Analysis
-
max time kernel
104s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08-05-2024 05:11
Behavioral task
behavioral1
Sample
ddb3b2837980862d7962172bc89c24f0_NEIKI.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
General
-
Target
ddb3b2837980862d7962172bc89c24f0_NEIKI.exe
-
Size
347KB
-
MD5
ddb3b2837980862d7962172bc89c24f0
-
SHA1
96746c72536004f31f11ed1cb0ca3bf248c61952
-
SHA256
5109349d132fa0f5747e48f6fdcd412c69f1cf675fec88e19e74ad9755922b80
-
SHA512
5dd8398463fbc3087a459afc539b842287798dde9f9ddef067c2052cca91ce43d64b03d6e5e9a4c1d08c77f455ac630140309aadbad468fe73f9865d7341c63a
-
SSDEEP
6144:8uIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLqIYhuIlWqB+E:X6Wq4aaE6KwyF5L0Y2D1PqLb6Wq4E
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe -
Executes dropped EXE 1 IoCs
pid Process 2276 svhost.exe -
resource yara_rule behavioral1/memory/2936-0-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral1/files/0x000b0000000155e2-5.dat upx behavioral1/files/0x0007000000015c69-65.dat upx behavioral1/memory/2936-608-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral1/memory/2276-2629-0x0000000000400000-0x0000000000523000-memory.dmp upx -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\x: svhost.exe File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\q: svhost.exe File opened (read-only) \??\v: svhost.exe File opened (read-only) \??\y: svhost.exe File opened (read-only) \??\b: svhost.exe File opened (read-only) \??\e: svhost.exe File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\j: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\s: svhost.exe File opened (read-only) \??\t: svhost.exe File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\w: svhost.exe File opened (read-only) \??\z: svhost.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2936-608-0x0000000000400000-0x0000000000523000-memory.dmp autoit_exe behavioral1/memory/2276-2629-0x0000000000400000-0x0000000000523000-memory.dmp autoit_exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\svhost.exe ddb3b2837980862d7962172bc89c24f0_NEIKI.exe File opened for modification C:\Windows\Driver.db svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2936 ddb3b2837980862d7962172bc89c24f0_NEIKI.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2276 svhost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2936 ddb3b2837980862d7962172bc89c24f0_NEIKI.exe 2936 ddb3b2837980862d7962172bc89c24f0_NEIKI.exe 2276 svhost.exe 2276 svhost.exe 2936 ddb3b2837980862d7962172bc89c24f0_NEIKI.exe 2276 svhost.exe 2936 ddb3b2837980862d7962172bc89c24f0_NEIKI.exe 2276 svhost.exe 2936 ddb3b2837980862d7962172bc89c24f0_NEIKI.exe 2276 svhost.exe 2936 ddb3b2837980862d7962172bc89c24f0_NEIKI.exe 2276 svhost.exe 2936 ddb3b2837980862d7962172bc89c24f0_NEIKI.exe 2276 svhost.exe 2936 ddb3b2837980862d7962172bc89c24f0_NEIKI.exe 2276 svhost.exe 2936 ddb3b2837980862d7962172bc89c24f0_NEIKI.exe 2276 svhost.exe 2936 ddb3b2837980862d7962172bc89c24f0_NEIKI.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2936 ddb3b2837980862d7962172bc89c24f0_NEIKI.exe 2936 ddb3b2837980862d7962172bc89c24f0_NEIKI.exe 2276 svhost.exe 2276 svhost.exe 2936 ddb3b2837980862d7962172bc89c24f0_NEIKI.exe 2276 svhost.exe 2936 ddb3b2837980862d7962172bc89c24f0_NEIKI.exe 2276 svhost.exe 2936 ddb3b2837980862d7962172bc89c24f0_NEIKI.exe 2276 svhost.exe 2936 ddb3b2837980862d7962172bc89c24f0_NEIKI.exe 2276 svhost.exe 2936 ddb3b2837980862d7962172bc89c24f0_NEIKI.exe 2276 svhost.exe 2936 ddb3b2837980862d7962172bc89c24f0_NEIKI.exe 2276 svhost.exe 2936 ddb3b2837980862d7962172bc89c24f0_NEIKI.exe 2276 svhost.exe 2936 ddb3b2837980862d7962172bc89c24f0_NEIKI.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe 2276 svhost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2936 wrote to memory of 2276 2936 ddb3b2837980862d7962172bc89c24f0_NEIKI.exe 28 PID 2936 wrote to memory of 2276 2936 ddb3b2837980862d7962172bc89c24f0_NEIKI.exe 28 PID 2936 wrote to memory of 2276 2936 ddb3b2837980862d7962172bc89c24f0_NEIKI.exe 28 PID 2936 wrote to memory of 2276 2936 ddb3b2837980862d7962172bc89c24f0_NEIKI.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\ddb3b2837980862d7962172bc89c24f0_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\ddb3b2837980862d7962172bc89c24f0_NEIKI.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2276
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
347KB
MD5037c9be2b7feb838aba6e7626582ce7a
SHA1382416cf277425ae2d55a233b3609e69be8e4105
SHA25662fc18c8cd4c2234f4a848a608b85a5024a7f4767b7b6fbf2b9aee251fa4af38
SHA512410b385d0f0f77ddd8529ac0382722abbd45d02c54fe7acfab15ce7284733246bddfca8d13b99d660d1f38e91831f156bfe811f975183aa7a73513ccfa6e4646
-
Filesize
82B
MD5c2d2dc50dca8a2bfdc8e2d59dfa5796d
SHA17a6150fc53244e28d1bcea437c0c9d276c41ccad
SHA256b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
SHA5126cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
-
Filesize
347KB
MD5f8c284b74671c03f72c7ad75aa77320d
SHA1eec3e5e4009d7b62d692dd028fb2b0dea16d79ec
SHA256183c93a15b6923a2e616aa12aafd0dbc7c861ad98b517917cf83d9875324b002
SHA5120ebc04a6be6c08f8870864b64c294b59b15db04c23bb5ce78bb20cdc4d57563a71e05d813330025e1c1c8f1c59bb51999767a3301bf2d371a80bd84fecbd4911