Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
12/05/2024, 16:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
31f77d9a0b703324a0e5c8093c9cdc00_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
31f77d9a0b703324a0e5c8093c9cdc00_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
31f77d9a0b703324a0e5c8093c9cdc00_NeikiAnalytics.exe
-
Size
206KB
-
MD5
31f77d9a0b703324a0e5c8093c9cdc00
-
SHA1
1dac2970c8f9849826d71ec469393a4ed68c9ab6
-
SHA256
ef28f6d7757251c1a7713b1458097478a3203d0b2be7a01ecc9697e9a814e23b
-
SHA512
4d9efb6f45ecd6a1757271f4c10f48af1cf85eaab803624cb4056043e0aa5453714381061965b93879a36b73691011d2cac21cc7bbc606c071563e8fa350e698
-
SSDEEP
6144:GsLqdufVUNDaqRs////////////////////////////////////////////////4:5FUNDaqm///////////////////////A
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
Executes dropped EXE 4 IoCs
pid Process 3056 explorer.exe 2596 spoolsv.exe 2732 svchost.exe 2480 spoolsv.exe -
Loads dropped DLL 8 IoCs
pid Process 2460 31f77d9a0b703324a0e5c8093c9cdc00_NeikiAnalytics.exe 2460 31f77d9a0b703324a0e5c8093c9cdc00_NeikiAnalytics.exe 3056 explorer.exe 3056 explorer.exe 2596 spoolsv.exe 2596 spoolsv.exe 2732 svchost.exe 2732 svchost.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\themes\explorer.exe 31f77d9a0b703324a0e5c8093c9cdc00_NeikiAnalytics.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 540 schtasks.exe 2388 schtasks.exe 2316 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2460 31f77d9a0b703324a0e5c8093c9cdc00_NeikiAnalytics.exe 2460 31f77d9a0b703324a0e5c8093c9cdc00_NeikiAnalytics.exe 2460 31f77d9a0b703324a0e5c8093c9cdc00_NeikiAnalytics.exe 2460 31f77d9a0b703324a0e5c8093c9cdc00_NeikiAnalytics.exe 2460 31f77d9a0b703324a0e5c8093c9cdc00_NeikiAnalytics.exe 2460 31f77d9a0b703324a0e5c8093c9cdc00_NeikiAnalytics.exe 2460 31f77d9a0b703324a0e5c8093c9cdc00_NeikiAnalytics.exe 2460 31f77d9a0b703324a0e5c8093c9cdc00_NeikiAnalytics.exe 2460 31f77d9a0b703324a0e5c8093c9cdc00_NeikiAnalytics.exe 2460 31f77d9a0b703324a0e5c8093c9cdc00_NeikiAnalytics.exe 2460 31f77d9a0b703324a0e5c8093c9cdc00_NeikiAnalytics.exe 2460 31f77d9a0b703324a0e5c8093c9cdc00_NeikiAnalytics.exe 2460 31f77d9a0b703324a0e5c8093c9cdc00_NeikiAnalytics.exe 2460 31f77d9a0b703324a0e5c8093c9cdc00_NeikiAnalytics.exe 2460 31f77d9a0b703324a0e5c8093c9cdc00_NeikiAnalytics.exe 2460 31f77d9a0b703324a0e5c8093c9cdc00_NeikiAnalytics.exe 2460 31f77d9a0b703324a0e5c8093c9cdc00_NeikiAnalytics.exe 3056 explorer.exe 3056 explorer.exe 3056 explorer.exe 3056 explorer.exe 3056 explorer.exe 3056 explorer.exe 3056 explorer.exe 3056 explorer.exe 3056 explorer.exe 3056 explorer.exe 3056 explorer.exe 3056 explorer.exe 3056 explorer.exe 3056 explorer.exe 3056 explorer.exe 3056 explorer.exe 2732 svchost.exe 2732 svchost.exe 2732 svchost.exe 2732 svchost.exe 2732 svchost.exe 2732 svchost.exe 2732 svchost.exe 2732 svchost.exe 2732 svchost.exe 2732 svchost.exe 2732 svchost.exe 2732 svchost.exe 2732 svchost.exe 2732 svchost.exe 2732 svchost.exe 2732 svchost.exe 3056 explorer.exe 3056 explorer.exe 3056 explorer.exe 3056 explorer.exe 2732 svchost.exe 2732 svchost.exe 3056 explorer.exe 2732 svchost.exe 3056 explorer.exe 2732 svchost.exe 3056 explorer.exe 2732 svchost.exe 3056 explorer.exe 2732 svchost.exe 3056 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 3056 explorer.exe 2732 svchost.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 2460 31f77d9a0b703324a0e5c8093c9cdc00_NeikiAnalytics.exe 2460 31f77d9a0b703324a0e5c8093c9cdc00_NeikiAnalytics.exe 3056 explorer.exe 3056 explorer.exe 2596 spoolsv.exe 2596 spoolsv.exe 2732 svchost.exe 2732 svchost.exe 2480 spoolsv.exe 2480 spoolsv.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2460 wrote to memory of 3056 2460 31f77d9a0b703324a0e5c8093c9cdc00_NeikiAnalytics.exe 28 PID 2460 wrote to memory of 3056 2460 31f77d9a0b703324a0e5c8093c9cdc00_NeikiAnalytics.exe 28 PID 2460 wrote to memory of 3056 2460 31f77d9a0b703324a0e5c8093c9cdc00_NeikiAnalytics.exe 28 PID 2460 wrote to memory of 3056 2460 31f77d9a0b703324a0e5c8093c9cdc00_NeikiAnalytics.exe 28 PID 3056 wrote to memory of 2596 3056 explorer.exe 29 PID 3056 wrote to memory of 2596 3056 explorer.exe 29 PID 3056 wrote to memory of 2596 3056 explorer.exe 29 PID 3056 wrote to memory of 2596 3056 explorer.exe 29 PID 2596 wrote to memory of 2732 2596 spoolsv.exe 30 PID 2596 wrote to memory of 2732 2596 spoolsv.exe 30 PID 2596 wrote to memory of 2732 2596 spoolsv.exe 30 PID 2596 wrote to memory of 2732 2596 spoolsv.exe 30 PID 2732 wrote to memory of 2480 2732 svchost.exe 31 PID 2732 wrote to memory of 2480 2732 svchost.exe 31 PID 2732 wrote to memory of 2480 2732 svchost.exe 31 PID 2732 wrote to memory of 2480 2732 svchost.exe 31 PID 3056 wrote to memory of 2492 3056 explorer.exe 32 PID 3056 wrote to memory of 2492 3056 explorer.exe 32 PID 3056 wrote to memory of 2492 3056 explorer.exe 32 PID 3056 wrote to memory of 2492 3056 explorer.exe 32 PID 2732 wrote to memory of 2388 2732 svchost.exe 33 PID 2732 wrote to memory of 2388 2732 svchost.exe 33 PID 2732 wrote to memory of 2388 2732 svchost.exe 33 PID 2732 wrote to memory of 2388 2732 svchost.exe 33 PID 2732 wrote to memory of 2316 2732 svchost.exe 38 PID 2732 wrote to memory of 2316 2732 svchost.exe 38 PID 2732 wrote to memory of 2316 2732 svchost.exe 38 PID 2732 wrote to memory of 2316 2732 svchost.exe 38 PID 2732 wrote to memory of 540 2732 svchost.exe 40 PID 2732 wrote to memory of 540 2732 svchost.exe 40 PID 2732 wrote to memory of 540 2732 svchost.exe 40 PID 2732 wrote to memory of 540 2732 svchost.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\31f77d9a0b703324a0e5c8093c9cdc00_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\31f77d9a0b703324a0e5c8093c9cdc00_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2480
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 17:01 /f5⤵
- Creates scheduled task(s)
PID:2388
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 17:02 /f5⤵
- Creates scheduled task(s)
PID:2316
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 17:03 /f5⤵
- Creates scheduled task(s)
PID:540
-
-
-
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe3⤵PID:2492
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
207KB
MD59620b96f201351e0cb4c7e6a6a144c8d
SHA1a7186ddd9aa54d82f513d43334b4e92cdf5773d7
SHA2568a29417f388f345bfa2c10cc7c0e839008446cf005d0cb47f4c55569429da4db
SHA512215bb96a0d8171b3bc8bceb5d1dcbf3eaf64ac5699e5f5a1d05e8c55ccb6708c19eb1713d6127ac1dfd8e44d4e48e3ad440287ca18c13897b857cc2bab5f3317
-
Filesize
206KB
MD5dc639b4ec21a6f70e6828e3da3e5e126
SHA1f2766966656d245aff8bbf8a304b39df7b6d98a3
SHA256c09019d662558ba8832f776ed994382c7b15ec8483f549f87645d42b452a110b
SHA512261851a5e2d4ed5d8c8c1a974971d78c8231a160c8bc7f8f1e851a815a72746958970f8e623512d5285208c7f3de276af228b561047941de9922bc71f826e8e8
-
Filesize
206KB
MD57ead4eaf7d43ba2447ad96863e86fd5f
SHA10205bfdaeeff8ec9b68ab53afc451ba012adffd1
SHA25678a7acd711bc354cab3bf265c80dbfd14b476a73522908005890efa0ec10f172
SHA51227c4c0da31c820d299fb4a3832ef25f3a411dee9c3abdc4088c45679f10d185711f60261dd998aea2b6e4a126ad472824b7206bd3ab17135159a7a20a959b95f