adf1be1107c4f4bfcdf77c2fc5009dfc0a7ae2bbda74b91860749fb8142fc198

Analysis

max time kernel
141s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-05-2024 14:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b39b194153df93d5666c7f40ee50430_NeikiAnalytics.exe
Size

71KB
MD5

5b39b194153df93d5666c7f40ee50430
SHA1

2af0ffbeae38d4ff6f1fbdc73c41f7cd4173f188
SHA256

adf1be1107c4f4bfcdf77c2fc5009dfc0a7ae2bbda74b91860749fb8142fc198
SHA512

8b1ee79f9f44a5705969df42645388fee2fe1cb8636447ac5851c91de0be82e58b183c4a701682e95f53a30a97e46eb7205be756a664c22d09bc39ce9420f408
SSDEEP

768:TrItKyw5WHXfQmjIiIk9ecAa0Mb96SyX1DLdRXXXE0006:Tr3Z5IfQmv81ar1yXtZI

Score

8^/10

evasion

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2760	attrib.exe

Deletes itself 1 IoCs

pid	Process
2700	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2856	zskhost.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Debug\zskhost.exe	5b39b194153df93d5666c7f40ee50430_NeikiAnalytics.exe
File opened for modification	C:\Windows\Debug\zskhost.exe	5b39b194153df93d5666c7f40ee50430_NeikiAnalytics.exe
File opened for modification	C:\Windows\Debug\zskhost.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1760	5b39b194153df93d5666c7f40ee50430_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2760	1760	5b39b194153df93d5666c7f40ee50430_NeikiAnalytics.exe	28
PID 1760 wrote to memory of 2760	1760	5b39b194153df93d5666c7f40ee50430_NeikiAnalytics.exe	28
PID 1760 wrote to memory of 2760	1760	5b39b194153df93d5666c7f40ee50430_NeikiAnalytics.exe	28
PID 1760 wrote to memory of 2760	1760	5b39b194153df93d5666c7f40ee50430_NeikiAnalytics.exe	28
PID 1760 wrote to memory of 2700	1760	5b39b194153df93d5666c7f40ee50430_NeikiAnalytics.exe	31
PID 1760 wrote to memory of 2700	1760	5b39b194153df93d5666c7f40ee50430_NeikiAnalytics.exe	31
PID 1760 wrote to memory of 2700	1760	5b39b194153df93d5666c7f40ee50430_NeikiAnalytics.exe	31
PID 1760 wrote to memory of 2700	1760	5b39b194153df93d5666c7f40ee50430_NeikiAnalytics.exe	31

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2760	attrib.exe

C:\Users\Admin\AppData\Local\Temp\5b39b194153df93d5666c7f40ee50430_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5b39b194153df93d5666c7f40ee50430_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\SysWOW64\attrib.exe
  attrib +a +s +h +r C:\Windows\Debug\zskhost.exe
  2⤵
  - Sets file to hidden
  - Drops file in Windows directory
  - Views/modifies file attributes
  PID:2760
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\5B39B1~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2700

C:\Windows\Debug\zskhost.exe
C:\Windows\Debug\zskhost.exe
1⤵
- Executes dropped EXE
PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\zskhost.exe

Filesize
71KB

MD5
93e70e217859104b3b48043dea3bda10

SHA1
f777436b54dfab4083a2603b13bdf0e0a802e785

SHA256
3686b6dbce19155bd2b0d010fcc3b1f690c50e99b92850947b5ca86d842a7cbd

SHA512
2a819ffbcb385672ec18ccb63032b07c80a085503964c6792654cee5857f208fa520eb71453228ad2b6a7ea36a62bc53db1000b2bbfb46733811e9b37253fc85

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads