Analysis
-
max time kernel
149s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 04:33
Static task
static1
Behavioral task
behavioral1
Sample
35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe
-
Size
1.3MB
-
MD5
af6cee3f9ef7e46eb68faf407942e380
-
SHA1
fa1b48a630b62247a23bdac43e5f8221736c8d3c
-
SHA256
35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9
-
SHA512
6aa6e1eb41b15d85db5bd59ac57234fdd56774370c91023ba405b3d2fe79451350cd39a0706c05cda155b9ec2430ee303ce26d923efb7ca7a78cecf503b42e9b
-
SSDEEP
12288:HXgvmzFHi0mo5aH0qMzd5807FHhPJQPDHvd:HXgvOHi0mGaH0qSdPFHb4V
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
Processes:
bglwzdj.exe35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exebglwzdj.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" bglwzdj.exe -
Processes:
35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exebglwzdj.exebglwzdj.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" bglwzdj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" bglwzdj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" bglwzdj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" bglwzdj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" bglwzdj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" bglwzdj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" bglwzdj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" bglwzdj.exe -
Adds policy Run key to start application 2 TTPs 28 IoCs
Processes:
35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exebglwzdj.exebglwzdj.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\scmcktetkwew = "dwpofxrppkbcvzgjzwpih.exe" 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\scmcktetkwew = "hwlgthxrneroddgfr.exe" bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\scmcktetkwew = "dwpofxrppkbcvzgjzwpih.exe" bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hovintbnb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aocwivkdyoawkjlj.exe" bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hovintbnb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dwpofxrppkbcvzgjzwpih.exe" bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\scmcktetkwew = "dwpofxrppkbcvzgjzwpih.exe" bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\scmcktetkwew = "qgwsgvmhewkiyzddqk.exe" bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hovintbnb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bsjgvldzxqfevxcdrmd.exe" bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hovintbnb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hwlgthxrneroddgfr.exe" bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hovintbnb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qgwsgvmhewkiyzddqk.exe" 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\scmcktetkwew = "bsjgvldzxqfevxcdrmd.exe" bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hovintbnb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ogywmdwtsmccuxdfuqia.exe" bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hovintbnb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qgwsgvmhewkiyzddqk.exe" bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hovintbnb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qgwsgvmhewkiyzddqk.exe" bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hovintbnb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dwpofxrppkbcvzgjzwpih.exe" bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hovintbnb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hwlgthxrneroddgfr.exe" bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\scmcktetkwew = "bsjgvldzxqfevxcdrmd.exe" bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\scmcktetkwew = "qgwsgvmhewkiyzddqk.exe" bglwzdj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\scmcktetkwew = "ogywmdwtsmccuxdfuqia.exe" bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hovintbnb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aocwivkdyoawkjlj.exe" bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hovintbnb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bsjgvldzxqfevxcdrmd.exe" bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\scmcktetkwew = "bsjgvldzxqfevxcdrmd.exe" 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\scmcktetkwew = "hwlgthxrneroddgfr.exe" bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\scmcktetkwew = "aocwivkdyoawkjlj.exe" bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\scmcktetkwew = "ogywmdwtsmccuxdfuqia.exe" bglwzdj.exe -
Disables RegEdit via registry modification 6 IoCs
Processes:
35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exebglwzdj.exebglwzdj.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" bglwzdj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" bglwzdj.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" bglwzdj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" bglwzdj.exe -
Executes dropped EXE 2 IoCs
Processes:
bglwzdj.exebglwzdj.exepid process 2080 bglwzdj.exe 2652 bglwzdj.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs
Processes:
bglwzdj.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefend bglwzdj.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc bglwzdj.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power bglwzdj.exe -
Loads dropped DLL 4 IoCs
Processes:
35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exepid process 1616 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe 1616 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe 1616 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe 1616 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe -
Adds Run key to start application 2 TTPs 64 IoCs
Processes:
bglwzdj.exe35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exebglwzdj.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vivozlzrlalgtrs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hwlgthxrneroddgfr.exe ." bglwzdj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vencjrbpfqx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qgwsgvmhewkiyzddqk.exe ." bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\aiqekrancm = "ogywmdwtsmccuxdfuqia.exe" bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\aocwivkdyoawkjlj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dwpofxrppkbcvzgjzwpih.exe" bglwzdj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\rcnenxjzrengr = "dwpofxrppkbcvzgjzwpih.exe" 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\aiqekrancm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hwlgthxrneroddgfr.exe" bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\aiqekrancm = "qgwsgvmhewkiyzddqk.exe" bglwzdj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\rcnenxjzrengr = "hwlgthxrneroddgfr.exe" bglwzdj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\aiqekrancm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dwpofxrppkbcvzgjzwpih.exe" bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\aiqekrancm = "aocwivkdyoawkjlj.exe" bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\aocwivkdyoawkjlj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bsjgvldzxqfevxcdrmd.exe" bglwzdj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\seqisdqhaoyseb = "hwlgthxrneroddgfr.exe ." bglwzdj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\seqisdqhaoyseb = "bsjgvldzxqfevxcdrmd.exe ." bglwzdj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\rcnenxjzrengr = "aocwivkdyoawkjlj.exe" bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vencjrbpfqx = "hwlgthxrneroddgfr.exe ." bglwzdj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vencjrbpfqx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aocwivkdyoawkjlj.exe ." bglwzdj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\rcnenxjzrengr = "qgwsgvmhewkiyzddqk.exe" bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vencjrbpfqx = "ogywmdwtsmccuxdfuqia.exe ." bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\aiqekrancm = "qgwsgvmhewkiyzddqk.exe" bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\aocwivkdyoawkjlj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ogywmdwtsmccuxdfuqia.exe" bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\aiqekrancm = "bsjgvldzxqfevxcdrmd.exe" bglwzdj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vencjrbpfqx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hwlgthxrneroddgfr.exe ." bglwzdj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vencjrbpfqx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bsjgvldzxqfevxcdrmd.exe ." bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\aiqekrancm = "aocwivkdyoawkjlj.exe" bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\aiqekrancm = "dwpofxrppkbcvzgjzwpih.exe" bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vivozlzrlalgtrs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hwlgthxrneroddgfr.exe ." bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vivozlzrlalgtrs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qgwsgvmhewkiyzddqk.exe ." bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\aiqekrancm = "hwlgthxrneroddgfr.exe" bglwzdj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\aiqekrancm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bsjgvldzxqfevxcdrmd.exe" bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\aiqekrancm = "bsjgvldzxqfevxcdrmd.exe" 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\rcnenxjzrengr = "aocwivkdyoawkjlj.exe" bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vencjrbpfqx = "hwlgthxrneroddgfr.exe ." 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\aocwivkdyoawkjlj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aocwivkdyoawkjlj.exe" bglwzdj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\seqisdqhaoyseb = "bsjgvldzxqfevxcdrmd.exe ." bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vivozlzrlalgtrs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bsjgvldzxqfevxcdrmd.exe ." bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\aiqekrancm = "hwlgthxrneroddgfr.exe" bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\aiqekrancm = "ogywmdwtsmccuxdfuqia.exe" 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\aiqekrancm = "ogywmdwtsmccuxdfuqia.exe" bglwzdj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\seqisdqhaoyseb = "ogywmdwtsmccuxdfuqia.exe ." bglwzdj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\aiqekrancm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dwpofxrppkbcvzgjzwpih.exe" bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vencjrbpfqx = "dwpofxrppkbcvzgjzwpih.exe ." bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\aocwivkdyoawkjlj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hwlgthxrneroddgfr.exe" 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vencjrbpfqx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ogywmdwtsmccuxdfuqia.exe ." 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\aocwivkdyoawkjlj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aocwivkdyoawkjlj.exe" bglwzdj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vencjrbpfqx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dwpofxrppkbcvzgjzwpih.exe ." bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vivozlzrlalgtrs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aocwivkdyoawkjlj.exe ." 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\aiqekrancm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qgwsgvmhewkiyzddqk.exe" bglwzdj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\aiqekrancm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ogywmdwtsmccuxdfuqia.exe" bglwzdj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\rcnenxjzrengr = "hwlgthxrneroddgfr.exe" bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vencjrbpfqx = "bsjgvldzxqfevxcdrmd.exe ." bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\aocwivkdyoawkjlj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ogywmdwtsmccuxdfuqia.exe" bglwzdj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vencjrbpfqx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aocwivkdyoawkjlj.exe ." bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\aiqekrancm = "dwpofxrppkbcvzgjzwpih.exe" bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\aiqekrancm = "bsjgvldzxqfevxcdrmd.exe" bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vencjrbpfqx = "qgwsgvmhewkiyzddqk.exe ." bglwzdj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\seqisdqhaoyseb = "hwlgthxrneroddgfr.exe ." bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vencjrbpfqx = "aocwivkdyoawkjlj.exe ." bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vivozlzrlalgtrs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aocwivkdyoawkjlj.exe ." bglwzdj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vencjrbpfqx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qgwsgvmhewkiyzddqk.exe ." bglwzdj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\seqisdqhaoyseb = "dwpofxrppkbcvzgjzwpih.exe ." bglwzdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vencjrbpfqx = "bsjgvldzxqfevxcdrmd.exe ." bglwzdj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\aiqekrancm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aocwivkdyoawkjlj.exe" bglwzdj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\seqisdqhaoyseb = "bsjgvldzxqfevxcdrmd.exe ." 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\rcnenxjzrengr = "dwpofxrppkbcvzgjzwpih.exe" bglwzdj.exe -
Processes:
bglwzdj.exebglwzdj.exe35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" bglwzdj.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA bglwzdj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" bglwzdj.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA bglwzdj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe -
Looks up external IP address via web service 8 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 9 whatismyipaddress.com 10 whatismyip.everdot.org 11 whatismyip.everdot.org 14 www.showmyipaddress.com 3 www.whatismyip.ca 5 whatismyipaddress.com 6 whatismyipaddress.com 7 whatismyipaddress.com -
Drops file in System32 directory 4 IoCs
Processes:
bglwzdj.exedescription ioc process File opened for modification C:\Windows\SysWOW64\ecaeaxwzeeagenzhcecaea.wze bglwzdj.exe File created C:\Windows\SysWOW64\ecaeaxwzeeagenzhcecaea.wze bglwzdj.exe File opened for modification C:\Windows\SysWOW64\vencjrbpfqxoxrohnajshowgukvctcwtm.fox bglwzdj.exe File created C:\Windows\SysWOW64\vencjrbpfqxoxrohnajshowgukvctcwtm.fox bglwzdj.exe -
Drops file in Program Files directory 4 IoCs
Processes:
bglwzdj.exedescription ioc process File opened for modification C:\Program Files (x86)\ecaeaxwzeeagenzhcecaea.wze bglwzdj.exe File created C:\Program Files (x86)\ecaeaxwzeeagenzhcecaea.wze bglwzdj.exe File opened for modification C:\Program Files (x86)\vencjrbpfqxoxrohnajshowgukvctcwtm.fox bglwzdj.exe File created C:\Program Files (x86)\vencjrbpfqxoxrohnajshowgukvctcwtm.fox bglwzdj.exe -
Drops file in Windows directory 4 IoCs
Processes:
bglwzdj.exedescription ioc process File opened for modification C:\Windows\ecaeaxwzeeagenzhcecaea.wze bglwzdj.exe File created C:\Windows\ecaeaxwzeeagenzhcecaea.wze bglwzdj.exe File opened for modification C:\Windows\vencjrbpfqxoxrohnajshowgukvctcwtm.fox bglwzdj.exe File created C:\Windows\vencjrbpfqxoxrohnajshowgukvctcwtm.fox bglwzdj.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
bglwzdj.exepid process 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe 2080 bglwzdj.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
bglwzdj.exedescription pid process Token: SeDebugPrivilege 2080 bglwzdj.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exedescription pid process target process PID 1616 wrote to memory of 2080 1616 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe bglwzdj.exe PID 1616 wrote to memory of 2080 1616 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe bglwzdj.exe PID 1616 wrote to memory of 2080 1616 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe bglwzdj.exe PID 1616 wrote to memory of 2080 1616 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe bglwzdj.exe PID 1616 wrote to memory of 2652 1616 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe bglwzdj.exe PID 1616 wrote to memory of 2652 1616 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe bglwzdj.exe PID 1616 wrote to memory of 2652 1616 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe bglwzdj.exe PID 1616 wrote to memory of 2652 1616 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe bglwzdj.exe -
System policy modification 1 TTPs 39 IoCs
Processes:
35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exebglwzdj.exebglwzdj.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" bglwzdj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" bglwzdj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" bglwzdj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" bglwzdj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" bglwzdj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer bglwzdj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" bglwzdj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" bglwzdj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System bglwzdj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" bglwzdj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" bglwzdj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" bglwzdj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" bglwzdj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" bglwzdj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" bglwzdj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer bglwzdj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" bglwzdj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" bglwzdj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" bglwzdj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" bglwzdj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" bglwzdj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System bglwzdj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" bglwzdj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" 35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" bglwzdj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" bglwzdj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" bglwzdj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\35a05bc9c2f03476ef8483c5d18768f10170ab11d0eaa8e3c5b95e73dc0e24a9_NeikiAnalytics.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\bglwzdj.exe"C:\Users\Admin\AppData\Local\Temp\bglwzdj.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\bglwzdj.exe"C:\Users\Admin\AppData\Local\Temp\bglwzdj.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- System policy modification
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\ecaeaxwzeeagenzhcecaea.wzeFilesize
280B
MD5f9e4062d3f62b1dd2b126eacbc20cce4
SHA1c943bf03f22fbe2c0e2e0d900cf3d1eedb91ffff
SHA2569a99c63421796b2c625d457128825a99c346a3bae8ee833a584673b200caebca
SHA5123ad835c03f79b887b503806309301256e8231e23d10de1526bb920bab66bf12b9dfd84d2c36277400faed51073bb1fd29f1f408156c9bfa878bf908e7b912f77
-
C:\Users\Admin\AppData\Local\vencjrbpfqxoxrohnajshowgukvctcwtm.foxFilesize
4KB
MD511e29203a8a8076358114e66f2c3f258
SHA1f8fa74fdfefb69a9fe276309a46ba16e01f4b8f4
SHA25687adfd40e551b5049b4d342ee37553c1052a0afae54c04b70ceffe0533bb8d82
SHA5123950a01090e33ac5e84d8a1e8635e833d016d9a288e9cf6c820b26367bec4d5a3cdb0e2b74581c7159f90a1386c93cdd4df806bf3dac87b9b79caa1249bb4024
-
\Users\Admin\AppData\Local\Temp\bglwzdj.exeFilesize
2.0MB
MD560bfd447b06a7b60892f81bac6595d74
SHA119dba8fe601bf8de9dad39638e3687c0d95c0cb0
SHA256b80b63225adcc4861f0f67ddea3da849ba23da9b5018deccf3817ae94a4fd275
SHA512e62c7690e689cd106c135d60b7765f003c26ed2799953a7d65bac4331a56a4ccaaf7486496eb7c21c3b03e56b14b226605b3a35e3067db6c35e2adde827a2e9b