d6ccbce67b074abd62eff688ce6f8406daecb7e3cbc439a66e53d133119a3cd3

Analysis

max time kernel
141s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 04:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

79a14ce255371769495020ff40fb4f60_NeikiAnalytics.exe
Size

71KB
MD5

79a14ce255371769495020ff40fb4f60
SHA1

5c07f5408bb2ea53bce16e6ab5a0eacc8ed82b1b
SHA256

d6ccbce67b074abd62eff688ce6f8406daecb7e3cbc439a66e53d133119a3cd3
SHA512

352cfcac347d668678fdfa08697546d5bf53a4faf03fc6ab47184d3fa7e7c9d1fb442577b81d9d686d86310ef69b99822816daef1d7b0f11f71355c5c9be7b7f
SSDEEP

1536:Or3Z5IfQmv81abyyXcZibfffsffffeIIIp:SJOfQm010yyXcZ2IIIp

Score

8^/10

evasion

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2104	attrib.exe

Deletes itself 1 IoCs

pid	Process
2524	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2588	jaohost.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Debug\jaohost.exe	79a14ce255371769495020ff40fb4f60_NeikiAnalytics.exe
File opened for modification	C:\Windows\Debug\jaohost.exe	79a14ce255371769495020ff40fb4f60_NeikiAnalytics.exe
File opened for modification	C:\Windows\Debug\jaohost.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1740	79a14ce255371769495020ff40fb4f60_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2104	1740	79a14ce255371769495020ff40fb4f60_NeikiAnalytics.exe	28
PID 1740 wrote to memory of 2104	1740	79a14ce255371769495020ff40fb4f60_NeikiAnalytics.exe	28
PID 1740 wrote to memory of 2104	1740	79a14ce255371769495020ff40fb4f60_NeikiAnalytics.exe	28
PID 1740 wrote to memory of 2104	1740	79a14ce255371769495020ff40fb4f60_NeikiAnalytics.exe	28
PID 1740 wrote to memory of 2524	1740	79a14ce255371769495020ff40fb4f60_NeikiAnalytics.exe	31
PID 1740 wrote to memory of 2524	1740	79a14ce255371769495020ff40fb4f60_NeikiAnalytics.exe	31
PID 1740 wrote to memory of 2524	1740	79a14ce255371769495020ff40fb4f60_NeikiAnalytics.exe	31
PID 1740 wrote to memory of 2524	1740	79a14ce255371769495020ff40fb4f60_NeikiAnalytics.exe	31

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2104	attrib.exe

C:\Users\Admin\AppData\Local\Temp\79a14ce255371769495020ff40fb4f60_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\79a14ce255371769495020ff40fb4f60_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\SysWOW64\attrib.exe
  attrib +a +s +h +r C:\Windows\Debug\jaohost.exe
  2⤵
  - Sets file to hidden
  - Drops file in Windows directory
  - Views/modifies file attributes
  PID:2104
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\79A14C~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2524

C:\Windows\Debug\jaohost.exe
C:\Windows\Debug\jaohost.exe
1⤵
- Executes dropped EXE
PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\jaohost.exe

Filesize
71KB

MD5
57f5efee005f8a45b5e47427366dd827

SHA1
407a1f4320a507032cca2125ef202d3de511644c

SHA256
cb4fd5acfffe038599f034e8293a168ac0787581b21e5c49814a41f27badc365

SHA512
eaf444203dee92fa5646c6fc20b024781dc8e3f85e5f8150892a514c9af161b7ffa7d66e5b2de52e11f5544052f218ec4b8695c73c214ac8fc046f8eee350dc9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads