Analysis
-
max time kernel
20s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 02:45
Static task
static1
Behavioral task
behavioral1
Sample
2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe
Resource
win7-20231129-en
General
-
Target
2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe
-
Size
97KB
-
MD5
f2ad4cc069cdccb32b055d68f181b220
-
SHA1
09807b1a57ac981c463b2b1f35589c69424ebae8
-
SHA256
2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a
-
SHA512
36a5eeecbd694c32c759c2d88cd5a3e15ee15665e114b9f4aa447fa9485d87c474a7c612d6f337df9fa4ac25eba9927613cfa0780b52de44a7e83582e3093dcc
-
SSDEEP
1536:NXk15iErYYuXi6k4N++9aVYXMrD7KCEWWjxLPz+0wYRrxjrbxGXzl+k:9k15Ee6k4L0Vv7KXNLb+XSxjrVQzQ
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
Processes:
2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe -
Processes:
2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe -
Processes:
2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe -
Processes:
resource yara_rule behavioral2/memory/4228-1-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4228-3-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4228-6-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4228-15-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4228-7-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4228-17-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4228-19-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4228-20-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4228-5-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4228-4-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4228-21-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4228-22-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4228-23-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4228-24-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4228-25-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4228-27-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4228-28-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4228-29-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4228-31-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4228-32-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4228-34-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4228-36-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4228-39-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4228-41-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4228-43-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4228-45-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4228-47-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4228-49-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4228-56-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4228-58-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4228-60-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4228-62-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4228-64-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4228-67-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4228-69-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4228-71-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4228-73-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4228-77-0x00000000007C0000-0x000000000187A000-memory.dmp upx -
Processes:
2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe -
Processes:
2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe -
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exedescription ioc process File opened (read-only) \??\E: 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe File opened (read-only) \??\J: 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe File opened (read-only) \??\M: 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe File opened (read-only) \??\Q: 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe File opened (read-only) \??\R: 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe File opened (read-only) \??\K: 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe File opened (read-only) \??\G: 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe File opened (read-only) \??\I: 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe File opened (read-only) \??\L: 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe File opened (read-only) \??\O: 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe File opened (read-only) \??\H: 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe File opened (read-only) \??\N: 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe File opened (read-only) \??\P: 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe File opened (read-only) \??\S: 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe -
Drops file in Program Files directory 4 IoCs
Processes:
2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exedescription ioc process File opened for modification C:\Program Files\7-Zip\7zG.exe 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe -
Drops file in Windows directory 2 IoCs
Processes:
2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exedescription ioc process File created C:\Windows\e57468e 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe File opened for modification C:\Windows\SYSTEM.INI 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exepid process 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exedescription pid process Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Token: SeDebugPrivilege 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exedescription pid process target process PID 4228 wrote to memory of 792 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe fontdrvhost.exe PID 4228 wrote to memory of 800 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe fontdrvhost.exe PID 4228 wrote to memory of 340 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe dwm.exe PID 4228 wrote to memory of 2616 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe sihost.exe PID 4228 wrote to memory of 2640 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe svchost.exe PID 4228 wrote to memory of 2740 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe taskhostw.exe PID 4228 wrote to memory of 3532 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Explorer.EXE PID 4228 wrote to memory of 3640 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe svchost.exe PID 4228 wrote to memory of 3824 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe DllHost.exe PID 4228 wrote to memory of 3912 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe StartMenuExperienceHost.exe PID 4228 wrote to memory of 3976 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe RuntimeBroker.exe PID 4228 wrote to memory of 4060 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe SearchApp.exe PID 4228 wrote to memory of 4144 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe RuntimeBroker.exe PID 4228 wrote to memory of 3920 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe TextInputHost.exe PID 4228 wrote to memory of 2976 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe RuntimeBroker.exe PID 4228 wrote to memory of 792 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe fontdrvhost.exe PID 4228 wrote to memory of 800 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe fontdrvhost.exe PID 4228 wrote to memory of 340 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe dwm.exe PID 4228 wrote to memory of 2616 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe sihost.exe PID 4228 wrote to memory of 2640 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe svchost.exe PID 4228 wrote to memory of 2740 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe taskhostw.exe PID 4228 wrote to memory of 3532 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe Explorer.EXE PID 4228 wrote to memory of 3640 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe svchost.exe PID 4228 wrote to memory of 3824 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe DllHost.exe PID 4228 wrote to memory of 3912 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe StartMenuExperienceHost.exe PID 4228 wrote to memory of 3976 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe RuntimeBroker.exe PID 4228 wrote to memory of 4060 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe SearchApp.exe PID 4228 wrote to memory of 4144 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe RuntimeBroker.exe PID 4228 wrote to memory of 3920 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe TextInputHost.exe PID 4228 wrote to memory of 2976 4228 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe RuntimeBroker.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2f96721596a021d7ed6d066b627c9510350c1625dc79e459dad9e415e0d5f40a_NeikiAnalytics.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Impair Defenses
4Disable or Modify Tools
3Disable or Modify System Firewall
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
F:\elhssn.exeFilesize
97KB
MD52cf1cf51b0be6450e6050a7c0981fb77
SHA1574d30d12e1cc01ffe3ab59a4bf6689f7886df1b
SHA256e919ba7fd43ea4e05051620de7b0434303af01df18f7ebfc18b63df476d521de
SHA51296b7c4c2088d9591705351c0ae4d75682d8febb651d4d76342151a1ca8619e677e482f784aec99a914e869e3c8b7f2584c293892b11a4790e20b5456d9f41c5a
-
memory/4228-29-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/4228-6-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/4228-9-0x0000000003FD0000-0x0000000003FD1000-memory.dmpFilesize
4KB
-
memory/4228-0-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4228-15-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/4228-7-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/4228-17-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/4228-16-0x0000000003D80000-0x0000000003D82000-memory.dmpFilesize
8KB
-
memory/4228-18-0x0000000003D80000-0x0000000003D82000-memory.dmpFilesize
8KB
-
memory/4228-19-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/4228-28-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/4228-5-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/4228-31-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/4228-8-0x0000000003D80000-0x0000000003D82000-memory.dmpFilesize
8KB
-
memory/4228-21-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/4228-22-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/4228-23-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/4228-24-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/4228-25-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/4228-27-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/4228-20-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/4228-3-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/4228-4-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/4228-32-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/4228-34-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/4228-36-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/4228-39-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/4228-41-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/4228-43-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/4228-45-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/4228-47-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/4228-49-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/4228-56-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/4228-58-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/4228-60-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/4228-62-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/4228-64-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/4228-66-0x0000000003D80000-0x0000000003D82000-memory.dmpFilesize
8KB
-
memory/4228-67-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/4228-69-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/4228-71-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/4228-73-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/4228-77-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB
-
memory/4228-1-0x00000000007C0000-0x000000000187A000-memory.dmpFilesize
16.7MB