Analysis
-
max time kernel
122s -
max time network
56s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29-06-2024 11:34
Static task
static1
Behavioral task
behavioral1
Sample
a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe
Resource
win7-20240611-en
General
-
Target
a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe
-
Size
81KB
-
MD5
0d98e02d4b8c50d993850b418ecf2390
-
SHA1
3ca4ee35d606f37534b53e68ece8cef809ef722a
-
SHA256
a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca
-
SHA512
5a7e524cc598b3d3eca9d347b66a9581e90693752e3dd15d7c89e2bfb2437007f11ea2bf16fcb43fa93db979aea167a95f3f374d4021d628b4e7bd90991de72c
-
SSDEEP
1536:eiUTk94vRZum2+JE0zK96m6kE2RqokZu0Rwxy6WBBm7ya:B4z2+JpzKV6vuTkZu0RwA6+m7ya
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
Processes:
a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe -
Processes:
a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe -
Processes:
a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe -
Processes:
resource yara_rule behavioral2/memory/968-1-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/968-5-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/968-4-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/968-6-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/968-10-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/968-11-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/968-14-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/968-7-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/968-15-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/968-16-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/968-17-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/968-18-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/968-19-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/968-20-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/968-22-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/968-23-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/968-24-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/968-26-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/968-27-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/968-29-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/968-31-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/968-34-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/968-36-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/968-38-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/968-40-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/968-42-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/968-44-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/968-46-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/968-48-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/968-51-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/968-53-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/968-54-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/968-61-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/968-62-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/968-65-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/968-68-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/968-69-0x00000000021A0000-0x000000000322E000-memory.dmp upx behavioral2/memory/968-70-0x00000000021A0000-0x000000000322E000-memory.dmp upx -
Processes:
a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe -
Processes:
a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exedescription ioc process File opened (read-only) \??\O: a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe File opened (read-only) \??\S: a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe File opened (read-only) \??\V: a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe File opened (read-only) \??\X: a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe File opened (read-only) \??\Z: a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe File opened (read-only) \??\I: a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe File opened (read-only) \??\L: a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe File opened (read-only) \??\M: a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe File opened (read-only) \??\J: a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe File opened (read-only) \??\K: a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe File opened (read-only) \??\N: a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe File opened (read-only) \??\Q: a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe File opened (read-only) \??\U: a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe File opened (read-only) \??\E: a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe File opened (read-only) \??\G: a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe File opened (read-only) \??\H: a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe File opened (read-only) \??\W: a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe File opened (read-only) \??\Y: a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe File opened (read-only) \??\P: a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe File opened (read-only) \??\R: a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe File opened (read-only) \??\T: a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exedescription ioc process File opened for modification C:\autorun.inf a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe File opened for modification F:\autorun.inf a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe -
Drops file in Program Files directory 12 IoCs
Processes:
a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exedescription ioc process File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe -
Drops file in Windows directory 1 IoCs
Processes:
a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exepid process 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exedescription pid process Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Token: SeDebugPrivilege 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exedescription pid process target process PID 968 wrote to memory of 784 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe fontdrvhost.exe PID 968 wrote to memory of 792 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe fontdrvhost.exe PID 968 wrote to memory of 1020 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe dwm.exe PID 968 wrote to memory of 2504 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe sihost.exe PID 968 wrote to memory of 2564 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe svchost.exe PID 968 wrote to memory of 2692 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe taskhostw.exe PID 968 wrote to memory of 3460 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Explorer.EXE PID 968 wrote to memory of 3604 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe svchost.exe PID 968 wrote to memory of 3792 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe DllHost.exe PID 968 wrote to memory of 3896 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe StartMenuExperienceHost.exe PID 968 wrote to memory of 3960 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe RuntimeBroker.exe PID 968 wrote to memory of 4084 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe SearchApp.exe PID 968 wrote to memory of 4140 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe RuntimeBroker.exe PID 968 wrote to memory of 4464 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe RuntimeBroker.exe PID 968 wrote to memory of 336 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe TextInputHost.exe PID 968 wrote to memory of 784 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe fontdrvhost.exe PID 968 wrote to memory of 792 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe fontdrvhost.exe PID 968 wrote to memory of 1020 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe dwm.exe PID 968 wrote to memory of 2504 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe sihost.exe PID 968 wrote to memory of 2564 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe svchost.exe PID 968 wrote to memory of 2692 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe taskhostw.exe PID 968 wrote to memory of 3460 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Explorer.EXE PID 968 wrote to memory of 3604 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe svchost.exe PID 968 wrote to memory of 3792 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe DllHost.exe PID 968 wrote to memory of 3896 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe StartMenuExperienceHost.exe PID 968 wrote to memory of 3960 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe RuntimeBroker.exe PID 968 wrote to memory of 4084 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe SearchApp.exe PID 968 wrote to memory of 4140 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe RuntimeBroker.exe PID 968 wrote to memory of 4464 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe RuntimeBroker.exe PID 968 wrote to memory of 336 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe TextInputHost.exe PID 968 wrote to memory of 784 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe fontdrvhost.exe PID 968 wrote to memory of 792 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe fontdrvhost.exe PID 968 wrote to memory of 1020 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe dwm.exe PID 968 wrote to memory of 2504 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe sihost.exe PID 968 wrote to memory of 2564 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe svchost.exe PID 968 wrote to memory of 2692 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe taskhostw.exe PID 968 wrote to memory of 3460 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Explorer.EXE PID 968 wrote to memory of 3604 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe svchost.exe PID 968 wrote to memory of 3792 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe DllHost.exe PID 968 wrote to memory of 3896 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe StartMenuExperienceHost.exe PID 968 wrote to memory of 3960 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe RuntimeBroker.exe PID 968 wrote to memory of 4084 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe SearchApp.exe PID 968 wrote to memory of 4140 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe RuntimeBroker.exe PID 968 wrote to memory of 4464 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe RuntimeBroker.exe PID 968 wrote to memory of 336 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe TextInputHost.exe PID 968 wrote to memory of 784 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe fontdrvhost.exe PID 968 wrote to memory of 792 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe fontdrvhost.exe PID 968 wrote to memory of 1020 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe dwm.exe PID 968 wrote to memory of 2504 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe sihost.exe PID 968 wrote to memory of 2564 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe svchost.exe PID 968 wrote to memory of 2692 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe taskhostw.exe PID 968 wrote to memory of 3460 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe Explorer.EXE PID 968 wrote to memory of 3604 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe svchost.exe PID 968 wrote to memory of 3792 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe DllHost.exe PID 968 wrote to memory of 3896 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe StartMenuExperienceHost.exe PID 968 wrote to memory of 3960 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe RuntimeBroker.exe PID 968 wrote to memory of 4084 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe SearchApp.exe PID 968 wrote to memory of 4140 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe RuntimeBroker.exe PID 968 wrote to memory of 4464 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe RuntimeBroker.exe PID 968 wrote to memory of 336 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe TextInputHost.exe PID 968 wrote to memory of 784 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe fontdrvhost.exe PID 968 wrote to memory of 792 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe fontdrvhost.exe PID 968 wrote to memory of 1020 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe dwm.exe PID 968 wrote to memory of 2504 968 a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe sihost.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a9cece1e0e8788d983b2fd5955fd95c9184c13d7137dbfffdd83640107cd06ca_NeikiAnalytics.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Impair Defenses
4Disable or Modify Tools
3Disable or Modify System Firewall
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
F:\ducr.pifFilesize
100KB
MD5cb5f8fa83327ad6d60ec558311a14166
SHA182a0a0718fbee47179f7045a2dc027c3ba6366ea
SHA256f1cf5efad14ea48b9deb9c68e9065b737922a75a0bab1920de2a7c8ef9ae23ac
SHA51210fc298dfcd1dfb07bc90364d71b920d1611357c1c10360a4e2e5e2742d3ecf877ddf5d922c5e5cf76be26421933bf7d3b47d105100c7da4ff08a71bff5412f4
-
memory/968-26-0x00000000021A0000-0x000000000322E000-memory.dmpFilesize
16.6MB
-
memory/968-6-0x00000000021A0000-0x000000000322E000-memory.dmpFilesize
16.6MB
-
memory/968-4-0x00000000021A0000-0x000000000322E000-memory.dmpFilesize
16.6MB
-
memory/968-0-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/968-12-0x00000000005D0000-0x00000000005D2000-memory.dmpFilesize
8KB
-
memory/968-13-0x00000000005D0000-0x00000000005D2000-memory.dmpFilesize
8KB
-
memory/968-10-0x00000000021A0000-0x000000000322E000-memory.dmpFilesize
16.6MB
-
memory/968-8-0x00000000005D0000-0x00000000005D2000-memory.dmpFilesize
8KB
-
memory/968-11-0x00000000021A0000-0x000000000322E000-memory.dmpFilesize
16.6MB
-
memory/968-14-0x00000000021A0000-0x000000000322E000-memory.dmpFilesize
16.6MB
-
memory/968-24-0x00000000021A0000-0x000000000322E000-memory.dmpFilesize
16.6MB
-
memory/968-9-0x0000000003230000-0x0000000003231000-memory.dmpFilesize
4KB
-
memory/968-27-0x00000000021A0000-0x000000000322E000-memory.dmpFilesize
16.6MB
-
memory/968-16-0x00000000021A0000-0x000000000322E000-memory.dmpFilesize
16.6MB
-
memory/968-17-0x00000000021A0000-0x000000000322E000-memory.dmpFilesize
16.6MB
-
memory/968-18-0x00000000021A0000-0x000000000322E000-memory.dmpFilesize
16.6MB
-
memory/968-19-0x00000000021A0000-0x000000000322E000-memory.dmpFilesize
16.6MB
-
memory/968-20-0x00000000021A0000-0x000000000322E000-memory.dmpFilesize
16.6MB
-
memory/968-22-0x00000000021A0000-0x000000000322E000-memory.dmpFilesize
16.6MB
-
memory/968-23-0x00000000021A0000-0x000000000322E000-memory.dmpFilesize
16.6MB
-
memory/968-7-0x00000000021A0000-0x000000000322E000-memory.dmpFilesize
16.6MB
-
memory/968-5-0x00000000021A0000-0x000000000322E000-memory.dmpFilesize
16.6MB
-
memory/968-15-0x00000000021A0000-0x000000000322E000-memory.dmpFilesize
16.6MB
-
memory/968-29-0x00000000021A0000-0x000000000322E000-memory.dmpFilesize
16.6MB
-
memory/968-31-0x00000000021A0000-0x000000000322E000-memory.dmpFilesize
16.6MB
-
memory/968-34-0x00000000021A0000-0x000000000322E000-memory.dmpFilesize
16.6MB
-
memory/968-36-0x00000000021A0000-0x000000000322E000-memory.dmpFilesize
16.6MB
-
memory/968-38-0x00000000021A0000-0x000000000322E000-memory.dmpFilesize
16.6MB
-
memory/968-40-0x00000000021A0000-0x000000000322E000-memory.dmpFilesize
16.6MB
-
memory/968-42-0x00000000021A0000-0x000000000322E000-memory.dmpFilesize
16.6MB
-
memory/968-44-0x00000000021A0000-0x000000000322E000-memory.dmpFilesize
16.6MB
-
memory/968-46-0x00000000021A0000-0x000000000322E000-memory.dmpFilesize
16.6MB
-
memory/968-48-0x00000000021A0000-0x000000000322E000-memory.dmpFilesize
16.6MB
-
memory/968-51-0x00000000021A0000-0x000000000322E000-memory.dmpFilesize
16.6MB
-
memory/968-53-0x00000000021A0000-0x000000000322E000-memory.dmpFilesize
16.6MB
-
memory/968-54-0x00000000021A0000-0x000000000322E000-memory.dmpFilesize
16.6MB
-
memory/968-61-0x00000000021A0000-0x000000000322E000-memory.dmpFilesize
16.6MB
-
memory/968-62-0x00000000021A0000-0x000000000322E000-memory.dmpFilesize
16.6MB
-
memory/968-63-0x00000000005D0000-0x00000000005D2000-memory.dmpFilesize
8KB
-
memory/968-65-0x00000000021A0000-0x000000000322E000-memory.dmpFilesize
16.6MB
-
memory/968-68-0x00000000021A0000-0x000000000322E000-memory.dmpFilesize
16.6MB
-
memory/968-69-0x00000000021A0000-0x000000000322E000-memory.dmpFilesize
16.6MB
-
memory/968-70-0x00000000021A0000-0x000000000322E000-memory.dmpFilesize
16.6MB
-
memory/968-1-0x00000000021A0000-0x000000000322E000-memory.dmpFilesize
16.6MB