ramnit | 11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 20:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
Size

881KB
MD5

e5ba25f6dff850ddaff8e6b07ecd44d0
SHA1

916aef6ce2ba8516587657188654bb583737c61c
SHA256

11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf
SHA512

38d544b8f81f4bf2af372411f2becbf716f76a18748370cd3305ca5b1b2bcfb88de0e083b87a9d2ae65592cc1ef8a4fd6c82f9159896994f61eb2e4f1eec4b5c
SSDEEP

12288:4wCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEN888888888888W8888888c:YNzCtUpQ9WWPBSSRMTEpXN4

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Drops startup file 1 IoCs

Processes:

11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Paint.lnk	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe

Executes dropped EXE 2 IoCs

Processes:

11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalyticsSrv.exeDesktopLayer.exe

pid process

1820 11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalyticsSrv.exe
3160 DesktopLayer.exe

pid	process
1820	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalyticsSrv.exe
3160	DesktopLayer.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalyticsSrv.exe	upx
behavioral2/memory/1820-4-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/memory/1820-6-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/memory/3160-13-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral2/memory/3160-15-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe

description	ioc	process
File opened for modification	C:\autorun.inf	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File opened for modification	F:\autorun.inf	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

Processes:

11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalyticsSrv.exe

description	ioc	process
File created	C:\Program Files\Java\jdk-1.8\bin\vjcmd.ico	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\vOSPPREARM.EXE	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\vjavah.ico	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7z.exe	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InputPersonalization.exe.mui	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\InputPersonalization.exe.mui	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\vjavap.exe	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalyticsSrv.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\OfflineScannerShell.exe.mui	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\vchrome.exe.sig	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\vappletviewer.exe	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\vjhat.ico	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\msinfo32.exe.mui	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\vOSE.ico	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\vCLVIEW.EXE	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\vaccicons.ico	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\vmisc.exe	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TabTip.exe.mui	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\Office16\vOSPPREARM.ico	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\vSmartTagInstall.ico	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\createdump.exe	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javap.exe	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Internet Explorer\fr-FR\iexplore.exe.mui	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\ShapeCollector.exe.mui	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Internet Explorer\es-ES\ieinstal.exe.mui	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Internet Explorer\ja-JP\ieinstal.exe.mui	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\vAppVShNotify.exe	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\vchrome_pwa_launcher.ico	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalyticsSrv.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.exe.sig	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\RCX4826.tmp	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\OfflineScannerShell.exe.mui	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\v7zG.exe	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\vAppVShNotify.ico	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\vchrome_proxy.ico	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\vjavaw.exe	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\vjhat.exe	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\msinfo32.exe.mui	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\vmisc.ico	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\RCX2BD4.tmp	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\createdump.exe	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe

Drops file in Windows directory 1 IoCs

Processes:

11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe

description ioc process

File opened for modification C:\Windows\bfsvc.exe 11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\bfsvc.exe	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426371186"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{462414A5-358C-11EF-B9F7-5E2396FD2BC6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115673"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "459864424"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115673"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "459864424"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31115673"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "508926524"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

DesktopLayer.exe

pid process

3160 DesktopLayer.exe
3160 DesktopLayer.exe
3160 DesktopLayer.exe
3160 DesktopLayer.exe
3160 DesktopLayer.exe
3160 DesktopLayer.exe
3160 DesktopLayer.exe
3160 DesktopLayer.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

884 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

884 iexplore.exe
884 iexplore.exe
2152 IEXPLORE.EXE
2152 IEXPLORE.EXE
2152 IEXPLORE.EXE
2152 IEXPLORE.EXE

pid	process
3160	DesktopLayer.exe
3160	DesktopLayer.exe
3160	DesktopLayer.exe
3160	DesktopLayer.exe
3160	DesktopLayer.exe
3160	DesktopLayer.exe
3160	DesktopLayer.exe
3160	DesktopLayer.exe

pid	process
884	iexplore.exe

pid	process
884	iexplore.exe
884	iexplore.exe
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalyticsSrv.exeDesktopLayer.exeiexplore.exe

description	pid	process	target process
PID 2332 wrote to memory of 1820	2332	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalyticsSrv.exe
PID 2332 wrote to memory of 1820	2332	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalyticsSrv.exe
PID 2332 wrote to memory of 1820	2332	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalyticsSrv.exe
PID 1820 wrote to memory of 3160	1820	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalyticsSrv.exe	DesktopLayer.exe
PID 1820 wrote to memory of 3160	1820	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalyticsSrv.exe	DesktopLayer.exe
PID 1820 wrote to memory of 3160	1820	11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalyticsSrv.exe	DesktopLayer.exe
PID 3160 wrote to memory of 884	3160	DesktopLayer.exe	iexplore.exe
PID 3160 wrote to memory of 884	3160	DesktopLayer.exe	iexplore.exe
PID 884 wrote to memory of 2152	884	iexplore.exe	IEXPLORE.EXE
PID 884 wrote to memory of 2152	884	iexplore.exe	IEXPLORE.EXE
PID 884 wrote to memory of 2152	884	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalytics.exe"
1⤵
- Drops startup file
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2332

C:\Users\Admin\AppData\Local\Temp\11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalyticsSrv.exe
C:\Users\Admin\AppData\Local\Temp\11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalyticsSrv.exe
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1820

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3160

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:884

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:884 CREDAT:17410 /prefetch:2
5⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3696 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:4316

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\microsoft shared\ClickToRun\vOfficeC2RClient.ico
Filesize
4KB

MD5
3ea9bcbc01e1a652de5a6fc291a66d1a

SHA1
aee490d53ee201879dff37503a0796c77642a792

SHA256
a058bfd185fe714927e15642004866449bce425d34292a08af56d66cf03ebe6c

SHA512
7c740132f026341770b6a20575786da581d8a31850d0d680978a00cc4dfca1e848ef9cdc32e51bae680ea13f6cc0d7324c38765cb4e26dcb2e423aced7da0501

Download Submit
C:\Program Files\Java\jdk-1.8\bin\vjavaws.ico
Filesize
4KB

MD5
38b41d03e9dfcbbd08210c5f0b50ba71

SHA1
2fbfde75ce9fe8423d8e7720bf7408cedcb57a70

SHA256
611f2cb2e03bd8dbcb584cd0a1c48accfba072dd3fc4e6d3144e2062553637f5

SHA512
ec97556b6ff6023d9e6302ba586ef27b1b54fbf7e8ac04ff318aa4694f13ad343049210ef17b7b603963984c1340589665d67d9c65fec0f91053ff43b1401ba9

Download Submit
C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\vmisc.ico
Filesize
4KB

MD5
fc27f73816c9f640d800cdc1c9294751

SHA1
e6c3d8835d1de4e9606e5588e741cd1be27398f6

SHA256
3cc5043caa157e5f9b1870527b8c323850bdae1e58d6760e4e895d2ab8a35a05

SHA512
9e36b96acc97bc7cd45e67a47f1ae7ab7d3818cc2fdaad147524ce9e4baedfaac9cd012923ec65db763bfd850c65b497376bb0694508bee59747f97bf1591fd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
471B

MD5
293ea21f7d2b09f447f07d065dd542b9

SHA1
5d30d1d814dab60840b66cb9ee7dd8ceea05df70

SHA256
2203bb67fc1d126a35d05b53e3b9c39acf5a06b6f2d792099460e8caa83f2a32

SHA512
7d5ff3768b8ab54f4186a325ac433eb4a1f3dfabb30d641a0a1d6b9f2f24c5dd83cc5d05c13477cab16c5644d39e45ae991d75a1ddb7c79b76e562b4f2eb2898

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
404B

MD5
fad992afc8364afb3a99796a58953e55

SHA1
d33748086ab3e906d6dff1ef5690972fb43be175

SHA256
32e7a029fd0d29ba937c77736d73390e4bb68066f4b3a21a53bf66944009a4d6

SHA512
1b31b88f5a40bb0ddeb06573334f378f40e2d3b927e90d7693b9cfd75ad40ca9af6cb118027f5429295442ba9056b1935f70d926110474cba87e2fd32e8db304

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\suggestions[1].en-US
Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf_NeikiAnalyticsSrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\odt\office2016setup.exe
Filesize
881KB

MD5
e5ba25f6dff850ddaff8e6b07ecd44d0

SHA1
916aef6ce2ba8516587657188654bb583737c61c

SHA256
11060745e33b13bb2dd9a63ed44cce487d15cfbdaa3764b4650d659bd6cb8daf

SHA512
38d544b8f81f4bf2af372411f2becbf716f76a18748370cd3305ca5b1b2bcfb88de0e083b87a9d2ae65592cc1ef8a4fd6c82f9159896994f61eb2e4f1eec4b5c

Download Submit
F:\autorun.inf
Filesize
102B

MD5
5513829683bff23161ca7d8595c25c72

SHA1
9961b65bbd3bac109dddd3a161fc30650e8a7096

SHA256
94e323bd9071db7369ade16f45454e7a0dbfb6a39efddc1234c4719d1f7ee4c2

SHA512
308c84446106cda0a71e37b0de46aaf4b7361f9ddcc3c4c29f8e87da8acb606525dce8a42caf9d74e708c56b31c524f9535a2f5f4757c6c357401da1c495ddb6

Download Submit
memory/1820-4-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1820-6-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1820-5-0x0000000000440000-0x000000000044F000-memory.dmp

Filesize
60KB

Download
memory/2332-73-0x0000000000400000-0x00000000004EA000-memory.dmp

Filesize
936KB

Download
memory/2332-74-0x0000000000400000-0x00000000004EA000-memory.dmp

Filesize
936KB

Download
memory/2332-0-0x0000000000400000-0x00000000004EA000-memory.dmp

Filesize
936KB

Download
memory/2332-16-0x0000000000400000-0x00000000004EA000-memory.dmp

Filesize
936KB

Download
memory/2332-301-0x0000000000400000-0x00000000004EA000-memory.dmp

Filesize
936KB

Download
memory/3160-15-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3160-14-0x0000000000450000-0x0000000000451000-memory.dmp

Filesize
4KB

Download
memory/3160-13-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download