a15d9cf77dd16e16402df52f7930e066f2218104d7729f1e3bf2a92a2cf40309

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 09:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

50b5268a7e578bfe65cd509794b91f20_NEIKI.exe
Size

280KB
MD5

50b5268a7e578bfe65cd509794b91f20
SHA1

1c5936f1123830da1fce8e208d01100236ebcffe
SHA256

a15d9cf77dd16e16402df52f7930e066f2218104d7729f1e3bf2a92a2cf40309
SHA512

bccdefd22f68841c861286c882cced00fce2e1990b1ba167044b4316899c2874f782fb785445788cb369f7592176b332996255274e74b0a5092ad02f51e8ac7a
SSDEEP

6144:VTz+WrPFZvTXb4RyW42vFlOloh2E+7pYUozDK:VTBPFV0RyWl3h2E+7pl

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2636	taskhostsys.exe
2560	taskhostsys.exe

Loads dropped DLL 4 IoCs

pid	Process
2964	50b5268a7e578bfe65cd509794b91f20_NEIKI.exe
2964	50b5268a7e578bfe65cd509794b91f20_NEIKI.exe
2964	50b5268a7e578bfe65cd509794b91f20_NEIKI.exe
2636	taskhostsys.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe	50b5268a7e578bfe65cd509794b91f20_NEIKI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Posix\\taskhostsys.exe\" /START \"%1\" %*"	50b5268a7e578bfe65cd509794b91f20_NEIKI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jitc\shell\runas\command\IsolatedCommand = "\"%1\" %*"	50b5268a7e578bfe65cd509794b91f20_NEIKI.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\open\command	50b5268a7e578bfe65cd509794b91f20_NEIKI.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\runas\command	50b5268a7e578bfe65cd509794b91f20_NEIKI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	50b5268a7e578bfe65cd509794b91f20_NEIKI.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jitc\shell\open\command	50b5268a7e578bfe65cd509794b91f20_NEIKI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\Content-Type = "application/x-msdownload"	50b5268a7e578bfe65cd509794b91f20_NEIKI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	50b5268a7e578bfe65cd509794b91f20_NEIKI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jitc\Content-Type = "application/x-msdownload"	50b5268a7e578bfe65cd509794b91f20_NEIKI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jitc\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Posix\\taskhostsys.exe\" /START \"%1\" %*"	50b5268a7e578bfe65cd509794b91f20_NEIKI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jitc\shell\open\command\IsolatedCommand = "\"%1\" %*"	50b5268a7e578bfe65cd509794b91f20_NEIKI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jitc\shell\runas\command\ = "\"%1\" %*"	50b5268a7e578bfe65cd509794b91f20_NEIKI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\ = "jitc"	50b5268a7e578bfe65cd509794b91f20_NEIKI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\DefaultIcon\ = "%1"	50b5268a7e578bfe65cd509794b91f20_NEIKI.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell	50b5268a7e578bfe65cd509794b91f20_NEIKI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jitc\ = "Application"	50b5268a7e578bfe65cd509794b91f20_NEIKI.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jitc\DefaultIcon	50b5268a7e578bfe65cd509794b91f20_NEIKI.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\DefaultIcon	50b5268a7e578bfe65cd509794b91f20_NEIKI.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\runas	50b5268a7e578bfe65cd509794b91f20_NEIKI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jitc\DefaultIcon\ = "%1"	50b5268a7e578bfe65cd509794b91f20_NEIKI.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jitc\shell	50b5268a7e578bfe65cd509794b91f20_NEIKI.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jitc\shell\runas\command	50b5268a7e578bfe65cd509794b91f20_NEIKI.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jitc\shell\runas	50b5268a7e578bfe65cd509794b91f20_NEIKI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*"	50b5268a7e578bfe65cd509794b91f20_NEIKI.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jitc	50b5268a7e578bfe65cd509794b91f20_NEIKI.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jitc\shell\open	50b5268a7e578bfe65cd509794b91f20_NEIKI.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.exe\shell\open	50b5268a7e578bfe65cd509794b91f20_NEIKI.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2636	taskhostsys.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2636	2964	50b5268a7e578bfe65cd509794b91f20_NEIKI.exe	28
PID 2964 wrote to memory of 2636	2964	50b5268a7e578bfe65cd509794b91f20_NEIKI.exe	28
PID 2964 wrote to memory of 2636	2964	50b5268a7e578bfe65cd509794b91f20_NEIKI.exe	28
PID 2964 wrote to memory of 2636	2964	50b5268a7e578bfe65cd509794b91f20_NEIKI.exe	28
PID 2636 wrote to memory of 2560	2636	taskhostsys.exe	29
PID 2636 wrote to memory of 2560	2636	taskhostsys.exe	29
PID 2636 wrote to memory of 2560	2636	taskhostsys.exe	29
PID 2636 wrote to memory of 2560	2636	taskhostsys.exe	29

C:\Users\Admin\AppData\Local\Temp\50b5268a7e578bfe65cd509794b91f20_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\50b5268a7e578bfe65cd509794b91f20_NEIKI.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Users\Admin\AppData\Roaming\Microsoft\Posix\taskhostsys.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\taskhostsys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\taskhostsys.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Users\Admin\AppData\Roaming\Microsoft\Posix\taskhostsys.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\taskhostsys.exe"
    3⤵
    - Executes dropped EXE
    PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Microsoft\Posix\taskhostsys.exe

Filesize
280KB

MD5
1cf9b2207561656829078f9cdb700129

SHA1
20925c26caeb9df9e5f3c6fd9465d5177603a95d

SHA256
520fa2458a6e62a4da1fc4a542fd4ab385fb2100dc6538d4b4a9c90aecdd87c7

SHA512
482df079c24d07843f97cf6458d4ae4917251e20f2c0c2b40494d375af8b2a3364411962386abe6220f2336afb64c625ebd6e75e80253e6c34723921b544a0ae

Download Submit