Analysis
-
max time kernel
21s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
29-06-2024 05:05
Static task
static1
Behavioral task
behavioral1
Sample
68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe
Resource
win7-20240611-en
General
-
Target
68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe
-
Size
300KB
-
MD5
918cc69d4af1ba0482b6c9a6067d63f0
-
SHA1
1259810f0b0d36c3fde05240498270ac33f639ba
-
SHA256
68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5
-
SHA512
08bffa536dc410e6841f785fffe46a33a9c92207d827f3a33a6bbf2e9edb9a0e67b9a6e243e00efc58801503ceebfda7138513e6460c2e8d141c51171c67becd
-
SSDEEP
3072:jonL5tpV+CSA1AAPoCpxW5ATBfUPhpS1svkTVC9FieYTTLprx/m3qT4S826guKqy:8tpvoCpcPe1jQdi0aCJd/s+nK
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
Processes:
68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exesvchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" svchost.exe -
Processes:
68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exesvchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe -
Processes:
68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exesvchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" svchost.exe -
Adds policy Run key to start application 2 TTPs 8 IoCs
Processes:
68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exeGlobal.exesvchost.exesystem.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sys = "C:\\WINDOWS\\Fonts\\Fonts.exe" 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Global.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sys = "C:\\WINDOWS\\Fonts\\Fonts.exe" Global.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sys = "C:\\WINDOWS\\Fonts\\Fonts.exe" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sys = "C:\\WINDOWS\\Fonts\\Fonts.exe" system.exe -
Drops file in Drivers directory 4 IoCs
Processes:
68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exeGlobal.exesvchost.exesystem.exedescription ioc process File created C:\WINDOWS\SysWOW64\drivers\drivers.cab.exe 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\drivers\drivers.cab.exe Global.exe File created C:\WINDOWS\SysWOW64\drivers\drivers.cab.exe svchost.exe File created C:\WINDOWS\SysWOW64\drivers\drivers.cab.exe system.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
Processes:
Global.exesvchost.exesystem.exe68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe Global.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\WINDOWS\\Media\\rndll32.pif" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "C:\\WINDOWS\\Fonts\\Fonts.exe" system.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\auto.exe system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "C:\\WINDOWS\\Fonts\\Fonts.exe" 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\auto.exe 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autorun.exe Global.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe\Debugger = "C:\\WINDOWS\\Fonts\\fonts.exe" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpHost.com" 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe Global.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\WINDOWS\\Media\\rndll32.pif" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpHost.com" Global.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe system.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autorun.exe 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe Global.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe\Debugger = "C:\\WINDOWS\\system32\\drivers\\drivers.cab.exe" Global.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe Global.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe\Debugger = "C:\\WINDOWS\\system32\\drivers\\drivers.cab.exe" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\auto.exe svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe Global.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe Global.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\auto.exe\Debugger = "C:\\WINDOWS\\system32\\drivers\\drivers.cab.exe" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpHost.com" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\WINDOWS\\Fonts\\tskmgr.exe" 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autorun.exe\Debugger = "C:\\WINDOWS\\system32\\drivers\\drivers.cab.exe" 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\auto.exe Global.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe\Debugger = "C:\\WINDOWS\\system32\\drivers\\drivers.cab.exe" 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autorun.exe\Debugger = "C:\\WINDOWS\\system32\\drivers\\drivers.cab.exe" Global.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\auto.exe\Debugger = "C:\\WINDOWS\\system32\\drivers\\drivers.cab.exe" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\WINDOWS\\Media\\rndll32.pif" Global.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\WINDOWS\\Fonts\\tskmgr.exe" system.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe system.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\WINDOWS\\Media\\rndll32.pif" 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "C:\\WINDOWS\\Fonts\\Fonts.exe" Global.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpHost.com" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\WINDOWS\\Fonts\\tskmgr.exe" Global.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\auto.exe\Debugger = "C:\\WINDOWS\\system32\\drivers\\drivers.cab.exe" Global.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autorun.exe\Debugger = "C:\\WINDOWS\\system32\\drivers\\drivers.cab.exe" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autorun.exe system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe\Debugger = "C:\\WINDOWS\\Fonts\\fonts.exe" 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\auto.exe\Debugger = "C:\\WINDOWS\\system32\\drivers\\drivers.cab.exe" 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\WINDOWS\\Fonts\\tskmgr.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe\Debugger = "C:\\WINDOWS\\system32\\drivers\\drivers.cab.exe" system.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autorun.exe svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autorun.exe\Debugger = "C:\\WINDOWS\\system32\\drivers\\drivers.cab.exe" system.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe\Debugger = "C:\\WINDOWS\\Fonts\\fonts.exe" Global.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "C:\\WINDOWS\\Fonts\\Fonts.exe" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe\Debugger = "C:\\WINDOWS\\Fonts\\fonts.exe" system.exe -
Executes dropped EXE 3 IoCs
Processes:
Global.exesvchost.exesystem.exepid process 760 Global.exe 2908 svchost.exe 832 system.exe -
Loads dropped DLL 6 IoCs
Processes:
68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exeGlobal.exesvchost.exepid process 1080 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe 1080 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe 760 Global.exe 760 Global.exe 2908 svchost.exe 2908 svchost.exe -
Modifies system executable filetype association 2 TTPs 8 IoCs
Processes:
68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exeGlobal.exesvchost.exesystem.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\NeverShowExt = "1" 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" Global.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\NeverShowExt = "1" Global.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\NeverShowExt = "1" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\NeverShowExt = "1" system.exe -
Processes:
resource yara_rule behavioral1/memory/1080-9-0x00000000026B0000-0x000000000376A000-memory.dmp upx behavioral1/memory/1080-6-0x00000000026B0000-0x000000000376A000-memory.dmp upx behavioral1/memory/1080-8-0x00000000026B0000-0x000000000376A000-memory.dmp upx behavioral1/memory/1080-10-0x00000000026B0000-0x000000000376A000-memory.dmp upx behavioral1/memory/1080-7-0x00000000026B0000-0x000000000376A000-memory.dmp upx behavioral1/memory/1080-11-0x00000000026B0000-0x000000000376A000-memory.dmp upx behavioral1/memory/1080-14-0x00000000026B0000-0x000000000376A000-memory.dmp upx behavioral1/memory/1080-5-0x00000000026B0000-0x000000000376A000-memory.dmp upx behavioral1/memory/1080-12-0x00000000026B0000-0x000000000376A000-memory.dmp upx behavioral1/memory/1080-35-0x00000000026B0000-0x000000000376A000-memory.dmp upx behavioral1/memory/1080-13-0x00000000026B0000-0x000000000376A000-memory.dmp upx behavioral1/memory/1080-34-0x00000000026B0000-0x000000000376A000-memory.dmp upx behavioral1/memory/1080-36-0x00000000026B0000-0x000000000376A000-memory.dmp upx behavioral1/memory/1080-130-0x00000000026B0000-0x000000000376A000-memory.dmp upx behavioral1/memory/2908-158-0x0000000002590000-0x000000000364A000-memory.dmp upx behavioral1/memory/2908-148-0x0000000002590000-0x000000000364A000-memory.dmp upx behavioral1/memory/2908-152-0x0000000002590000-0x000000000364A000-memory.dmp upx behavioral1/memory/2908-159-0x0000000002590000-0x000000000364A000-memory.dmp upx behavioral1/memory/2908-161-0x0000000002590000-0x000000000364A000-memory.dmp upx -
Processes:
68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exesvchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe -
Adds Run key to start application 2 TTPs 12 IoCs
Processes:
svchost.exesystem.exe68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exeGlobal.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ = "C:\\WINDOWS\\system32\\dllcache\\Default.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\WINDOWS\\system\\KEYBOARD.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ = "C:\\WINDOWS\\system32\\dllcache\\Default.exe" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ = "C:\\WINDOWS\\system32\\dllcache\\Default.exe" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ = "C:\\WINDOWS\\system32\\dllcache\\Default.exe" 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\WINDOWS\\system\\KEYBOARD.exe" 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ = "C:\\WINDOWS\\system32\\dllcache\\Default.exe" Global.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ = "C:\\WINDOWS\\system32\\dllcache\\Default.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\WINDOWS\\system\\KEYBOARD.exe" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ = "C:\\WINDOWS\\system32\\dllcache\\Default.exe" 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ = "C:\\WINDOWS\\system32\\dllcache\\Default.exe" Global.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\WINDOWS\\system\\KEYBOARD.exe" Global.exe -
Processes:
svchost.exe68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe -
Enumerates connected drives 3 TTPs 5 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
svchost.exedescription ioc process File opened (read-only) \??\E: svchost.exe File opened (read-only) \??\G: svchost.exe File opened (read-only) \??\H: svchost.exe File opened (read-only) \??\I: svchost.exe File opened (read-only) \??\J: svchost.exe -
Drops autorun.inf file 1 TTPs 11 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
svchost.exeGlobal.exesystem.exe68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exedescription ioc process File opened for modification C:\WINDOWS\SysWOW64\dllcache\autorun.inf svchost.exe File created C:\autorun.inf Global.exe File opened for modification D:\autorun.inf Global.exe File created D:\autorun.inf Global.exe File opened for modification F:\autorun.inf Global.exe File created F:\autorun.inf Global.exe File opened for modification C:\WINDOWS\SysWOW64\dllcache\autorun.inf system.exe File opened for modification C:\WINDOWS\SysWOW64\dllcache\autorun.inf 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe File created C:\WINDOWS\SysWOW64\dllcache\autorun.inf 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\dllcache\autorun.inf Global.exe File opened for modification C:\autorun.inf Global.exe -
Drops file in System32 directory 54 IoCs
Processes:
svchost.exesystem.exe68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exeGlobal.exedescription ioc process File created C:\WINDOWS\SysWOW64\dllcache\Default.exe svchost.exe File created C:\WINDOWS\SysWOW64\regedit.exe system.exe File opened for modification C:\WINDOWS\SysWOW64\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\svchost.exe 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe File created C:\WINDOWS\SysWOW64\dllcache\Default.exe 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\dllcache 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe File created C:\WINDOWS\SysWOW64\dllcache\autorun.inf 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe File created C:\WINDOWS\SysWOW64\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\svchost.exe system.exe File opened for modification C:\WINDOWS\SysWOW64\dllcache\tskmgr.exe Global.exe File created C:\WINDOWS\SysWOW64\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe system.exe File opened for modification C:\WINDOWS\SysWOW64\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\Global.exe system.exe File created C:\WINDOWS\SysWOW64\dllcache\Default.exe system.exe File opened for modification C:\WINDOWS\SysWOW64\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe File created C:\WINDOWS\SysWOW64\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\Global.exe Global.exe File opened for modification C:\WINDOWS\SysWOW64\dllcache\ 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe File created C:\WINDOWS\SysWOW64\dllcache\tskmgr.exe Global.exe File opened for modification C:\WINDOWS\SysWOW64\dllcache\Global.exe Global.exe File opened for modification C:\WINDOWS\SysWOW64\dllcache svchost.exe File created C:\WINDOWS\SysWOW64\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe svchost.exe File created C:\WINDOWS\SysWOW64\dllcache\svchost.exe system.exe File opened for modification C:\WINDOWS\SysWOW64\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E)\Global.exe 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe File created C:\WINDOWS\SysWOW64\regedit.exe 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\dllcache\ system.exe File opened for modification C:\WINDOWS\SysWOW64\dllcache\autorun.inf 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe File created C:\WINDOWS\SysWOW64\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\Global.exe svchost.exe File created C:\WINDOWS\SysWOW64\dllcache\svchost.exe svchost.exe File created C:\WINDOWS\SysWOW64\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe File created C:\WINDOWS\SysWOW64\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\svchost.exe svchost.exe File opened for modification C:\WINDOWS\SysWOW64\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\svchost.exe system.exe File opened for modification C:\WINDOWS\SysWOW64\dllcache\autorun.inf svchost.exe File opened for modification C:\WINDOWS\SysWOW64\dllcache\autorun.inf Global.exe File created C:\WINDOWS\SysWOW64\dllcache\Global.exe svchost.exe File opened for modification C:\WINDOWS\SysWOW64\dllcache Global.exe File opened for modification C:\WINDOWS\SysWOW64\dllcache\ Global.exe File opened for modification C:\WINDOWS\SysWOW64\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\Global.exe svchost.exe File opened for modification C:\WINDOWS\SysWOW64\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\Global.exe Global.exe File created C:\WINDOWS\SysWOW64\regedit.exe Global.exe File opened for modification C:\WINDOWS\SysWOW64\dllcache\autorun.inf system.exe File opened for modification C:\WINDOWS\SysWOW64\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe Global.exe File created C:\WINDOWS\SysWOW64\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\Global.exe system.exe File created C:\WINDOWS\SysWOW64\dllcache\Global.exe 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\dllcache\svchost.exe Global.exe File opened for modification C:\WINDOWS\SysWOW64\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E)\svchost.exe 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe File created C:\WINDOWS\SysWOW64\dllcache\svchost.exe 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\svchost.exe svchost.exe File created C:\WINDOWS\SysWOW64\dllcache\tskmgr.exe 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E} 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe File opened for modification C:\WINDOWS\SysWOW64\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\svchost.exe Global.exe File opened for modification C:\WINDOWS\SysWOW64\dllcache\Default.exe Global.exe File created C:\WINDOWS\SysWOW64\regedit.exe svchost.exe File opened for modification C:\WINDOWS\SysWOW64\dllcache\ svchost.exe File opened for modification C:\WINDOWS\SysWOW64\dllcache system.exe File created C:\WINDOWS\SysWOW64\dllcache\Global.exe system.exe File created C:\WINDOWS\SysWOW64\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\svchost.exe 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe File created C:\WINDOWS\SysWOW64\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\Global.exe 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe -
Drops file in Windows directory 41 IoCs
Processes:
system.exe68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exeGlobal.exesvchost.exedescription ioc process File created C:\WINDOWS\pchealth\Global.exe system.exe File created C:\WINDOWS\Media\rndll32.pif system.exe File opened for modification C:\WINDOWS\Cursors\Boom.vbs 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe File opened for modification C:\WINDOWS\Fonts\tskmgr.exe Global.exe File opened for modification C:\WINDOWS\pchealth\Global.exe Global.exe File created C:\WINDOWS\pchealth\helpctr\binaries\HelpHost.com svchost.exe File created C:\WINDOWS\system\KEYBOARD.exe svchost.exe File created C:\Windows\f761574 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe File opened for modification C:\WINDOWS\Fonts\wav.wav 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe File created C:\WINDOWS\Help\microsoft.hlp system.exe File created C:\WINDOWS\pchealth\helpctr\binaries\HelpHost.com Global.exe File opened for modification C:\WINDOWS\Cursors\Boom.vbs svchost.exe File opened for modification C:\WINDOWS\Fonts\Fonts.exe Global.exe File created C:\WINDOWS\Fonts\Fonts.exe svchost.exe File created C:\WINDOWS\pchealth\Global.exe svchost.exe File created C:\WINDOWS\Fonts\wav.wav 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe File created C:\WINDOWS\Help\microsoft.hlp 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe File opened for modification C:\WINDOWS\Help\microsoft.hlp Global.exe File opened for modification C:\WINDOWS\Cursors\Boom.vbs Global.exe File created C:\WINDOWS\Cursors\Boom.vbs svchost.exe File created C:\WINDOWS\Cursors\Boom.vbs system.exe File created C:\WINDOWS\Fonts\Fonts.exe 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe File created C:\WINDOWS\Cursors\Boom.vbs 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe File created C:\WINDOWS\pchealth\Global.exe 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe File opened for modification C:\WINDOWS\Media\rndll32.pif Global.exe File created C:\WINDOWS\Cursors\Boom.vbs Global.exe File created C:\Windows\f763fed svchost.exe File opened for modification C:\Windows\SYSTEM.INI 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe File created C:\WINDOWS\pchealth\helpctr\binaries\HelpHost.com 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe File opened for modification C:\WINDOWS\system\KEYBOARD.exe Global.exe File created C:\WINDOWS\Help\microsoft.hlp svchost.exe File created C:\WINDOWS\Fonts\tskmgr.exe svchost.exe File created C:\WINDOWS\Fonts\tskmgr.exe system.exe File created C:\WINDOWS\system\KEYBOARD.exe 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe File created C:\WINDOWS\Fonts\tskmgr.exe 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe File created C:\WINDOWS\Fonts\Fonts.exe system.exe File created C:\WINDOWS\pchealth\helpctr\binaries\HelpHost.com system.exe File created C:\WINDOWS\system\KEYBOARD.exe system.exe File opened for modification C:\WINDOWS\Cursors\Boom.vbs system.exe File created C:\WINDOWS\Media\rndll32.pif 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe File created C:\WINDOWS\Media\rndll32.pif svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Control Panel 16 IoCs
Processes:
svchost.exesystem.exe68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exeGlobal.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpHost.com" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Control Panel\Desktop\AutoEndTasks = "1" system.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Control Panel\Desktop 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Control Panel\Desktop\AutoEndTasks = "1" 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Control Panel\Desktop svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Control Panel\Desktop\ScreenSaveTimeOut = "30" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpHost.com" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Control Panel\Desktop\ScreenSaveTimeOut = "30" 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Control Panel\Desktop Global.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Control Panel\Desktop\ScreenSaveTimeOut = "30" Global.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Control Panel\Desktop system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Control Panel\Desktop\ScreenSaveTimeOut = "30" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpHost.com" 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpHost.com" Global.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Control Panel\Desktop\AutoEndTasks = "1" Global.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Control Panel\Desktop\AutoEndTasks = "1" svchost.exe -
Modifies registry class 44 IoCs
Processes:
Global.exe68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exesystem.exesvchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command\ = "C:\\WINDOWS\\pchealth\\Global.exe" Global.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mscfile\shell\open\command\ = "C:\\WINDOWS\\pchealth\\Global.exe" Global.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" Global.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command\ = "C:\\WINDOWS\\pchealth\\Global.exe" system.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mscfile\shell\open\command\ = "C:\\WINDOWS\\Fonts\\Fonts.exe" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "VBSFile" Global.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mscfile\shell\open\command\ = "C:\\WINDOWS\\Fonts\\Fonts.exe" Global.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile Global.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSCFile\Shell\Open\Command svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mscfile\shell\open\command\ = "C:\\WINDOWS\\pchealth\\Global.exe" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "VBSFile" system.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSCFile\Shell\Open\Command 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\Shell\Open\Command 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs Global.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\NeverShowExt = "1" Global.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command\ = "C:\\WINDOWS\\pchealth\\Global.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" system.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "VBSFile" 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mscfile\shell\open\command\ = "C:\\WINDOWS\\Fonts\\Fonts.exe" 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\NeverShowExt = "1" 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\NeverShowExt = "1" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mscfile\shell\open\command\ = "C:\\WINDOWS\\pchealth\\Global.exe" 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\Shell\Open\Command Global.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "VBSFile" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSCFile\Shell\Open\Command system.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\Shell\Open\Command system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command\ = "C:\\WINDOWS\\pchealth\\Global.exe" 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\Shell\Open\Command svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mscfile\shell\open\command\ = "C:\\WINDOWS\\pchealth\\Global.exe" system.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSCFile\Shell\Open\Command Global.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile Global.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mscfile\shell\open\command\ = "C:\\WINDOWS\\Fonts\\Fonts.exe" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\NeverShowExt = "1" system.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exesvchost.exepid process 1080 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe 2908 svchost.exe 2908 svchost.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes:
68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exesvchost.exedescription pid process Token: SeDebugPrivilege 1080 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Token: SeDebugPrivilege 1080 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Token: SeDebugPrivilege 1080 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Token: SeDebugPrivilege 1080 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Token: SeDebugPrivilege 1080 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Token: SeDebugPrivilege 1080 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Token: SeDebugPrivilege 1080 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Token: SeDebugPrivilege 1080 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Token: SeDebugPrivilege 1080 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Token: SeDebugPrivilege 1080 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Token: SeDebugPrivilege 1080 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Token: SeDebugPrivilege 1080 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Token: SeDebugPrivilege 1080 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Token: SeDebugPrivilege 1080 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Token: SeDebugPrivilege 1080 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Token: SeDebugPrivilege 1080 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Token: SeDebugPrivilege 1080 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Token: SeDebugPrivilege 1080 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Token: SeDebugPrivilege 1080 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Token: SeDebugPrivilege 1080 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Token: SeDebugPrivilege 2908 svchost.exe Token: SeDebugPrivilege 2908 svchost.exe Token: SeDebugPrivilege 2908 svchost.exe Token: SeDebugPrivilege 2908 svchost.exe Token: SeDebugPrivilege 2908 svchost.exe Token: SeDebugPrivilege 2908 svchost.exe Token: SeDebugPrivilege 2908 svchost.exe Token: SeDebugPrivilege 2908 svchost.exe Token: SeDebugPrivilege 2908 svchost.exe Token: SeDebugPrivilege 2908 svchost.exe Token: SeDebugPrivilege 2908 svchost.exe Token: SeDebugPrivilege 2908 svchost.exe Token: SeDebugPrivilege 2908 svchost.exe Token: SeDebugPrivilege 2908 svchost.exe Token: SeDebugPrivilege 2908 svchost.exe Token: SeDebugPrivilege 2908 svchost.exe Token: SeDebugPrivilege 2908 svchost.exe Token: SeDebugPrivilege 2908 svchost.exe Token: SeDebugPrivilege 2908 svchost.exe Token: SeDebugPrivilege 2908 svchost.exe Token: SeDebugPrivilege 2908 svchost.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exeGlobal.exesvchost.exesystem.exepid process 1080 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe 760 Global.exe 2908 svchost.exe 832 system.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exeGlobal.exesvchost.exedescription pid process target process PID 1080 wrote to memory of 1232 1080 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe taskhost.exe PID 1080 wrote to memory of 1316 1080 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Dwm.exe PID 1080 wrote to memory of 1364 1080 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Explorer.EXE PID 1080 wrote to memory of 1256 1080 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe DllHost.exe PID 1080 wrote to memory of 760 1080 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Global.exe PID 1080 wrote to memory of 760 1080 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Global.exe PID 1080 wrote to memory of 760 1080 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Global.exe PID 1080 wrote to memory of 760 1080 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Global.exe PID 760 wrote to memory of 2908 760 Global.exe svchost.exe PID 760 wrote to memory of 2908 760 Global.exe svchost.exe PID 760 wrote to memory of 2908 760 Global.exe svchost.exe PID 760 wrote to memory of 2908 760 Global.exe svchost.exe PID 2908 wrote to memory of 1232 2908 svchost.exe taskhost.exe PID 2908 wrote to memory of 1316 2908 svchost.exe Dwm.exe PID 2908 wrote to memory of 1364 2908 svchost.exe Explorer.EXE PID 2908 wrote to memory of 760 2908 svchost.exe Global.exe PID 2908 wrote to memory of 760 2908 svchost.exe Global.exe PID 2908 wrote to memory of 832 2908 svchost.exe system.exe PID 2908 wrote to memory of 832 2908 svchost.exe system.exe PID 2908 wrote to memory of 832 2908 svchost.exe system.exe PID 2908 wrote to memory of 832 2908 svchost.exe system.exe PID 2908 wrote to memory of 1232 2908 svchost.exe taskhost.exe PID 2908 wrote to memory of 1316 2908 svchost.exe Dwm.exe PID 2908 wrote to memory of 1364 2908 svchost.exe Explorer.EXE PID 2908 wrote to memory of 832 2908 svchost.exe system.exe PID 2908 wrote to memory of 832 2908 svchost.exe system.exe -
System policy modification 1 TTPs 10 IoCs
Processes:
system.exe68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exeGlobal.exesvchost.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System system.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableStatusMessages = "1" 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Global.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableStatusMessages = "1" Global.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableStatusMessages = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableStatusMessages = "1" system.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\68242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5_NeikiAnalytics.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Adds policy Run key to start application
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Loads dropped DLL
- Modifies system executable filetype association
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\WINDOWS\SysWOW64\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\Global.exe"C:\WINDOWS\system32\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\Global.exe"3⤵
- Adds policy Run key to start application
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\WINDOWS\SysWOW64\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\svchost.exe"C:\WINDOWS\system32\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\svchost.exe"4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Adds policy Run key to start application
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\WINDOWS\SysWOW64\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe"C:\WINDOWS\system32\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe"5⤵
- Adds policy Run key to start application
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Defense Evasion
Modify Registry
8Impair Defenses
4Disable or Modify Tools
3Disable or Modify System Firewall
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\WINDOWS\Cursors\Boom.vbsFilesize
4KB
MD5e72c9789ac7232e3b36766eb2a8f8da6
SHA1a37a9f18e227d103bb4e1ecac0834c2cdf99d112
SHA2567b03603cbc56105470b4bfb250d0ef18fa93126475e2872d63dc52c35866d2a9
SHA512666a2592c5303a1f42a8bbddc2a8e5d3289c612be7401e3530a3afd70d8243276645bad00a82f3254674307583dabae49c16204e790200a34b0707813265f6d0
-
C:\WINDOWS\SysWOW64\dllcache\autorun.infFilesize
118B
MD54eb846be89a1520b7d0181f0736f9a96
SHA1869a156f9bd21b06d896cafa66db628f7b5e9679
SHA2565bf2d22daa1c82872df820f2e5d12fdc60e131f20782cc5e566a04343bfdf6d8
SHA512ee444365384528857a68672a0b1ae1a3b62f7a4b05038d894bc33f603291defdc03a2a3a2849054aa13f4f2def783fdce8f88a5896fd64f11a3f7c9b19c4008c
-
C:\Windows\Fonts\Fonts.exeFilesize
300KB
MD5918cc69d4af1ba0482b6c9a6067d63f0
SHA11259810f0b0d36c3fde05240498270ac33f639ba
SHA25668242865c6bee25eac8a6a559039b8cef5bd048647ad8ba5dc076f1719a595d5
SHA51208bffa536dc410e6841f785fffe46a33a9c92207d827f3a33a6bbf2e9edb9a0e67b9a6e243e00efc58801503ceebfda7138513e6460c2e8d141c51171c67becd
-
C:\Windows\SYSTEM.INIFilesize
257B
MD51820322f780f1b6db010981044dfa41e
SHA111de7dfc3278fe070443992d9c8d422467bbea66
SHA25674d4a6d1981bd831ff7f73e81e1229f5b87bb4f2c8c5b8fe6eb9e8ae1fa18d80
SHA512fcad95e785ea3412d5943f7c7260e53bbf122b06fcc640e38aef47f86ed167d5c93611217e34a9b37a54d54db62777c96e460392bb938e841b68b019eaaee46d
-
memory/760-173-0x0000000003DD0000-0x0000000003DD1000-memory.dmpFilesize
4KB
-
memory/760-134-0x0000000003D80000-0x0000000003DC9000-memory.dmpFilesize
292KB
-
memory/1080-26-0x0000000003920000-0x0000000003921000-memory.dmpFilesize
4KB
-
memory/1080-77-0x0000000006D70000-0x0000000006DB9000-memory.dmpFilesize
292KB
-
memory/1080-27-0x0000000003900000-0x0000000003902000-memory.dmpFilesize
8KB
-
memory/1080-0-0x0000000000400000-0x0000000000449000-memory.dmpFilesize
292KB
-
memory/1080-24-0x0000000003920000-0x0000000003921000-memory.dmpFilesize
4KB
-
memory/1080-23-0x0000000003900000-0x0000000003902000-memory.dmpFilesize
8KB
-
memory/1080-9-0x00000000026B0000-0x000000000376A000-memory.dmpFilesize
16.7MB
-
memory/1080-14-0x00000000026B0000-0x000000000376A000-memory.dmpFilesize
16.7MB
-
memory/1080-5-0x00000000026B0000-0x000000000376A000-memory.dmpFilesize
16.7MB
-
memory/1080-12-0x00000000026B0000-0x000000000376A000-memory.dmpFilesize
16.7MB
-
memory/1080-35-0x00000000026B0000-0x000000000376A000-memory.dmpFilesize
16.7MB
-
memory/1080-13-0x00000000026B0000-0x000000000376A000-memory.dmpFilesize
16.7MB
-
memory/1080-34-0x00000000026B0000-0x000000000376A000-memory.dmpFilesize
16.7MB
-
memory/1080-36-0x00000000026B0000-0x000000000376A000-memory.dmpFilesize
16.7MB
-
memory/1080-11-0x00000000026B0000-0x000000000376A000-memory.dmpFilesize
16.7MB
-
memory/1080-28-0x0000000003900000-0x0000000003902000-memory.dmpFilesize
8KB
-
memory/1080-76-0x0000000006D70000-0x0000000006DB9000-memory.dmpFilesize
292KB
-
memory/1080-7-0x00000000026B0000-0x000000000376A000-memory.dmpFilesize
16.7MB
-
memory/1080-116-0x0000000003900000-0x0000000003902000-memory.dmpFilesize
8KB
-
memory/1080-129-0x0000000000400000-0x0000000000449000-memory.dmpFilesize
292KB
-
memory/1080-130-0x00000000026B0000-0x000000000376A000-memory.dmpFilesize
16.7MB
-
memory/1080-10-0x00000000026B0000-0x000000000376A000-memory.dmpFilesize
16.7MB
-
memory/1080-6-0x00000000026B0000-0x000000000376A000-memory.dmpFilesize
16.7MB
-
memory/1080-8-0x00000000026B0000-0x000000000376A000-memory.dmpFilesize
16.7MB
-
memory/1232-15-0x00000000020F0000-0x00000000020F2000-memory.dmpFilesize
8KB
-
memory/2908-143-0x0000000000400000-0x0000000000449000-memory.dmpFilesize
292KB
-
memory/2908-158-0x0000000002590000-0x000000000364A000-memory.dmpFilesize
16.7MB
-
memory/2908-148-0x0000000002590000-0x000000000364A000-memory.dmpFilesize
16.7MB
-
memory/2908-179-0x0000000000520000-0x0000000000521000-memory.dmpFilesize
4KB
-
memory/2908-152-0x0000000002590000-0x000000000364A000-memory.dmpFilesize
16.7MB
-
memory/2908-159-0x0000000002590000-0x000000000364A000-memory.dmpFilesize
16.7MB
-
memory/2908-161-0x0000000002590000-0x000000000364A000-memory.dmpFilesize
16.7MB