Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
14/05/2024, 06:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
977bdcd67c21f9b9358f7d4adbcd2c80_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
977bdcd67c21f9b9358f7d4adbcd2c80_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 977bdcd67c21f9b9358f7d4adbcd2c80_NeikiAnalytics.exe
- Size 135KB
- Sample240514-hhf2ssed84
- SHA256 84923a51108f3556acb942ffa1b73b8677a84d6162f6a47dc25bee03d2e3ae19
- MD5 977bdcd67c21f9b9358f7d4adbcd2c80
- SHA1 d76d2dfcc7c6edfb17ca07b830d7c854cf7c3127
- SHA512 f6c413bfc88c2c0753c76812beaf98238837891d935da3166ca9f16ecde503fa0521de66fea084df5833298348a682fb24e231ac978db762179f88926c68b92d
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVT+0t8:UVqoCl/YgjxEufVU0TbTyDDal0S8
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Executes dropped EXE 4 IoCs
pid Process 4692 explorer.exe 1608 spoolsv.exe 3984 svchost.exe 2564 spoolsv.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Resources\tjud.exe explorer.exe File opened for modification \??\c:\windows\resources\themes\explorer.exe 977bdcd67c21f9b9358f7d4adbcd2c80_NeikiAnalytics.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3808 977bdcd67c21f9b9358f7d4adbcd2c80_NeikiAnalytics.exe 3808 977bdcd67c21f9b9358f7d4adbcd2c80_NeikiAnalytics.exe 3808 977bdcd67c21f9b9358f7d4adbcd2c80_NeikiAnalytics.exe 3808 977bdcd67c21f9b9358f7d4adbcd2c80_NeikiAnalytics.exe 3808 977bdcd67c21f9b9358f7d4adbcd2c80_NeikiAnalytics.exe 3808 977bdcd67c21f9b9358f7d4adbcd2c80_NeikiAnalytics.exe 3808 977bdcd67c21f9b9358f7d4adbcd2c80_NeikiAnalytics.exe 3808 977bdcd67c21f9b9358f7d4adbcd2c80_NeikiAnalytics.exe 3808 977bdcd67c21f9b9358f7d4adbcd2c80_NeikiAnalytics.exe 3808 977bdcd67c21f9b9358f7d4adbcd2c80_NeikiAnalytics.exe 3808 977bdcd67c21f9b9358f7d4adbcd2c80_NeikiAnalytics.exe 3808 977bdcd67c21f9b9358f7d4adbcd2c80_NeikiAnalytics.exe 3808 977bdcd67c21f9b9358f7d4adbcd2c80_NeikiAnalytics.exe 3808 977bdcd67c21f9b9358f7d4adbcd2c80_NeikiAnalytics.exe 3808 977bdcd67c21f9b9358f7d4adbcd2c80_NeikiAnalytics.exe 3808 977bdcd67c21f9b9358f7d4adbcd2c80_NeikiAnalytics.exe 3808 977bdcd67c21f9b9358f7d4adbcd2c80_NeikiAnalytics.exe 3808 977bdcd67c21f9b9358f7d4adbcd2c80_NeikiAnalytics.exe 3808 977bdcd67c21f9b9358f7d4adbcd2c80_NeikiAnalytics.exe 3808 977bdcd67c21f9b9358f7d4adbcd2c80_NeikiAnalytics.exe 3808 977bdcd67c21f9b9358f7d4adbcd2c80_NeikiAnalytics.exe 3808 977bdcd67c21f9b9358f7d4adbcd2c80_NeikiAnalytics.exe 3808 977bdcd67c21f9b9358f7d4adbcd2c80_NeikiAnalytics.exe 3808 977bdcd67c21f9b9358f7d4adbcd2c80_NeikiAnalytics.exe 3808 977bdcd67c21f9b9358f7d4adbcd2c80_NeikiAnalytics.exe 3808 977bdcd67c21f9b9358f7d4adbcd2c80_NeikiAnalytics.exe 3808 977bdcd67c21f9b9358f7d4adbcd2c80_NeikiAnalytics.exe 3808 977bdcd67c21f9b9358f7d4adbcd2c80_NeikiAnalytics.exe 3808 977bdcd67c21f9b9358f7d4adbcd2c80_NeikiAnalytics.exe 3808 977bdcd67c21f9b9358f7d4adbcd2c80_NeikiAnalytics.exe 3808 977bdcd67c21f9b9358f7d4adbcd2c80_NeikiAnalytics.exe 3808 977bdcd67c21f9b9358f7d4adbcd2c80_NeikiAnalytics.exe 3808 977bdcd67c21f9b9358f7d4adbcd2c80_NeikiAnalytics.exe 3808 977bdcd67c21f9b9358f7d4adbcd2c80_NeikiAnalytics.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe 4692 explorer.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4692 explorer.exe 3984 svchost.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 3808 977bdcd67c21f9b9358f7d4adbcd2c80_NeikiAnalytics.exe 3808 977bdcd67c21f9b9358f7d4adbcd2c80_NeikiAnalytics.exe 4692 explorer.exe 4692 explorer.exe 1608 spoolsv.exe 1608 spoolsv.exe 3984 svchost.exe 3984 svchost.exe 2564 spoolsv.exe 2564 spoolsv.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3808 wrote to memory of 4692 3808 977bdcd67c21f9b9358f7d4adbcd2c80_NeikiAnalytics.exe 84 PID 3808 wrote to memory of 4692 3808 977bdcd67c21f9b9358f7d4adbcd2c80_NeikiAnalytics.exe 84 PID 3808 wrote to memory of 4692 3808 977bdcd67c21f9b9358f7d4adbcd2c80_NeikiAnalytics.exe 84 PID 4692 wrote to memory of 1608 4692 explorer.exe 85 PID 4692 wrote to memory of 1608 4692 explorer.exe 85 PID 4692 wrote to memory of 1608 4692 explorer.exe 85 PID 1608 wrote to memory of 3984 1608 spoolsv.exe 86 PID 1608 wrote to memory of 3984 1608 spoolsv.exe 86 PID 1608 wrote to memory of 3984 1608 spoolsv.exe 86 PID 3984 wrote to memory of 2564 3984 svchost.exe 87 PID 3984 wrote to memory of 2564 3984 svchost.exe 87 PID 3984 wrote to memory of 2564 3984 svchost.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\977bdcd67c21f9b9358f7d4adbcd2c80_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\977bdcd67c21f9b9358f7d4adbcd2c80_NeikiAnalytics.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3808 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2564
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Resources\Themes\explorer.exe
- Size 135KB
- SHA256 e87085b787f6c22961fa7ca708fe7bd02865a7701da079bf930935364ccf9ba7
- MD5 274f3809df312f628103ccc5edc38651
- SHA1 01d21e5ebdff903d257624ce5b2f156cd2db23ec
- SHA512 819887582053051e27c9e4f84144f8b9ee376867fffcc9ac34acd54eb91cd8806020046e5a2c49ef31db1a59817663062056829e017277c9f0aeea970bbaf861
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVT+0tF:UVqoCl/YgjxEufVU0TbTyDDal0SF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Resources\spoolsv.exe
- Size 135KB
- SHA256 48bec2240fbd6863d81b45e873a670325f799ad42f709fbaf31b4deb17891cdc
- MD5 8fa50de2bf56158e7e2af9f4cd62b350
- SHA1 de0e467843f29735afee9801109e7b2776f9a8c8
- SHA512 8824a536e5dc99fc8e902517f1bbc06fe36dd597609d215e2641b543c8874d0c6559208046bbcd5b1d3da1ddac8c17b185c35e763b8f14e32c6ea5a6ccfe93ce
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVT+0tY:UVqoCl/YgjxEufVU0TbTyDDal0SY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Resources\svchost.exe
- Size 135KB
- SHA256 c2253b5c166d298afe21a3cb562b2fee0aed21f7074b058f22adcae4b16ad53f
- MD5 fe0560fd4202b532a52822a5f5c31132
- SHA1 f5c85e5ae1aec5fe5c39bce46e987c89fe04a8e3
- SHA512 d330499ca6366e7007368798b299c26d3b60c38e9376aa93e1570c89617b45e26702f8c06ab86be7d571145175b4dddaf74d74bdd7b35c31a36d25685b19347a
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVT+0tb:UVqoCl/YgjxEufVU0TbTyDDal0Sb
- MD5 SHA1 SHA512 SSDEEP