows directory 2 IoCs
Processes:
2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe File created C:\Windows\_bmp23_.bm_ 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exepid process 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe -
Suspicious behavior: MapViewOfSection 64 IoCs
Processes:
2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exepid process 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exedescription pid process Token: SeDebugPrivilege 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe Token: SeDebugPrivilege 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe Token: SeDebugPrivilege 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe Token: SeDebugPrivilege 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe Token: SeDebugPrivilege 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe Token: SeDebugPrivilege 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe Token: SeDebugPrivilege 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe Token: SeDebugPrivilege 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe Token: SeDebugPrivilege 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe Token: SeDebugPrivilege 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe Token: SeDebugPrivilege 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe Token: SeDebugPrivilege 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe Token: SeDebugPrivilege 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe Token: SeDebugPrivilege 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe Token: SeDebugPrivilege 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe Token: SeDebugPrivilege 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe Token: SeDebugPrivilege 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe Token: SeDebugPrivilege 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe Token: SeDebugPrivilege 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe Token: SeDebugPrivilege 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe Token: SeDebugPrivilege 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe Token: SeDebugPrivilege 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe Token: SeDebugPrivilege 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exepid process 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exedescription pid process target process PID 740 wrote to memory of 624 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe winlogon.exe PID 740 wrote to memory of 624 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe winlogon.exe PID 740 wrote to memory of 624 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe winlogon.exe PID 740 wrote to memory of 624 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe winlogon.exe PID 740 wrote to memory of 624 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe winlogon.exe PID 740 wrote to memory of 624 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe winlogon.exe PID 740 wrote to memory of 676 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe lsass.exe PID 740 wrote to memory of 676 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe lsass.exe PID 740 wrote to memory of 676 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe lsass.exe PID 740 wrote to memory of 676 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe lsass.exe PID 740 wrote to memory of 676 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe lsass.exe PID 740 wrote to memory of 676 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe lsass.exe PID 740 wrote to memory of 788 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe svchost.exe PID 740 wrote to memory of 788 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe svchost.exe PID 740 wrote to memory of 788 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe svchost.exe PID 740 wrote to memory of 788 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe svchost.exe PID 740 wrote to memory of 788 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe svchost.exe PID 740 wrote to memory of 788 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe svchost.exe PID 740 wrote to memory of 796 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe fontdrvhost.exe PID 740 wrote to memory of 796 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe fontdrvhost.exe PID 740 wrote to memory of 796 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe fontdrvhost.exe PID 740 wrote to memory of 796 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe fontdrvhost.exe PID 740 wrote to memory of 796 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe fontdrvhost.exe PID 740 wrote to memory of 796 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe fontdrvhost.exe PID 740 wrote to memory of 804 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe fontdrvhost.exe PID 740 wrote to memory of 804 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe fontdrvhost.exe PID 740 wrote to memory of 804 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe fontdrvhost.exe PID 740 wrote to memory of 804 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe fontdrvhost.exe PID 740 wrote to memory of 804 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe fontdrvhost.exe PID 740 wrote to memory of 804 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe fontdrvhost.exe PID 740 wrote to memory of 916 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe svchost.exe PID 740 wrote to memory of 916 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe svchost.exe PID 740 wrote to memory of 916 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe svchost.exe PID 740 wrote to memory of 916 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe svchost.exe PID 740 wrote to memory of 916 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe svchost.exe PID 740 wrote to memory of 916 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe svchost.exe PID 740 wrote to memory of 964 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe svchost.exe PID 740 wrote to memory of 964 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe svchost.exe PID 740 wrote to memory of 964 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe svchost.exe PID 740 wrote to memory of 964 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe svchost.exe PID 740 wrote to memory of 964 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe svchost.exe PID 740 wrote to memory of 964 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe svchost.exe PID 740 wrote to memory of 376 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe dwm.exe PID 740 wrote to memory of 376 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe dwm.exe PID 740 wrote to memory of 376 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe dwm.exe PID 740 wrote to memory of 376 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe dwm.exe PID 740 wrote to memory of 376 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe dwm.exe PID 740 wrote to memory of 376 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe dwm.exe PID 740 wrote to memory of 408 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe svchost.exe PID 740 wrote to memory of 408 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe svchost.exe PID 740 wrote to memory of 408 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe svchost.exe PID 740 wrote to memory of 408 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe svchost.exe PID 740 wrote to memory of 408 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe svchost.exe PID 740 wrote to memory of 408 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe svchost.exe PID 740 wrote to memory of 1028 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe svchost.exe PID 740 wrote to memory of 1028 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe svchost.exe PID 740 wrote to memory of 1028 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe svchost.exe PID 740 wrote to memory of 1028 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe svchost.exe PID 740 wrote to memory of 1028 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe svchost.exe PID 740 wrote to memory of 1028 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe svchost.exe PID 740 wrote to memory of 1064 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe svchost.exe PID 740 wrote to memory of 1064 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe svchost.exe PID 740 wrote to memory of 1064 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe svchost.exe PID 740 wrote to memory of 1064 740 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe svchost.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"2⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding2⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca2⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca2⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding2⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca2⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca2⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca2⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2f77f398277c0b4dec23773292b8c89bd62cd6aa5b148edd47363db4b30ad54a_NeikiAnalytics.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Impair Defenses
4Disable or Modify Tools
3Disable or Modify System Firewall
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/740-0-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/740-1-0x0000000002280000-0x000000000330E000-memory.dmpFilesize
16.6MB
-
memory/740-3-0x0000000002280000-0x000000000330E000-memory.dmpFilesize
16.6MB
-
memory/740-6-0x0000000002280000-0x000000000330E000-memory.dmpFilesize
16.6MB
-
memory/740-4-0x0000000002280000-0x000000000330E000-memory.dmpFilesize
16.6MB
-
memory/740-7-0x0000000002280000-0x000000000330E000-memory.dmpFilesize
16.6MB
-
memory/740-9-0x0000000002280000-0x000000000330E000-memory.dmpFilesize
16.6MB
-
memory/740-8-0x0000000002280000-0x000000000330E000-memory.dmpFilesize
16.6MB
-
memory/740-10-0x0000000002280000-0x000000000330E000-memory.dmpFilesize
16.6MB
-
memory/740-5-0x0000000002280000-0x000000000330E000-memory.dmpFilesize
16.6MB
-
memory/740-11-0x0000000002280000-0x000000000330E000-memory.dmpFilesize
16.6MB
-
memory/740-15-0x0000000002260000-0x0000000002261000-memory.dmpFilesize
4KB
-
memory/740-14-0x0000000002250000-0x0000000002252000-memory.dmpFilesize
8KB
-
memory/740-16-0x0000000002250000-0x0000000002252000-memory.dmpFilesize
8KB
-
memory/740-12-0x0000000002280000-0x000000000330E000-memory.dmpFilesize
16.6MB
-
memory/740-17-0x0000000002250000-0x0000000002252000-memory.dmpFilesize
8KB
-
memory/740-13-0x0000000002280000-0x000000000330E000-memory.dmpFilesize
16.6MB
-
memory/740-18-0x000000007FE40000-0x000000007FE4C000-memory.dmpFilesize
48KB
-
memory/740-19-0x0000000002280000-0x000000000330E000-memory.dmpFilesize
16.6MB
-
memory/740-21-0x000000007FE40000-0x000000007FE4C000-memory.dmpFilesize
48KB
-
memory/740-20-0x000000007FE40000-0x000000007FE4C000-memory.dmpFilesize
48KB
-
memory/740-22-0x0000000002280000-0x000000000330E000-memory.dmpFilesize
16.6MB
-
memory/740-23-0x0000000002280000-0x000000000330E000-memory.dmpFilesize
16.6MB
-
memory/740-28-0x0000000002280000-0x000000000330E000-memory.dmpFilesize
16.6MB
-
memory/740-29-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/740-30-0x000000005F000000-0x000000005F011000-memory.dmpFilesize
68KB
-
memory/740-31-0x0000000002280000-0x000000000330E000-memory.dmpFilesize
16.6MB
-
memory/740-32-0x0000000002280000-0x000000000330E000-memory.dmpFilesize
16.6MB
-
memory/740-34-0x0000000002280000-0x000000000330E000-memory.dmpFilesize
16.6MB
-
memory/740-39-0x000000007FE40000-0x000000007FE4C000-memory.dmpFilesize
48KB
-
memory/740-43-0x0000000002250000-0x0000000002252000-memory.dmpFilesize
8KB
-
memory/740-56-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/740-55-0x000000005F000000-0x000000005F011000-memory.dmpFilesize
68KB