Analysis
-
max time kernel
122s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
29-06-2024 10:42
Static task
static1
Behavioral task
behavioral1
Sample
a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe
Resource
win7-20240611-en
General
-
Target
a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe
-
Size
4.3MB
-
MD5
d4d07631aa9bbf8c0e2faec8b030e060
-
SHA1
ba9aebaeb1af97210988b896e317bed2405fc5a5
-
SHA256
a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068
-
SHA512
6380a43a4006e7e3cca530a1925bb5919d2776e38fa50362d20eef5ed16af31ce381f4ad2e651f6bd53378bcd8c74a0c2c1848b142e3a727b3c91eb822eefb3e
-
SSDEEP
6144:gTv+GxxjGVW/dlNMO4atTBpWGBICUWv72eBrrNF:O+U5g+dGatTzpTfb
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
Processes:
a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe -
Processes:
a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe -
Processes:
a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe -
Processes:
resource yara_rule behavioral1/memory/288-1-0x0000000000650000-0x00000000016DE000-memory.dmp upx behavioral1/memory/288-5-0x0000000000650000-0x00000000016DE000-memory.dmp upx behavioral1/memory/288-9-0x0000000000650000-0x00000000016DE000-memory.dmp upx behavioral1/memory/288-7-0x0000000000650000-0x00000000016DE000-memory.dmp upx behavioral1/memory/288-11-0x0000000000650000-0x00000000016DE000-memory.dmp upx behavioral1/memory/288-12-0x0000000000650000-0x00000000016DE000-memory.dmp upx behavioral1/memory/288-10-0x0000000000650000-0x00000000016DE000-memory.dmp upx behavioral1/memory/288-8-0x0000000000650000-0x00000000016DE000-memory.dmp upx behavioral1/memory/288-13-0x0000000000650000-0x00000000016DE000-memory.dmp upx behavioral1/memory/288-14-0x0000000000650000-0x00000000016DE000-memory.dmp upx behavioral1/memory/288-15-0x0000000000650000-0x00000000016DE000-memory.dmp upx behavioral1/memory/288-30-0x0000000000650000-0x00000000016DE000-memory.dmp upx behavioral1/memory/288-31-0x0000000000650000-0x00000000016DE000-memory.dmp upx behavioral1/memory/288-32-0x0000000000650000-0x00000000016DE000-memory.dmp upx behavioral1/memory/288-34-0x0000000000650000-0x00000000016DE000-memory.dmp upx behavioral1/memory/288-35-0x0000000000650000-0x00000000016DE000-memory.dmp upx behavioral1/memory/288-36-0x0000000000650000-0x00000000016DE000-memory.dmp upx behavioral1/memory/288-38-0x0000000000650000-0x00000000016DE000-memory.dmp upx behavioral1/memory/288-40-0x0000000000650000-0x00000000016DE000-memory.dmp upx behavioral1/memory/288-42-0x0000000000650000-0x00000000016DE000-memory.dmp upx behavioral1/memory/288-43-0x0000000000650000-0x00000000016DE000-memory.dmp upx behavioral1/memory/288-50-0x0000000000650000-0x00000000016DE000-memory.dmp upx behavioral1/memory/288-51-0x0000000000650000-0x00000000016DE000-memory.dmp upx behavioral1/memory/288-52-0x0000000000650000-0x00000000016DE000-memory.dmp upx behavioral1/memory/288-54-0x0000000000650000-0x00000000016DE000-memory.dmp upx behavioral1/memory/288-57-0x0000000000650000-0x00000000016DE000-memory.dmp upx behavioral1/memory/288-58-0x0000000000650000-0x00000000016DE000-memory.dmp upx behavioral1/memory/288-59-0x0000000000650000-0x00000000016DE000-memory.dmp upx behavioral1/memory/288-67-0x0000000000650000-0x00000000016DE000-memory.dmp upx behavioral1/memory/288-69-0x0000000000650000-0x00000000016DE000-memory.dmp upx behavioral1/memory/288-72-0x0000000000650000-0x00000000016DE000-memory.dmp upx behavioral1/memory/288-74-0x0000000000650000-0x00000000016DE000-memory.dmp upx -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 107.178.223.183 -
Processes:
a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe -
Processes:
a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exedescription ioc process File opened (read-only) \??\G: a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe File opened (read-only) \??\S: a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe File opened (read-only) \??\H: a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe File opened (read-only) \??\I: a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe File opened (read-only) \??\J: a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe File opened (read-only) \??\K: a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe File opened (read-only) \??\P: a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe File opened (read-only) \??\W: a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe File opened (read-only) \??\Y: a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe File opened (read-only) \??\E: a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe File opened (read-only) \??\M: a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe File opened (read-only) \??\N: a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe File opened (read-only) \??\O: a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe File opened (read-only) \??\R: a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe File opened (read-only) \??\V: a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe File opened (read-only) \??\X: a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe File opened (read-only) \??\Z: a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe File opened (read-only) \??\L: a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe File opened (read-only) \??\Q: a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe File opened (read-only) \??\T: a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe File opened (read-only) \??\U: a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exedescription ioc process File opened for modification C:\autorun.inf a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe File opened for modification F:\autorun.inf a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe -
Drops file in Program Files directory 5 IoCs
Processes:
a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exedescription ioc process File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe -
Drops file in Windows directory 1 IoCs
Processes:
a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 32 IoCs
Processes:
a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exepid process 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exedescription pid process Token: SeDebugPrivilege 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Token: SeDebugPrivilege 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Token: SeDebugPrivilege 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Token: SeDebugPrivilege 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Token: SeDebugPrivilege 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Token: SeDebugPrivilege 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Token: SeDebugPrivilege 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Token: SeDebugPrivilege 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Token: SeDebugPrivilege 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Token: SeDebugPrivilege 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Token: SeDebugPrivilege 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Token: SeDebugPrivilege 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Token: SeDebugPrivilege 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Token: SeDebugPrivilege 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Token: SeDebugPrivilege 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Token: SeDebugPrivilege 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Token: SeDebugPrivilege 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Token: SeDebugPrivilege 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Token: SeDebugPrivilege 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Token: SeDebugPrivilege 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Token: SeDebugPrivilege 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Token: SeDebugPrivilege 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Token: SeDebugPrivilege 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Token: SeDebugPrivilege 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Token: SeDebugPrivilege 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Token: SeDebugPrivilege 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Token: SeDebugPrivilege 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Token: SeDebugPrivilege 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Token: SeDebugPrivilege 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Token: SeDebugPrivilege 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Token: SeDebugPrivilege 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Token: SeDebugPrivilege 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Token: SeDebugPrivilege 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exedescription pid process target process PID 288 wrote to memory of 1068 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe taskhost.exe PID 288 wrote to memory of 1124 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Dwm.exe PID 288 wrote to memory of 1168 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Explorer.EXE PID 288 wrote to memory of 2124 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe DllHost.exe PID 288 wrote to memory of 1068 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe taskhost.exe PID 288 wrote to memory of 1124 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Dwm.exe PID 288 wrote to memory of 1168 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Explorer.EXE PID 288 wrote to memory of 1068 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe taskhost.exe PID 288 wrote to memory of 1124 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Dwm.exe PID 288 wrote to memory of 1168 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Explorer.EXE PID 288 wrote to memory of 1068 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe taskhost.exe PID 288 wrote to memory of 1124 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Dwm.exe PID 288 wrote to memory of 1168 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Explorer.EXE PID 288 wrote to memory of 1068 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe taskhost.exe PID 288 wrote to memory of 1124 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Dwm.exe PID 288 wrote to memory of 1168 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Explorer.EXE PID 288 wrote to memory of 1068 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe taskhost.exe PID 288 wrote to memory of 1124 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Dwm.exe PID 288 wrote to memory of 1168 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Explorer.EXE PID 288 wrote to memory of 1068 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe taskhost.exe PID 288 wrote to memory of 1124 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Dwm.exe PID 288 wrote to memory of 1168 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Explorer.EXE PID 288 wrote to memory of 1068 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe taskhost.exe PID 288 wrote to memory of 1124 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Dwm.exe PID 288 wrote to memory of 1168 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Explorer.EXE PID 288 wrote to memory of 1068 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe taskhost.exe PID 288 wrote to memory of 1124 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Dwm.exe PID 288 wrote to memory of 1168 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Explorer.EXE PID 288 wrote to memory of 1068 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe taskhost.exe PID 288 wrote to memory of 1124 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Dwm.exe PID 288 wrote to memory of 1168 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Explorer.EXE PID 288 wrote to memory of 1068 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe taskhost.exe PID 288 wrote to memory of 1124 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Dwm.exe PID 288 wrote to memory of 1168 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Explorer.EXE PID 288 wrote to memory of 1068 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe taskhost.exe PID 288 wrote to memory of 1124 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Dwm.exe PID 288 wrote to memory of 1168 288 a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe Explorer.EXE -
System policy modification 1 TTPs 1 IoCs
Processes:
a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a35b70123a19b4cf11e0b1d23aeb9fac45f3fd718954257fbd77ddbc6e6e4068_NeikiAnalytics.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Impair Defenses
4Disable or Modify Tools
3Disable or Modify System Firewall
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\sfgh.pifFilesize
100KB
MD565af341a352be60628dc348a36e292e3
SHA16bd74ef5367e78762384ff9f4022cc5017009deb
SHA2569a37ba5a5270747a33887ed5abc46855716cdf105ed686cb177d43bd3b544d80
SHA51209ee56b1ae078cb8afb6154c5e6c586f601946e9c08af0e05a1b15f0ae684e4e9286206b27ba70bd4632fd52cf3805973decd5d210e4bd7448a6675cfe7f5f83
-
memory/288-32-0x0000000000650000-0x00000000016DE000-memory.dmpFilesize
16.6MB
-
memory/288-57-0x0000000000650000-0x00000000016DE000-memory.dmpFilesize
16.6MB
-
memory/288-9-0x0000000000650000-0x00000000016DE000-memory.dmpFilesize
16.6MB
-
memory/288-34-0x0000000000650000-0x00000000016DE000-memory.dmpFilesize
16.6MB
-
memory/288-11-0x0000000000650000-0x00000000016DE000-memory.dmpFilesize
16.6MB
-
memory/288-36-0x0000000000650000-0x00000000016DE000-memory.dmpFilesize
16.6MB
-
memory/288-10-0x0000000000650000-0x00000000016DE000-memory.dmpFilesize
16.6MB
-
memory/288-35-0x0000000000650000-0x00000000016DE000-memory.dmpFilesize
16.6MB
-
memory/288-13-0x0000000000650000-0x00000000016DE000-memory.dmpFilesize
16.6MB
-
memory/288-14-0x0000000000650000-0x00000000016DE000-memory.dmpFilesize
16.6MB
-
memory/288-15-0x0000000000650000-0x00000000016DE000-memory.dmpFilesize
16.6MB
-
memory/288-130-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/288-26-0x0000000002EB0000-0x0000000002EB1000-memory.dmpFilesize
4KB
-
memory/288-24-0x0000000002EB0000-0x0000000002EB1000-memory.dmpFilesize
4KB
-
memory/288-23-0x0000000002EA0000-0x0000000002EA2000-memory.dmpFilesize
8KB
-
memory/288-27-0x0000000002EA0000-0x0000000002EA2000-memory.dmpFilesize
8KB
-
memory/288-28-0x0000000002EA0000-0x0000000002EA2000-memory.dmpFilesize
8KB
-
memory/288-30-0x0000000000650000-0x00000000016DE000-memory.dmpFilesize
16.6MB
-
memory/288-31-0x0000000000650000-0x00000000016DE000-memory.dmpFilesize
16.6MB
-
memory/288-0-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/288-7-0x0000000000650000-0x00000000016DE000-memory.dmpFilesize
16.6MB
-
memory/288-8-0x0000000000650000-0x00000000016DE000-memory.dmpFilesize
16.6MB
-
memory/288-12-0x0000000000650000-0x00000000016DE000-memory.dmpFilesize
16.6MB
-
memory/288-38-0x0000000000650000-0x00000000016DE000-memory.dmpFilesize
16.6MB
-
memory/288-40-0x0000000000650000-0x00000000016DE000-memory.dmpFilesize
16.6MB
-
memory/288-42-0x0000000000650000-0x00000000016DE000-memory.dmpFilesize
16.6MB
-
memory/288-43-0x0000000000650000-0x00000000016DE000-memory.dmpFilesize
16.6MB
-
memory/288-50-0x0000000000650000-0x00000000016DE000-memory.dmpFilesize
16.6MB
-
memory/288-51-0x0000000000650000-0x00000000016DE000-memory.dmpFilesize
16.6MB
-
memory/288-52-0x0000000000650000-0x00000000016DE000-memory.dmpFilesize
16.6MB
-
memory/288-54-0x0000000000650000-0x00000000016DE000-memory.dmpFilesize
16.6MB
-
memory/288-5-0x0000000000650000-0x00000000016DE000-memory.dmpFilesize
16.6MB
-
memory/288-58-0x0000000000650000-0x00000000016DE000-memory.dmpFilesize
16.6MB
-
memory/288-59-0x0000000000650000-0x00000000016DE000-memory.dmpFilesize
16.6MB
-
memory/288-60-0x0000000002EA0000-0x0000000002EA2000-memory.dmpFilesize
8KB
-
memory/288-67-0x0000000000650000-0x00000000016DE000-memory.dmpFilesize
16.6MB
-
memory/288-69-0x0000000000650000-0x00000000016DE000-memory.dmpFilesize
16.6MB
-
memory/288-72-0x0000000000650000-0x00000000016DE000-memory.dmpFilesize
16.6MB
-
memory/288-74-0x0000000000650000-0x00000000016DE000-memory.dmpFilesize
16.6MB
-
memory/288-1-0x0000000000650000-0x00000000016DE000-memory.dmpFilesize
16.6MB
-
memory/1068-16-0x0000000000310000-0x0000000000312000-memory.dmpFilesize
8KB