Analysis
-
max time kernel
122s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29-06-2024 05:29
Static task
static1
Behavioral task
behavioral1
Sample
6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe
-
Size
65KB
-
MD5
535ebe1e2d3db1183c3d03ee84089d80
-
SHA1
a5ba62d899fd8493f575ada2cb8bda7faed9fee2
-
SHA256
6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575
-
SHA512
a2df122765c36eb0246c5c7bb6b99adf529d7049be5f4a259e9a863e47659241513120474b674443479a9c03ea151474618e200e4fb10fbf2e79ee8ffd39e9a9
-
SSDEEP
1536:fI2GlfINCFjZft25R1DYHcOIDx/4+nUkVYqD7eDJUNW8GwbhcE:RNK0lY84+UkVYqDSNUhGxE
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
Processes:
6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe -
Processes:
6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe -
Processes:
6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe -
Processes:
resource yara_rule behavioral2/memory/3456-1-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3456-8-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3456-3-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3456-7-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3456-19-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3456-15-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3456-21-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3456-14-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3456-5-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3456-4-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3456-6-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3456-22-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3456-23-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3456-24-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3456-25-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3456-26-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3456-28-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3456-29-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3456-30-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3456-32-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3456-33-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3456-35-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3456-36-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3456-40-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3456-42-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3456-44-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3456-46-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3456-47-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3456-50-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3456-51-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3456-53-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3456-55-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3456-57-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3456-60-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3456-67-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3456-69-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3456-70-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3456-73-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3456-78-0x00000000007B0000-0x000000000186A000-memory.dmp upx -
Processes:
6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe -
Processes:
6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exedescription ioc process File opened (read-only) \??\W: 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened (read-only) \??\X: 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened (read-only) \??\H: 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened (read-only) \??\M: 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened (read-only) \??\N: 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened (read-only) \??\Q: 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened (read-only) \??\T: 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened (read-only) \??\V: 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened (read-only) \??\E: 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened (read-only) \??\I: 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened (read-only) \??\L: 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened (read-only) \??\U: 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened (read-only) \??\G: 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened (read-only) \??\K: 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened (read-only) \??\Z: 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened (read-only) \??\J: 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened (read-only) \??\O: 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened (read-only) \??\P: 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened (read-only) \??\R: 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened (read-only) \??\S: 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened (read-only) \??\Y: 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exedescription ioc process File opened for modification C:\autorun.inf 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened for modification F:\autorun.inf 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe -
Drops file in Program Files directory 12 IoCs
Processes:
6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exedescription ioc process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\7z.exe 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe -
Drops file in Windows directory 2 IoCs
Processes:
6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exedescription ioc process File created C:\Windows\e578983 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe File opened for modification C:\Windows\SYSTEM.INI 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exepid process 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exedescription pid process Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Token: SeDebugPrivilege 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exedescription pid process target process PID 3456 wrote to memory of 776 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe fontdrvhost.exe PID 3456 wrote to memory of 784 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe fontdrvhost.exe PID 3456 wrote to memory of 316 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe dwm.exe PID 3456 wrote to memory of 2724 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe sihost.exe PID 3456 wrote to memory of 2796 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe svchost.exe PID 3456 wrote to memory of 752 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe taskhostw.exe PID 3456 wrote to memory of 3432 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Explorer.EXE PID 3456 wrote to memory of 3568 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe svchost.exe PID 3456 wrote to memory of 3752 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe DllHost.exe PID 3456 wrote to memory of 3844 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe StartMenuExperienceHost.exe PID 3456 wrote to memory of 3912 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe RuntimeBroker.exe PID 3456 wrote to memory of 3996 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe SearchApp.exe PID 3456 wrote to memory of 4004 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe RuntimeBroker.exe PID 3456 wrote to memory of 2472 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe RuntimeBroker.exe PID 3456 wrote to memory of 2312 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe TextInputHost.exe PID 3456 wrote to memory of 776 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe fontdrvhost.exe PID 3456 wrote to memory of 784 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe fontdrvhost.exe PID 3456 wrote to memory of 316 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe dwm.exe PID 3456 wrote to memory of 2724 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe sihost.exe PID 3456 wrote to memory of 2796 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe svchost.exe PID 3456 wrote to memory of 752 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe taskhostw.exe PID 3456 wrote to memory of 3432 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Explorer.EXE PID 3456 wrote to memory of 3568 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe svchost.exe PID 3456 wrote to memory of 3752 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe DllHost.exe PID 3456 wrote to memory of 3844 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe StartMenuExperienceHost.exe PID 3456 wrote to memory of 3912 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe RuntimeBroker.exe PID 3456 wrote to memory of 3996 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe SearchApp.exe PID 3456 wrote to memory of 4004 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe RuntimeBroker.exe PID 3456 wrote to memory of 2472 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe RuntimeBroker.exe PID 3456 wrote to memory of 2312 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe TextInputHost.exe PID 3456 wrote to memory of 776 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe fontdrvhost.exe PID 3456 wrote to memory of 784 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe fontdrvhost.exe PID 3456 wrote to memory of 316 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe dwm.exe PID 3456 wrote to memory of 2724 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe sihost.exe PID 3456 wrote to memory of 2796 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe svchost.exe PID 3456 wrote to memory of 752 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe taskhostw.exe PID 3456 wrote to memory of 3432 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Explorer.EXE PID 3456 wrote to memory of 3568 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe svchost.exe PID 3456 wrote to memory of 3752 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe DllHost.exe PID 3456 wrote to memory of 3844 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe StartMenuExperienceHost.exe PID 3456 wrote to memory of 3912 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe RuntimeBroker.exe PID 3456 wrote to memory of 3996 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe SearchApp.exe PID 3456 wrote to memory of 4004 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe RuntimeBroker.exe PID 3456 wrote to memory of 2472 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe RuntimeBroker.exe PID 3456 wrote to memory of 2312 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe TextInputHost.exe PID 3456 wrote to memory of 776 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe fontdrvhost.exe PID 3456 wrote to memory of 784 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe fontdrvhost.exe PID 3456 wrote to memory of 316 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe dwm.exe PID 3456 wrote to memory of 2724 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe sihost.exe PID 3456 wrote to memory of 2796 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe svchost.exe PID 3456 wrote to memory of 752 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe taskhostw.exe PID 3456 wrote to memory of 3432 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe Explorer.EXE PID 3456 wrote to memory of 3568 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe svchost.exe PID 3456 wrote to memory of 3752 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe DllHost.exe PID 3456 wrote to memory of 3844 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe StartMenuExperienceHost.exe PID 3456 wrote to memory of 3912 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe RuntimeBroker.exe PID 3456 wrote to memory of 3996 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe SearchApp.exe PID 3456 wrote to memory of 4004 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe RuntimeBroker.exe PID 3456 wrote to memory of 2472 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe RuntimeBroker.exe PID 3456 wrote to memory of 2312 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe TextInputHost.exe PID 3456 wrote to memory of 776 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe fontdrvhost.exe PID 3456 wrote to memory of 784 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe fontdrvhost.exe PID 3456 wrote to memory of 316 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe dwm.exe PID 3456 wrote to memory of 2724 3456 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe sihost.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6c4d2d0767298df47a523b16e8f5c05e9f0979b3441443cb6afb1f392d69f575_NeikiAnalytics.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Impair Defenses
4Disable or Modify Tools
3Disable or Modify System Firewall
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
F:\rsebxg.pifFilesize
97KB
MD5204631cecfdb28582e83517c83ee651e
SHA1a6c61823da5cdeae3703237707b33b84e8ef4ebb
SHA2566192bb9cccced11e8009c9b73ddd0d07975af764bbb6cd541304ee588d61fdb2
SHA5127f0758a34e928cb5f2575d450dacd067aac84385cc4f26b0b4e3e39bb8ced205d893b5fd4c3bdd6a00f723868b612d1248d94dc62c215e20c64a339597b536c9
-
memory/3456-29-0x00000000007B0000-0x000000000186A000-memory.dmpFilesize
16.7MB
-
memory/3456-78-0x00000000007B0000-0x000000000186A000-memory.dmpFilesize
16.7MB
-
memory/3456-3-0x00000000007B0000-0x000000000186A000-memory.dmpFilesize
16.7MB
-
memory/3456-30-0x00000000007B0000-0x000000000186A000-memory.dmpFilesize
16.7MB
-
memory/3456-18-0x0000000001B00000-0x0000000001B02000-memory.dmpFilesize
8KB
-
memory/3456-19-0x00000000007B0000-0x000000000186A000-memory.dmpFilesize
16.7MB
-
memory/3456-15-0x00000000007B0000-0x000000000186A000-memory.dmpFilesize
16.7MB
-
memory/3456-20-0x0000000001B00000-0x0000000001B02000-memory.dmpFilesize
8KB
-
memory/3456-21-0x00000000007B0000-0x000000000186A000-memory.dmpFilesize
16.7MB
-
memory/3456-14-0x00000000007B0000-0x000000000186A000-memory.dmpFilesize
16.7MB
-
memory/3456-5-0x00000000007B0000-0x000000000186A000-memory.dmpFilesize
16.7MB
-
memory/3456-4-0x00000000007B0000-0x000000000186A000-memory.dmpFilesize
16.7MB
-
memory/3456-17-0x0000000001B10000-0x0000000001B11000-memory.dmpFilesize
4KB
-
memory/3456-16-0x0000000001B00000-0x0000000001B02000-memory.dmpFilesize
8KB
-
memory/3456-6-0x00000000007B0000-0x000000000186A000-memory.dmpFilesize
16.7MB
-
memory/3456-22-0x00000000007B0000-0x000000000186A000-memory.dmpFilesize
16.7MB
-
memory/3456-23-0x00000000007B0000-0x000000000186A000-memory.dmpFilesize
16.7MB
-
memory/3456-33-0x00000000007B0000-0x000000000186A000-memory.dmpFilesize
16.7MB
-
memory/3456-25-0x00000000007B0000-0x000000000186A000-memory.dmpFilesize
16.7MB
-
memory/3456-26-0x00000000007B0000-0x000000000186A000-memory.dmpFilesize
16.7MB
-
memory/3456-28-0x00000000007B0000-0x000000000186A000-memory.dmpFilesize
16.7MB
-
memory/3456-0-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3456-7-0x00000000007B0000-0x000000000186A000-memory.dmpFilesize
16.7MB
-
memory/3456-8-0x00000000007B0000-0x000000000186A000-memory.dmpFilesize
16.7MB
-
memory/3456-24-0x00000000007B0000-0x000000000186A000-memory.dmpFilesize
16.7MB
-
memory/3456-35-0x00000000007B0000-0x000000000186A000-memory.dmpFilesize
16.7MB
-
memory/3456-36-0x00000000007B0000-0x000000000186A000-memory.dmpFilesize
16.7MB
-
memory/3456-40-0x00000000007B0000-0x000000000186A000-memory.dmpFilesize
16.7MB
-
memory/3456-42-0x00000000007B0000-0x000000000186A000-memory.dmpFilesize
16.7MB
-
memory/3456-44-0x00000000007B0000-0x000000000186A000-memory.dmpFilesize
16.7MB
-
memory/3456-46-0x00000000007B0000-0x000000000186A000-memory.dmpFilesize
16.7MB
-
memory/3456-47-0x00000000007B0000-0x000000000186A000-memory.dmpFilesize
16.7MB
-
memory/3456-50-0x00000000007B0000-0x000000000186A000-memory.dmpFilesize
16.7MB
-
memory/3456-51-0x00000000007B0000-0x000000000186A000-memory.dmpFilesize
16.7MB
-
memory/3456-53-0x00000000007B0000-0x000000000186A000-memory.dmpFilesize
16.7MB
-
memory/3456-55-0x00000000007B0000-0x000000000186A000-memory.dmpFilesize
16.7MB
-
memory/3456-57-0x00000000007B0000-0x000000000186A000-memory.dmpFilesize
16.7MB
-
memory/3456-60-0x00000000007B0000-0x000000000186A000-memory.dmpFilesize
16.7MB
-
memory/3456-67-0x00000000007B0000-0x000000000186A000-memory.dmpFilesize
16.7MB
-
memory/3456-69-0x00000000007B0000-0x000000000186A000-memory.dmpFilesize
16.7MB
-
memory/3456-71-0x0000000001B00000-0x0000000001B02000-memory.dmpFilesize
8KB
-
memory/3456-70-0x00000000007B0000-0x000000000186A000-memory.dmpFilesize
16.7MB
-
memory/3456-73-0x00000000007B0000-0x000000000186A000-memory.dmpFilesize
16.7MB
-
memory/3456-32-0x00000000007B0000-0x000000000186A000-memory.dmpFilesize
16.7MB
-
memory/3456-1-0x00000000007B0000-0x000000000186A000-memory.dmpFilesize
16.7MB