Overview
overview
10Static
static
37ad39bfaf9...cs.exe
windows7-x64
107ad39bfaf9...cs.exe
windows10-2004-x64
10$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows7-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3Delphi.NET...Acc.js
windows7-x64
3Delphi.NET...Acc.js
windows10-2004-x64
3Delphi.NET...Acc.js
windows7-x64
3Delphi.NET...Acc.js
windows10-2004-x64
3Delphi.NET...Acc.js
windows7-x64
3Delphi.NET...Acc.js
windows10-2004-x64
3Delphi.NET...Acc.js
windows7-x64
3Delphi.NET...Acc.js
windows10-2004-x64
3MemAcc.vbs
windows7-x64
1MemAcc.vbs
windows10-2004-x64
1MemAcc.chm
windows7-x64
1MemAcc.chm
windows10-2004-x64
1MemAcc.js
windows7-x64
3MemAcc.js
windows10-2004-x64
3MemAcc.pdf
windows7-x64
1MemAcc.pdf
windows10-2004-x64
1MemAcc.vbs
windows7-x64
1MemAcc.vbs
windows10-2004-x64
1Redist/MemAcc.sys
windows7-x64
1Redist/MemAcc.sys
windows10-2004-x64
1VB.NET/BIO...cc.vbs
windows7-x64
1VB.NET/BIO...cc.vbs
windows10-2004-x64
1Analysis
-
max time kernel
134s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29-06-2024 06:52
Behavioral task
behavioral1
Sample
7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240419-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
Delphi.NET/BIOSData/Zeal.MemAcc.js
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
Delphi.NET/BIOSData/Zeal.MemAcc.js
Resource
win10v2004-20240611-en
Behavioral task
behavioral13
Sample
Delphi.NET/Map/Zeal.MemAcc.js
Resource
win7-20240611-en
Behavioral task
behavioral14
Sample
Delphi.NET/Map/Zeal.MemAcc.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
Delphi.NET/MemTest/Zeal.MemAcc.js
Resource
win7-20240611-en
Behavioral task
behavioral16
Sample
Delphi.NET/MemTest/Zeal.MemAcc.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
Delphi.NET/PCI/Zeal.MemAcc.js
Resource
win7-20240220-en
Behavioral task
behavioral18
Sample
Delphi.NET/PCI/Zeal.MemAcc.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
MemAcc.vbs
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
MemAcc.vbs
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
MemAcc.chm
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
MemAcc.chm
Resource
win10v2004-20240611-en
Behavioral task
behavioral23
Sample
MemAcc.js
Resource
win7-20231129-en
Behavioral task
behavioral24
Sample
MemAcc.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
MemAcc.pdf
Resource
win7-20240419-en
Behavioral task
behavioral26
Sample
MemAcc.pdf
Resource
win10v2004-20240611-en
Behavioral task
behavioral27
Sample
MemAcc.vbs
Resource
win7-20240611-en
Behavioral task
behavioral28
Sample
MemAcc.vbs
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
Redist/MemAcc.sys
Resource
win7-20240611-en
Behavioral task
behavioral30
Sample
Redist/MemAcc.sys
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
VB.NET/BIOSData/MemAcc.vbs
Resource
win7-20231129-en
Behavioral task
behavioral32
Sample
VB.NET/BIOSData/MemAcc.vbs
Resource
win10v2004-20240508-en
General
-
Target
7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe
-
Size
733KB
-
MD5
0a1ad78b7445d452a8b9e30cc96f3e20
-
SHA1
0fb048733f46346a769a32a367e1d9341856899c
-
SHA256
7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d
-
SHA512
991be91a3a4eb44d31bc6f6cf638ee29aee42e8ea470b5ce546e63689f8cf874c377850239986b8f575ce947704028a6e2855c68c5726d8ccf9b7e5b974ffd08
-
SSDEEP
12288:baxvpA0aa6nJ6Jl3+4tdqoeBcVgaOZi85uGgGn47nX6SoJb0CbPcgIsHwrdU68qO:baQBnJgl3+42BcVtOZiDPG6KSm4CrcX8
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
Processes:
7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe -
Processes:
7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe -
Processes:
7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
Processes:
msedge.exepid process 2052 msedge.exe -
Loads dropped DLL 3 IoCs
Processes:
7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exepid process 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe -
Processes:
resource yara_rule behavioral2/memory/648-1-0x00000000023E0000-0x000000000349A000-memory.dmp upx behavioral2/memory/648-7-0x00000000023E0000-0x000000000349A000-memory.dmp upx behavioral2/memory/648-5-0x00000000023E0000-0x000000000349A000-memory.dmp upx behavioral2/memory/648-8-0x00000000023E0000-0x000000000349A000-memory.dmp upx behavioral2/memory/648-11-0x00000000023E0000-0x000000000349A000-memory.dmp upx behavioral2/memory/648-9-0x00000000023E0000-0x000000000349A000-memory.dmp upx behavioral2/memory/648-10-0x00000000023E0000-0x000000000349A000-memory.dmp upx behavioral2/memory/648-4-0x00000000023E0000-0x000000000349A000-memory.dmp upx behavioral2/memory/648-6-0x00000000023E0000-0x000000000349A000-memory.dmp upx behavioral2/memory/648-3-0x00000000023E0000-0x000000000349A000-memory.dmp upx behavioral2/memory/648-33-0x00000000023E0000-0x000000000349A000-memory.dmp upx behavioral2/memory/648-25-0x00000000023E0000-0x000000000349A000-memory.dmp upx behavioral2/memory/648-38-0x00000000023E0000-0x000000000349A000-memory.dmp upx behavioral2/memory/648-111-0x00000000023E0000-0x000000000349A000-memory.dmp upx behavioral2/memory/648-112-0x00000000023E0000-0x000000000349A000-memory.dmp upx behavioral2/memory/648-114-0x00000000023E0000-0x000000000349A000-memory.dmp upx behavioral2/memory/648-115-0x00000000023E0000-0x000000000349A000-memory.dmp upx behavioral2/memory/648-116-0x00000000023E0000-0x000000000349A000-memory.dmp upx behavioral2/memory/648-118-0x00000000023E0000-0x000000000349A000-memory.dmp upx behavioral2/memory/648-119-0x00000000023E0000-0x000000000349A000-memory.dmp upx behavioral2/memory/648-122-0x00000000023E0000-0x000000000349A000-memory.dmp upx behavioral2/memory/648-123-0x00000000023E0000-0x000000000349A000-memory.dmp upx behavioral2/memory/648-125-0x00000000023E0000-0x000000000349A000-memory.dmp upx behavioral2/memory/648-129-0x00000000023E0000-0x000000000349A000-memory.dmp upx behavioral2/memory/648-130-0x00000000023E0000-0x000000000349A000-memory.dmp upx behavioral2/memory/648-132-0x00000000023E0000-0x000000000349A000-memory.dmp upx behavioral2/memory/648-138-0x00000000023E0000-0x000000000349A000-memory.dmp upx behavioral2/memory/648-139-0x00000000023E0000-0x000000000349A000-memory.dmp upx behavioral2/memory/648-141-0x00000000023E0000-0x000000000349A000-memory.dmp upx behavioral2/memory/648-142-0x00000000023E0000-0x000000000349A000-memory.dmp upx behavioral2/memory/648-144-0x00000000023E0000-0x000000000349A000-memory.dmp upx behavioral2/memory/648-146-0x00000000023E0000-0x000000000349A000-memory.dmp upx behavioral2/memory/648-147-0x00000000023E0000-0x000000000349A000-memory.dmp upx behavioral2/memory/648-148-0x00000000023E0000-0x000000000349A000-memory.dmp upx behavioral2/memory/648-149-0x00000000023E0000-0x000000000349A000-memory.dmp upx behavioral2/memory/648-151-0x00000000023E0000-0x000000000349A000-memory.dmp upx behavioral2/memory/648-153-0x00000000023E0000-0x000000000349A000-memory.dmp upx behavioral2/memory/648-155-0x00000000023E0000-0x000000000349A000-memory.dmp upx behavioral2/memory/648-157-0x00000000023E0000-0x000000000349A000-memory.dmp upx behavioral2/memory/648-159-0x00000000023E0000-0x000000000349A000-memory.dmp upx behavioral2/memory/648-161-0x00000000023E0000-0x000000000349A000-memory.dmp upx behavioral2/memory/648-175-0x00000000023E0000-0x000000000349A000-memory.dmp upx -
Processes:
7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe -
Processes:
7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe -
Enumerates connected drives 3 TTPs 20 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exedescription ioc process File opened (read-only) \??\G: 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe File opened (read-only) \??\L: 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe File opened (read-only) \??\O: 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe File opened (read-only) \??\Q: 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe File opened (read-only) \??\M: 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe File opened (read-only) \??\N: 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe File opened (read-only) \??\R: 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe File opened (read-only) \??\W: 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe File opened (read-only) \??\Y: 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe File opened (read-only) \??\V: 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe File opened (read-only) \??\E: 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe File opened (read-only) \??\H: 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe File opened (read-only) \??\I: 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe File opened (read-only) \??\J: 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe File opened (read-only) \??\P: 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe File opened (read-only) \??\S: 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe File opened (read-only) \??\T: 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe File opened (read-only) \??\U: 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe File opened (read-only) \??\X: 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe File opened (read-only) \??\Z: 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exedescription ioc process File opened for modification C:\autorun.inf 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe File opened for modification F:\autorun.inf 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe -
Drops file in Program Files directory 12 IoCs
Processes:
7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\7z.exe 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe -
Drops file in Windows directory 2 IoCs
Processes:
7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exedescription ioc process File created C:\Windows\e57fb09 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe File opened for modification C:\Windows\SYSTEM.INI 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exepid process 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exedescription pid process Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Token: SeDebugPrivilege 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exedescription pid process target process PID 648 wrote to memory of 780 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe fontdrvhost.exe PID 648 wrote to memory of 788 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe fontdrvhost.exe PID 648 wrote to memory of 316 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe dwm.exe PID 648 wrote to memory of 2416 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe sihost.exe PID 648 wrote to memory of 2448 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe svchost.exe PID 648 wrote to memory of 2524 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe taskhostw.exe PID 648 wrote to memory of 3240 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Explorer.EXE PID 648 wrote to memory of 3484 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe svchost.exe PID 648 wrote to memory of 3740 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe DllHost.exe PID 648 wrote to memory of 3840 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe StartMenuExperienceHost.exe PID 648 wrote to memory of 3944 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe RuntimeBroker.exe PID 648 wrote to memory of 4048 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe SearchApp.exe PID 648 wrote to memory of 3544 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe RuntimeBroker.exe PID 648 wrote to memory of 464 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe RuntimeBroker.exe PID 648 wrote to memory of 4440 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe TextInputHost.exe PID 648 wrote to memory of 4392 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe msedge.exe PID 648 wrote to memory of 448 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe msedge.exe PID 648 wrote to memory of 4028 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe msedge.exe PID 648 wrote to memory of 1912 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe msedge.exe PID 648 wrote to memory of 3512 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe msedge.exe PID 648 wrote to memory of 1644 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe msedge.exe PID 648 wrote to memory of 1336 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe msedge.exe PID 648 wrote to memory of 780 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe fontdrvhost.exe PID 648 wrote to memory of 788 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe fontdrvhost.exe PID 648 wrote to memory of 316 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe dwm.exe PID 648 wrote to memory of 2416 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe sihost.exe PID 648 wrote to memory of 2448 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe svchost.exe PID 648 wrote to memory of 2524 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe taskhostw.exe PID 648 wrote to memory of 3240 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Explorer.EXE PID 648 wrote to memory of 3484 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe svchost.exe PID 648 wrote to memory of 3740 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe DllHost.exe PID 648 wrote to memory of 3840 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe StartMenuExperienceHost.exe PID 648 wrote to memory of 3944 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe RuntimeBroker.exe PID 648 wrote to memory of 4048 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe SearchApp.exe PID 648 wrote to memory of 3544 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe RuntimeBroker.exe PID 648 wrote to memory of 464 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe RuntimeBroker.exe PID 648 wrote to memory of 4440 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe TextInputHost.exe PID 648 wrote to memory of 4392 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe msedge.exe PID 648 wrote to memory of 448 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe msedge.exe PID 648 wrote to memory of 4028 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe msedge.exe PID 648 wrote to memory of 1912 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe msedge.exe PID 648 wrote to memory of 3512 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe msedge.exe PID 648 wrote to memory of 1644 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe msedge.exe PID 648 wrote to memory of 1336 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe msedge.exe PID 648 wrote to memory of 780 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe fontdrvhost.exe PID 648 wrote to memory of 788 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe fontdrvhost.exe PID 648 wrote to memory of 316 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe dwm.exe PID 648 wrote to memory of 2416 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe sihost.exe PID 648 wrote to memory of 2448 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe svchost.exe PID 648 wrote to memory of 2524 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe taskhostw.exe PID 648 wrote to memory of 3240 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe Explorer.EXE PID 648 wrote to memory of 3484 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe svchost.exe PID 648 wrote to memory of 3740 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe DllHost.exe PID 648 wrote to memory of 3840 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe StartMenuExperienceHost.exe PID 648 wrote to memory of 3944 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe RuntimeBroker.exe PID 648 wrote to memory of 4048 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe SearchApp.exe PID 648 wrote to memory of 3544 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe RuntimeBroker.exe PID 648 wrote to memory of 464 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe RuntimeBroker.exe PID 648 wrote to memory of 4440 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe TextInputHost.exe PID 648 wrote to memory of 4392 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe msedge.exe PID 648 wrote to memory of 448 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe msedge.exe PID 648 wrote to memory of 4028 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe msedge.exe PID 648 wrote to memory of 1912 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe msedge.exe PID 648 wrote to memory of 3512 648 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe msedge.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d_NeikiAnalytics.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x2bc,0x7ff9e2402e98,0x7ff9e2402ea4,0x7ff9e2402eb02⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1924 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3156 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:32⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3176 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5400 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=5584 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4124 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:82⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Impair Defenses
4Disable or Modify Tools
3Disable or Modify System Firewall
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeFilesize
3.9MB
MD5faf79a48399d502194e87a5ad1ba7b8e
SHA109cd9d783ac126d33ec37de781beedce9ce6aa51
SHA2563d1266025af95bdb7b92d17debbf88a1386b19b7f7c2eeb9ced77debb9748e14
SHA512d84f8e25179e2cee6f95dc95c94a4a70dc56814aaf7f95e38f24f9828e64629cab0c184f5fddd67d834f419703f65d9d0e3a93e54d2730ed63d3d89644babb84
-
C:\Users\Admin\AppData\Local\Temp\nsd1E0.tmp\InstallOptions.dllFilesize
12KB
MD5d61d6c709e7947296603059f8bedeba9
SHA1bdcfc90c358c82be43ef85727a7bdfebbd6d1b69
SHA25665012a46603b7e13807938e2a61f3c2a60cced3fb3187dfab3e391705e2c3f63
SHA512ed5a6efd1dd5e2119a9c523b9f9154e13552b3538bf72f4b8b02d6a9c808c3ae2ba7613d9e2b3395237461703f2da0a1482a52727ffcf6fc967552390dab0f2b
-
C:\Users\Admin\AppData\Local\Temp\nsd1E0.tmp\UserInfo.dllFilesize
4KB
MD58313b80c993dbf27b4b50d0a718f0913
SHA1810972ca1b6587dbaf88192874bb9441db296429
SHA25688829c8846c7059e499a15cb5abcddfcab63b56c19510d7a4cc418a4d9d742ba
SHA512a53eda5f749102fa4ab1e8e916ad6fcc3e5563f28632f7b771413cdc6b3ec31d2d898ab3802ab047a8d8af5ebac445194a78ec38e7d20479e0f36cf8e81bb0df
-
C:\Users\Admin\AppData\Local\Temp\nsd1E0.tmp\ioSpecial.iniFilesize
770B
MD5a7674d56ee967785b54204566cb2bb46
SHA15e6d18a89740c8c2f16a3ff43c6587d9e1d7e0ca
SHA2561f9f608e9ef89e64dd3c716130612d476c2c2501043b31c88c6a65df7ffbe1f3
SHA5121a4b748b83af4cd021cc7569b0f7c56c12431ce9492134f8bdfe1bf7c0fba3ac758eb0459eb8d330fad8d9074d2923fe64a7c976b95d35d8dc148ad98123f72b
-
C:\eddqbm.exeFilesize
97KB
MD54d37ea793b3e3dc31e02d015550b7867
SHA128827c077c9caeaa2120e62a246454e9b3e891d4
SHA2564640a254344210bc9b589b72f57210bfda17d4b41becd2abb0677d8ee44686af
SHA512ba142c345bcf317535413e509f24c6d0f5e688069ea0c84df6e631aba68e70c37bc856e07006ef69ed48e2fc42e668604c95fec50b06479cb8e53078ec6b594b
-
memory/648-115-0x00000000023E0000-0x000000000349A000-memory.dmpFilesize
16.7MB
-
memory/648-155-0x00000000023E0000-0x000000000349A000-memory.dmpFilesize
16.7MB
-
memory/648-7-0x00000000023E0000-0x000000000349A000-memory.dmpFilesize
16.7MB
-
memory/648-5-0x00000000023E0000-0x000000000349A000-memory.dmpFilesize
16.7MB
-
memory/648-8-0x00000000023E0000-0x000000000349A000-memory.dmpFilesize
16.7MB
-
memory/648-11-0x00000000023E0000-0x000000000349A000-memory.dmpFilesize
16.7MB
-
memory/648-9-0x00000000023E0000-0x000000000349A000-memory.dmpFilesize
16.7MB
-
memory/648-10-0x00000000023E0000-0x000000000349A000-memory.dmpFilesize
16.7MB
-
memory/648-4-0x00000000023E0000-0x000000000349A000-memory.dmpFilesize
16.7MB
-
memory/648-19-0x00000000022B0000-0x00000000022B2000-memory.dmpFilesize
8KB
-
memory/648-18-0x00000000022C0000-0x00000000022C1000-memory.dmpFilesize
4KB
-
memory/648-17-0x00000000022B0000-0x00000000022B2000-memory.dmpFilesize
8KB
-
memory/648-6-0x00000000023E0000-0x000000000349A000-memory.dmpFilesize
16.7MB
-
memory/648-3-0x00000000023E0000-0x000000000349A000-memory.dmpFilesize
16.7MB
-
memory/648-116-0x00000000023E0000-0x000000000349A000-memory.dmpFilesize
16.7MB
-
memory/648-33-0x00000000023E0000-0x000000000349A000-memory.dmpFilesize
16.7MB
-
memory/648-25-0x00000000023E0000-0x000000000349A000-memory.dmpFilesize
16.7MB
-
memory/648-38-0x00000000023E0000-0x000000000349A000-memory.dmpFilesize
16.7MB
-
memory/648-111-0x00000000023E0000-0x000000000349A000-memory.dmpFilesize
16.7MB
-
memory/648-112-0x00000000023E0000-0x000000000349A000-memory.dmpFilesize
16.7MB
-
memory/648-114-0x00000000023E0000-0x000000000349A000-memory.dmpFilesize
16.7MB
-
memory/648-0-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/648-20-0x00000000022B0000-0x00000000022B2000-memory.dmpFilesize
8KB
-
memory/648-1-0x00000000023E0000-0x000000000349A000-memory.dmpFilesize
16.7MB
-
memory/648-139-0x00000000023E0000-0x000000000349A000-memory.dmpFilesize
16.7MB
-
memory/648-122-0x00000000023E0000-0x000000000349A000-memory.dmpFilesize
16.7MB
-
memory/648-123-0x00000000023E0000-0x000000000349A000-memory.dmpFilesize
16.7MB
-
memory/648-125-0x00000000023E0000-0x000000000349A000-memory.dmpFilesize
16.7MB
-
memory/648-129-0x00000000023E0000-0x000000000349A000-memory.dmpFilesize
16.7MB
-
memory/648-130-0x00000000023E0000-0x000000000349A000-memory.dmpFilesize
16.7MB
-
memory/648-132-0x00000000023E0000-0x000000000349A000-memory.dmpFilesize
16.7MB
-
memory/648-138-0x00000000023E0000-0x000000000349A000-memory.dmpFilesize
16.7MB
-
memory/648-119-0x00000000023E0000-0x000000000349A000-memory.dmpFilesize
16.7MB
-
memory/648-141-0x00000000023E0000-0x000000000349A000-memory.dmpFilesize
16.7MB
-
memory/648-142-0x00000000023E0000-0x000000000349A000-memory.dmpFilesize
16.7MB
-
memory/648-144-0x00000000023E0000-0x000000000349A000-memory.dmpFilesize
16.7MB
-
memory/648-146-0x00000000023E0000-0x000000000349A000-memory.dmpFilesize
16.7MB
-
memory/648-147-0x00000000023E0000-0x000000000349A000-memory.dmpFilesize
16.7MB
-
memory/648-148-0x00000000023E0000-0x000000000349A000-memory.dmpFilesize
16.7MB
-
memory/648-149-0x00000000023E0000-0x000000000349A000-memory.dmpFilesize
16.7MB
-
memory/648-151-0x00000000023E0000-0x000000000349A000-memory.dmpFilesize
16.7MB
-
memory/648-153-0x00000000023E0000-0x000000000349A000-memory.dmpFilesize
16.7MB
-
memory/648-118-0x00000000023E0000-0x000000000349A000-memory.dmpFilesize
16.7MB
-
memory/648-157-0x00000000023E0000-0x000000000349A000-memory.dmpFilesize
16.7MB
-
memory/648-159-0x00000000023E0000-0x000000000349A000-memory.dmpFilesize
16.7MB
-
memory/648-161-0x00000000023E0000-0x000000000349A000-memory.dmpFilesize
16.7MB
-
memory/648-175-0x00000000023E0000-0x000000000349A000-memory.dmpFilesize
16.7MB
-
memory/648-176-0x00000000022B0000-0x00000000022B2000-memory.dmpFilesize
8KB