Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 03:53
Static task
static1
Behavioral task
behavioral1
Sample
336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe
-
Size
3.1MB
-
MD5
e1d9cf8f0681c095c206be771c74bbe0
-
SHA1
9f145b4cab5880bf7543781746edd1eeddfb7f2f
-
SHA256
336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e
-
SHA512
7d8b7aef957600139f92197c7698462abe1b5b38a89303f53e049dac23eb5087a4c4b5af0f60f94720ebb1213614bc2ab1aabe8cc07f91e669208c413e358a16
-
SSDEEP
98304:tqNY3aiqSfLWppP9qfXme/LbwMlmdxcs/0K3nd2k:tZamTWphmWezbwMYR/0ungk
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
Processes:
336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe -
Processes:
336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe -
Processes:
336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
Processes:
VCREDI~2.EXEpid process 2700 VCREDI~2.EXE -
Loads dropped DLL 5 IoCs
Processes:
336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exeVCREDI~2.EXEMsiExec.exepid process 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe 2700 VCREDI~2.EXE 2700 VCREDI~2.EXE 2700 VCREDI~2.EXE 1680 MsiExec.exe -
Processes:
resource yara_rule behavioral1/memory/1244-2-0x0000000002AF0000-0x0000000003B7E000-memory.dmp upx behavioral1/memory/1244-9-0x0000000002AF0000-0x0000000003B7E000-memory.dmp upx behavioral1/memory/1244-4-0x0000000002AF0000-0x0000000003B7E000-memory.dmp upx behavioral1/memory/1244-13-0x0000000002AF0000-0x0000000003B7E000-memory.dmp upx behavioral1/memory/1244-10-0x0000000002AF0000-0x0000000003B7E000-memory.dmp upx behavioral1/memory/1244-12-0x0000000002AF0000-0x0000000003B7E000-memory.dmp upx behavioral1/memory/1244-5-0x0000000002AF0000-0x0000000003B7E000-memory.dmp upx behavioral1/memory/1244-14-0x0000000002AF0000-0x0000000003B7E000-memory.dmp upx behavioral1/memory/1244-11-0x0000000002AF0000-0x0000000003B7E000-memory.dmp upx behavioral1/memory/1244-8-0x0000000002AF0000-0x0000000003B7E000-memory.dmp upx behavioral1/memory/1244-7-0x0000000002AF0000-0x0000000003B7E000-memory.dmp upx behavioral1/memory/1244-29-0x0000000002AF0000-0x0000000003B7E000-memory.dmp upx behavioral1/memory/1244-30-0x0000000002AF0000-0x0000000003B7E000-memory.dmp upx behavioral1/memory/1244-31-0x0000000002AF0000-0x0000000003B7E000-memory.dmp upx behavioral1/memory/1244-34-0x0000000002AF0000-0x0000000003B7E000-memory.dmp upx behavioral1/memory/1244-35-0x0000000002AF0000-0x0000000003B7E000-memory.dmp upx behavioral1/memory/1244-36-0x0000000002AF0000-0x0000000003B7E000-memory.dmp upx behavioral1/memory/1244-48-0x0000000002AF0000-0x0000000003B7E000-memory.dmp upx behavioral1/memory/1244-49-0x0000000002AF0000-0x0000000003B7E000-memory.dmp upx behavioral1/memory/1244-89-0x0000000002AF0000-0x0000000003B7E000-memory.dmp upx behavioral1/memory/1244-91-0x0000000002AF0000-0x0000000003B7E000-memory.dmp upx behavioral1/memory/1244-92-0x0000000002AF0000-0x0000000003B7E000-memory.dmp upx behavioral1/memory/1244-114-0x0000000002AF0000-0x0000000003B7E000-memory.dmp upx behavioral1/memory/1244-115-0x0000000002AF0000-0x0000000003B7E000-memory.dmp upx behavioral1/memory/1244-316-0x0000000002AF0000-0x0000000003B7E000-memory.dmp upx -
Processes:
336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exeVCREDI~2.EXEdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" VCREDI~2.EXE -
Processes:
336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe -
Enumerates connected drives 3 TTPs 63 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exe336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exedescription ioc process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\K: 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe File opened (read-only) \??\L: 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe File opened (read-only) \??\U: 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\T: 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe File opened (read-only) \??\I: 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe File opened (read-only) \??\P: 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\O: 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe File opened (read-only) \??\K: msiexec.exe -
Drops file in Windows directory 60 IoCs
Processes:
msiexec.exeDrvInst.exe336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exedescription ioc process File created C:\Windows\WinSxS\InstallTemp\20240701035406709.0\amd64_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6e02dfe5.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240701035406709.0\mfc80.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240701035406959.1 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240701035406615.0\msvcm80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240701035406959.2\8.0.50727.762.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240701035406834.0\mfc80KOR.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240701035406927.0\vcomp.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240701035406959.1\8.0.50727.762.policy msiexec.exe File opened for modification C:\Windows\Installer\f766c0c.msi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240701035406553.0\amd64_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_fdbc5a54.manifest msiexec.exe File opened for modification C:\Windows\Installer\MSI7550.tmp msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240701035406553.0 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240701035406615.0 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240701035406959.2 msiexec.exe File opened for modification C:\Windows\Installer\f766c0f.ipi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240701035406553.0\ATL80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240701035406615.0\amd64_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_9d1c6ce0.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240701035406834.0\amd64_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_c351f8e3.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240701035406834.0\mfc80ENU.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240701035406927.0\amd64_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_9e223a7a.cat msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240701035406709.0\mfc80u.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240701035406959.2\8.0.50727.762.cat msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240701035406927.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240701035406834.0\mfc80FRA.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240701035406943.0\8.0.50727.762.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240701035406709.0\amd64_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6e02dfe5.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240701035406834.0\mfc80ITA.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240701035406834.0\mfc80JPN.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240701035406974.0\8.0.50727.762.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240701035406615.0\msvcr80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240701035406834.0\mfc80CHS.dll msiexec.exe File created C:\Windows\Installer\f766c11.msi msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240701035406959.0 msiexec.exe File opened for modification C:\Windows\SYSTEM.INI 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe File created C:\Windows\Installer\f766c0f.ipi msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240701035406709.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240701035406553.0\amd64_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_fdbc5a54.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240701035406615.0\amd64_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_9d1c6ce0.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240701035406834.0\amd64_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_c351f8e3.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240701035406927.0\amd64_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_9e223a7a.manifest msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240701035406974.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240701035406959.1\8.0.50727.762.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240701035406943.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240701035406615.0\msvcp80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240701035406709.0\mfcm80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240701035406834.0\mfc80ESP.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240701035406834.0\mfc80DEU.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240701035406959.0\8.0.50727.762.policy msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\f766c0c.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI6E3D.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240701035406709.0\mfcm80u.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240701035406834.0\mfc80CHT.dll msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File created C:\Windows\WinSxS\InstallTemp\20240701035406943.0\8.0.50727.762.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240701035406959.0\8.0.50727.762.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240701035406974.0\8.0.50727.762.policy msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20240701035406834.0 msiexec.exe -
Event Triggered Execution: Installer Packages 1 TTPs 1 IoCs
-
Modifies data under HKEY_USERS 46 IoCs
Processes:
DrvInst.exemsiexec.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe -
Modifies registry class 56 IoCs
Processes:
msiexec.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84b9c17023c712640acaf308593282f8\SourceList\Media\1 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\92091D8AC5E822E408118470F0E997E6 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84b9c17023c712640acaf308593282f8\SourceList\Media\8 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84b9c17023c712640acaf308593282f8\SourceList\Media\3 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84b9c17023c712640acaf308593282f8\SourceList\Media\7 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84b9c17023c712640acaf308593282f8\SourceList\Media msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFCLOC,type="win32-policy",version="8.0.50727.762",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2a0037004000400025003d003100750055003d00310030005d003600510043003900740021005600560043005f005200650064006900730074003e00500054005d002700660025002b0027004b002800650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84b9c17023c712640acaf308593282f8\ProductName = "Microsoft Visual C++ 2005 Redistributable (x64)" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84b9c17023c712640acaf308593282f8\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\84b9c17023c712640acaf308593282f8\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Features\84b9c17023c712640acaf308593282f8 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.CRT,type="win32-policy",version="8.0.50727.762",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2a0037004000400025003d003100750055003d00310030005d003600510043003900740021005600560043005f005200650064006900730074003e004b0039007000540041002700650026005d002900650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84b9c17023c712640acaf308593282f8\SourceList\Media\4 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84b9c17023c712640acaf308593282f8\SourceList\Media\5 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84b9c17023c712640acaf308593282f8\SourceList\Media\11 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFC,type="win32",version="8.0.50727.762",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2a0037004000400025003d003100750055003d00310030005d003600510043003900740021005600560043005f005200650064006900730074003e0069002a0048004e00530057007d0024007e005500650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.OpenMP,type="win32",version="8.0.50727.762",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2a0037004000400025003d003100750055003d00310030005d003600510043003900740021005600560043005f005200650064006900730074003e007a0050005400310026006e0073004b0064007a00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84b9c17023c712640acaf308593282f8\SourceList\Media\10 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84b9c17023c712640acaf308593282f8\SourceList\PackageName = "vcredist.msi" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84b9c17023c712640acaf308593282f8\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\84b9c17023c712640acaf308593282f8\VC_Redist msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84b9c17023c712640acaf308593282f8\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\92091D8AC5E822E408118470F0E997E6 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84b9c17023c712640acaf308593282f8 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84b9c17023c712640acaf308593282f8\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Win32Assemblies\Global msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\84b9c17023c712640acaf308593282f8\Servicing_Key msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\84b9c17023c712640acaf308593282f8 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84b9c17023c712640acaf308593282f8\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84b9c17023c712640acaf308593282f8\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84b9c17023c712640acaf308593282f8\SourceList\Media\9 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\84b9c17023c712640acaf308593282f8\SourceList msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84b9c17023c712640acaf308593282f8\SourceList msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.CRT,type="win32",version="8.0.50727.762",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2a0037004000400025003d003100750055003d00310030005d003600510043003900740021005600560043005f005200650064006900730074003e0049004c005400540052005900320074004f005700650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.ATL,type="win32-policy",version="8.0.50727.762",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2a0037004000400025003d003100750055003d00310030005d003600510043003900740021005600560043005f005200650064006900730074003e007b004c0046003d0042004900620074004f002800650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84b9c17023c712640acaf308593282f8\Language = "0" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84b9c17023c712640acaf308593282f8 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84b9c17023c712640acaf308593282f8\Version = "134274064" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84b9c17023c712640acaf308593282f8\SourceList\Media\2 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\84b9c17023c712640acaf308593282f8 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84b9c17023c712640acaf308593282f8\PackageCode = "DE4274C441EE6BD49B69F8E3F8AB76C5" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84b9c17023c712640acaf308593282f8\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84b9c17023c712640acaf308593282f8\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84b9c17023c712640acaf308593282f8\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\92091D8AC5E822E408118470F0E997E6\84b9c17023c712640acaf308593282f8 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84b9c17023c712640acaf308593282f8\SourceList\Net msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.OpenMP,type="win32-policy",version="8.0.50727.762",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2a0037004000400025003d003100750055003d00310030005d003600510043003900740021005600560043005f005200650064006900730074003e007e0078002d00360076007a0045007a007e003200650038004d006b0062004900640046007700550000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84b9c17023c712640acaf308593282f8\SourceList msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84b9c17023c712640acaf308593282f8\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFCLOC,type="win32",version="8.0.50727.762",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2a0037004000400025003d003100750055003d00310030005d003600510043003900740021005600560043005f005200650064006900730074003e00530021004900240047002e004f005f0078006800650038004d006b0062004900640046007700550000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\84b9c17023c712640acaf308593282f8 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84b9c17023c712640acaf308593282f8\SourceList\Media\6 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.ATL,type="win32",version="8.0.50727.762",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2a0037004000400025003d003100750055003d00310030005d003600510043003900740021005600560043005f005200650064006900730074003e005a00310021003d00520046007900460072005700650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFC,type="win32-policy",version="8.0.50727.762",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2a0037004000400025003d003100750055003d00310030005d003600510043003900740021005600560043005f005200650064006900730074003e00240062003000290043004b0076003d0035002700650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\84b9c17023c712640acaf308593282f8\DeploymentFlags = "3" msiexec.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exemsiexec.exepid process 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe 2744 msiexec.exe 2744 msiexec.exe 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exemsiexec.exemsiexec.exevssvc.exeDrvInst.exedescription pid process Token: SeDebugPrivilege 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe Token: SeDebugPrivilege 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe Token: SeDebugPrivilege 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe Token: SeDebugPrivilege 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe Token: SeDebugPrivilege 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe Token: SeDebugPrivilege 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe Token: SeDebugPrivilege 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe Token: SeDebugPrivilege 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe Token: SeDebugPrivilege 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe Token: SeDebugPrivilege 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe Token: SeDebugPrivilege 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe Token: SeDebugPrivilege 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe Token: SeDebugPrivilege 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe Token: SeDebugPrivilege 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe Token: SeDebugPrivilege 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe Token: SeDebugPrivilege 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe Token: SeDebugPrivilege 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe Token: SeDebugPrivilege 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe Token: SeDebugPrivilege 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe Token: SeDebugPrivilege 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe Token: SeShutdownPrivilege 2592 msiexec.exe Token: SeIncreaseQuotaPrivilege 2592 msiexec.exe Token: SeRestorePrivilege 2744 msiexec.exe Token: SeTakeOwnershipPrivilege 2744 msiexec.exe Token: SeSecurityPrivilege 2744 msiexec.exe Token: SeCreateTokenPrivilege 2592 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2592 msiexec.exe Token: SeLockMemoryPrivilege 2592 msiexec.exe Token: SeIncreaseQuotaPrivilege 2592 msiexec.exe Token: SeMachineAccountPrivilege 2592 msiexec.exe Token: SeTcbPrivilege 2592 msiexec.exe Token: SeSecurityPrivilege 2592 msiexec.exe Token: SeTakeOwnershipPrivilege 2592 msiexec.exe Token: SeLoadDriverPrivilege 2592 msiexec.exe Token: SeSystemProfilePrivilege 2592 msiexec.exe Token: SeSystemtimePrivilege 2592 msiexec.exe Token: SeProfSingleProcessPrivilege 2592 msiexec.exe Token: SeIncBasePriorityPrivilege 2592 msiexec.exe Token: SeCreatePagefilePrivilege 2592 msiexec.exe Token: SeCreatePermanentPrivilege 2592 msiexec.exe Token: SeBackupPrivilege 2592 msiexec.exe Token: SeRestorePrivilege 2592 msiexec.exe Token: SeShutdownPrivilege 2592 msiexec.exe Token: SeDebugPrivilege 2592 msiexec.exe Token: SeAuditPrivilege 2592 msiexec.exe Token: SeSystemEnvironmentPrivilege 2592 msiexec.exe Token: SeChangeNotifyPrivilege 2592 msiexec.exe Token: SeRemoteShutdownPrivilege 2592 msiexec.exe Token: SeUndockPrivilege 2592 msiexec.exe Token: SeSyncAgentPrivilege 2592 msiexec.exe Token: SeEnableDelegationPrivilege 2592 msiexec.exe Token: SeManageVolumePrivilege 2592 msiexec.exe Token: SeImpersonatePrivilege 2592 msiexec.exe Token: SeCreateGlobalPrivilege 2592 msiexec.exe Token: SeBackupPrivilege 1992 vssvc.exe Token: SeRestorePrivilege 1992 vssvc.exe Token: SeAuditPrivilege 1992 vssvc.exe Token: SeBackupPrivilege 2744 msiexec.exe Token: SeRestorePrivilege 2744 msiexec.exe Token: SeDebugPrivilege 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe Token: SeDebugPrivilege 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe Token: SeDebugPrivilege 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe Token: SeDebugPrivilege 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe Token: SeRestorePrivilege 1720 DrvInst.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msiexec.exepid process 2592 msiexec.exe 2592 msiexec.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exeVCREDI~2.EXEmsiexec.exedescription pid process target process PID 1244 wrote to memory of 1112 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe taskhost.exe PID 1244 wrote to memory of 1176 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe Dwm.exe PID 1244 wrote to memory of 1284 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe Explorer.EXE PID 1244 wrote to memory of 2224 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe DllHost.exe PID 1244 wrote to memory of 2700 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe VCREDI~2.EXE PID 1244 wrote to memory of 2700 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe VCREDI~2.EXE PID 1244 wrote to memory of 2700 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe VCREDI~2.EXE PID 1244 wrote to memory of 2700 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe VCREDI~2.EXE PID 1244 wrote to memory of 2700 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe VCREDI~2.EXE PID 1244 wrote to memory of 2700 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe VCREDI~2.EXE PID 1244 wrote to memory of 2700 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe VCREDI~2.EXE PID 2700 wrote to memory of 2592 2700 VCREDI~2.EXE msiexec.exe PID 2700 wrote to memory of 2592 2700 VCREDI~2.EXE msiexec.exe PID 2700 wrote to memory of 2592 2700 VCREDI~2.EXE msiexec.exe PID 2700 wrote to memory of 2592 2700 VCREDI~2.EXE msiexec.exe PID 2700 wrote to memory of 2592 2700 VCREDI~2.EXE msiexec.exe PID 2700 wrote to memory of 2592 2700 VCREDI~2.EXE msiexec.exe PID 2700 wrote to memory of 2592 2700 VCREDI~2.EXE msiexec.exe PID 1244 wrote to memory of 1112 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe taskhost.exe PID 1244 wrote to memory of 1176 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe Dwm.exe PID 1244 wrote to memory of 1284 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe Explorer.EXE PID 1244 wrote to memory of 2700 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe VCREDI~2.EXE PID 1244 wrote to memory of 2700 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe VCREDI~2.EXE PID 1244 wrote to memory of 2592 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe msiexec.exe PID 1244 wrote to memory of 2592 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe msiexec.exe PID 2744 wrote to memory of 1680 2744 msiexec.exe MsiExec.exe PID 2744 wrote to memory of 1680 2744 msiexec.exe MsiExec.exe PID 2744 wrote to memory of 1680 2744 msiexec.exe MsiExec.exe PID 2744 wrote to memory of 1680 2744 msiexec.exe MsiExec.exe PID 2744 wrote to memory of 1680 2744 msiexec.exe MsiExec.exe PID 2744 wrote to memory of 1680 2744 msiexec.exe MsiExec.exe PID 2744 wrote to memory of 1680 2744 msiexec.exe MsiExec.exe PID 1244 wrote to memory of 1112 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe taskhost.exe PID 1244 wrote to memory of 1176 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe Dwm.exe PID 1244 wrote to memory of 1284 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe Explorer.EXE PID 1244 wrote to memory of 1680 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe MsiExec.exe PID 1244 wrote to memory of 1680 1244 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe MsiExec.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\336ec1049ff1bae842f7120c211096b6352f29c26ff7e3c9667648667ae4310e_NeikiAnalytics.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~2.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~2.EXE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec /i vcredist.msi4⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A703F32796E981DFCEC2059FA45132CF2⤵
- Loads dropped DLL
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003B0" "00000000000005A4"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Defense Evasion
Modify Registry
6Impair Defenses
4Disable or Modify Tools
3Disable or Modify System Firewall
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~2.EXEFilesize
3.0MB
MD5f6f02acc9f12ed50752a46d6d604366c
SHA18977f1a83b431e00a7778c3d9ae12186c3195c86
SHA2569b8e03f752edffbb99ec66a296854eb0cdea242b3b0d2d1c4971519f065fde3b
SHA51275d097fd074a271fcdce955f3ed589a33e9f1dff2828a8bc593d40fb3e92b2992ae994f5b9d1985c97ac95b7dc5adb909ec80205349106f26bbd3995e6234be2
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vcredis1.cabFilesize
309KB
MD5aae3979b3284a81600ee6c53b9faceb1
SHA1f9fa42cd6f8f26f2214e992b16e1f844e1f10bca
SHA256b02b597c8f40c3e7eb8a0f341f1deb31ee067f05e0fe2c35f95fe0d048ea7cef
SHA51293314de2c5fc0130c4f82a18cf757c4c61c8001911a32cf693eb4a1241c241dee193124ad98896462be3dd545d3fe5ef2ac9c80effc619fede36202db9b5ceec
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vcredist.msiFilesize
3.1MB
MD5b80bb6ed55d37e94eedb93ee12382fee
SHA190c020cde0026f62de72da9eca1a10ab6c915483
SHA2566d08b5552e5bf6985fb4deec83889c715007c9f16a25fc5389face4f15c675ab
SHA512d371b1ed142002c0343ffc25228d325f26bd113b277c63225d09bd014483103215f8c0a125d7f3b5025ae02b795addc670628422cda584ca4c5fb2cf3db36c62
-
C:\Windows\Installer\MSI6E3D.tmpFilesize
28KB
MD585221b3bcba8dbe4b4a46581aa49f760
SHA1746645c92594bfc739f77812d67cfd85f4b92474
SHA256f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
SHA512060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d
-
memory/1112-15-0x0000000002170000-0x0000000002172000-memory.dmpFilesize
8KB
-
memory/1244-30-0x0000000002AF0000-0x0000000003B7E000-memory.dmpFilesize
16.6MB
-
memory/1244-36-0x0000000002AF0000-0x0000000003B7E000-memory.dmpFilesize
16.6MB
-
memory/1244-12-0x0000000002AF0000-0x0000000003B7E000-memory.dmpFilesize
16.6MB
-
memory/1244-5-0x0000000002AF0000-0x0000000003B7E000-memory.dmpFilesize
16.6MB
-
memory/1244-14-0x0000000002AF0000-0x0000000003B7E000-memory.dmpFilesize
16.6MB
-
memory/1244-28-0x0000000000CD0000-0x0000000000CD2000-memory.dmpFilesize
8KB
-
memory/1244-27-0x0000000000CD0000-0x0000000000CD2000-memory.dmpFilesize
8KB
-
memory/1244-26-0x0000000004850000-0x0000000004851000-memory.dmpFilesize
4KB
-
memory/1244-24-0x0000000004850000-0x0000000004851000-memory.dmpFilesize
4KB
-
memory/1244-23-0x0000000000CD0000-0x0000000000CD2000-memory.dmpFilesize
8KB
-
memory/1244-13-0x0000000002AF0000-0x0000000003B7E000-memory.dmpFilesize
16.6MB
-
memory/1244-11-0x0000000002AF0000-0x0000000003B7E000-memory.dmpFilesize
16.6MB
-
memory/1244-8-0x0000000002AF0000-0x0000000003B7E000-memory.dmpFilesize
16.6MB
-
memory/1244-7-0x0000000002AF0000-0x0000000003B7E000-memory.dmpFilesize
16.6MB
-
memory/1244-29-0x0000000002AF0000-0x0000000003B7E000-memory.dmpFilesize
16.6MB
-
memory/1244-1-0x0000000000990000-0x0000000000CB0000-memory.dmpFilesize
3.1MB
-
memory/1244-31-0x0000000002AF0000-0x0000000003B7E000-memory.dmpFilesize
16.6MB
-
memory/1244-34-0x0000000002AF0000-0x0000000003B7E000-memory.dmpFilesize
16.6MB
-
memory/1244-35-0x0000000002AF0000-0x0000000003B7E000-memory.dmpFilesize
16.6MB
-
memory/1244-10-0x0000000002AF0000-0x0000000003B7E000-memory.dmpFilesize
16.6MB
-
memory/1244-4-0x0000000002AF0000-0x0000000003B7E000-memory.dmpFilesize
16.6MB
-
memory/1244-43-0x0000000001001000-0x0000000001002000-memory.dmpFilesize
4KB
-
memory/1244-48-0x0000000002AF0000-0x0000000003B7E000-memory.dmpFilesize
16.6MB
-
memory/1244-49-0x0000000002AF0000-0x0000000003B7E000-memory.dmpFilesize
16.6MB
-
memory/1244-9-0x0000000002AF0000-0x0000000003B7E000-memory.dmpFilesize
16.6MB
-
memory/1244-89-0x0000000002AF0000-0x0000000003B7E000-memory.dmpFilesize
16.6MB
-
memory/1244-91-0x0000000002AF0000-0x0000000003B7E000-memory.dmpFilesize
16.6MB
-
memory/1244-315-0x0000000001000000-0x0000000001320000-memory.dmpFilesize
3.1MB
-
memory/1244-316-0x0000000002AF0000-0x0000000003B7E000-memory.dmpFilesize
16.6MB
-
memory/1244-0-0x0000000001000000-0x0000000001320000-memory.dmpFilesize
3.1MB
-
memory/1244-2-0x0000000002AF0000-0x0000000003B7E000-memory.dmpFilesize
16.6MB
-
memory/1244-92-0x0000000002AF0000-0x0000000003B7E000-memory.dmpFilesize
16.6MB
-
memory/1244-114-0x0000000002AF0000-0x0000000003B7E000-memory.dmpFilesize
16.6MB
-
memory/1244-115-0x0000000002AF0000-0x0000000003B7E000-memory.dmpFilesize
16.6MB
-
memory/2592-112-0x0000000000350000-0x0000000000352000-memory.dmpFilesize
8KB
-
memory/2592-110-0x0000000000380000-0x0000000000381000-memory.dmpFilesize
4KB
-
memory/2700-111-0x0000000000130000-0x0000000000132000-memory.dmpFilesize
8KB
-
memory/2700-104-0x0000000000210000-0x0000000000211000-memory.dmpFilesize
4KB