Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 06:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b3429ffc2662978de7693fe1c46c18f0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
b3429ffc2662978de7693fe1c46c18f0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
b3429ffc2662978de7693fe1c46c18f0_NeikiAnalytics.exe
-
Size
135KB
-
MD5
b3429ffc2662978de7693fe1c46c18f0
-
SHA1
596c9a0499e7adabef8976aa1ae76dc5332d7d5c
-
SHA256
c8ce4486ffba3657b75dd964a265c4b0945128de11059bd9462f3a1b2b84269e
-
SHA512
174395fb040412921a6ca900d416874524cc3fe01c71eb7850601f6a25955f90e19f484f6392327e9216c5dfa4e9c9d5989c13ecda5773f8b91682a96e451b7b
-
SSDEEP
1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVo+Wi:UVqoCl/YgjxEufVU0TbTyDDal0i
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
Executes dropped EXE 4 IoCs
pid Process 1592 explorer.exe 2596 spoolsv.exe 2760 svchost.exe 2620 spoolsv.exe -
Loads dropped DLL 4 IoCs
pid Process 1560 b3429ffc2662978de7693fe1c46c18f0_NeikiAnalytics.exe 1592 explorer.exe 2596 spoolsv.exe 2760 svchost.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe File opened for modification \??\c:\windows\resources\themes\explorer.exe b3429ffc2662978de7693fe1c46c18f0_NeikiAnalytics.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2656 schtasks.exe 1864 schtasks.exe 2372 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1560 b3429ffc2662978de7693fe1c46c18f0_NeikiAnalytics.exe 1560 b3429ffc2662978de7693fe1c46c18f0_NeikiAnalytics.exe 1560 b3429ffc2662978de7693fe1c46c18f0_NeikiAnalytics.exe 1560 b3429ffc2662978de7693fe1c46c18f0_NeikiAnalytics.exe 1560 b3429ffc2662978de7693fe1c46c18f0_NeikiAnalytics.exe 1560 b3429ffc2662978de7693fe1c46c18f0_NeikiAnalytics.exe 1560 b3429ffc2662978de7693fe1c46c18f0_NeikiAnalytics.exe 1560 b3429ffc2662978de7693fe1c46c18f0_NeikiAnalytics.exe 1560 b3429ffc2662978de7693fe1c46c18f0_NeikiAnalytics.exe 1560 b3429ffc2662978de7693fe1c46c18f0_NeikiAnalytics.exe 1560 b3429ffc2662978de7693fe1c46c18f0_NeikiAnalytics.exe 1560 b3429ffc2662978de7693fe1c46c18f0_NeikiAnalytics.exe 1560 b3429ffc2662978de7693fe1c46c18f0_NeikiAnalytics.exe 1560 b3429ffc2662978de7693fe1c46c18f0_NeikiAnalytics.exe 1560 b3429ffc2662978de7693fe1c46c18f0_NeikiAnalytics.exe 1560 b3429ffc2662978de7693fe1c46c18f0_NeikiAnalytics.exe 1560 b3429ffc2662978de7693fe1c46c18f0_NeikiAnalytics.exe 1592 explorer.exe 1592 explorer.exe 1592 explorer.exe 1592 explorer.exe 1592 explorer.exe 1592 explorer.exe 1592 explorer.exe 1592 explorer.exe 1592 explorer.exe 1592 explorer.exe 1592 explorer.exe 1592 explorer.exe 1592 explorer.exe 1592 explorer.exe 1592 explorer.exe 1592 explorer.exe 2760 svchost.exe 2760 svchost.exe 2760 svchost.exe 2760 svchost.exe 2760 svchost.exe 2760 svchost.exe 2760 svchost.exe 2760 svchost.exe 2760 svchost.exe 2760 svchost.exe 2760 svchost.exe 2760 svchost.exe 2760 svchost.exe 2760 svchost.exe 2760 svchost.exe 2760 svchost.exe 1592 explorer.exe 1592 explorer.exe 1592 explorer.exe 1592 explorer.exe 2760 svchost.exe 2760 svchost.exe 1592 explorer.exe 2760 svchost.exe 1592 explorer.exe 2760 svchost.exe 1592 explorer.exe 2760 svchost.exe 1592 explorer.exe 2760 svchost.exe 1592 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1592 explorer.exe 2760 svchost.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1560 b3429ffc2662978de7693fe1c46c18f0_NeikiAnalytics.exe 1560 b3429ffc2662978de7693fe1c46c18f0_NeikiAnalytics.exe 1592 explorer.exe 1592 explorer.exe 2596 spoolsv.exe 2596 spoolsv.exe 2760 svchost.exe 2760 svchost.exe 2620 spoolsv.exe 2620 spoolsv.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1560 wrote to memory of 1592 1560 b3429ffc2662978de7693fe1c46c18f0_NeikiAnalytics.exe 28 PID 1560 wrote to memory of 1592 1560 b3429ffc2662978de7693fe1c46c18f0_NeikiAnalytics.exe 28 PID 1560 wrote to memory of 1592 1560 b3429ffc2662978de7693fe1c46c18f0_NeikiAnalytics.exe 28 PID 1560 wrote to memory of 1592 1560 b3429ffc2662978de7693fe1c46c18f0_NeikiAnalytics.exe 28 PID 1592 wrote to memory of 2596 1592 explorer.exe 29 PID 1592 wrote to memory of 2596 1592 explorer.exe 29 PID 1592 wrote to memory of 2596 1592 explorer.exe 29 PID 1592 wrote to memory of 2596 1592 explorer.exe 29 PID 2596 wrote to memory of 2760 2596 spoolsv.exe 30 PID 2596 wrote to memory of 2760 2596 spoolsv.exe 30 PID 2596 wrote to memory of 2760 2596 spoolsv.exe 30 PID 2596 wrote to memory of 2760 2596 spoolsv.exe 30 PID 2760 wrote to memory of 2620 2760 svchost.exe 31 PID 2760 wrote to memory of 2620 2760 svchost.exe 31 PID 2760 wrote to memory of 2620 2760 svchost.exe 31 PID 2760 wrote to memory of 2620 2760 svchost.exe 31 PID 1592 wrote to memory of 1152 1592 explorer.exe 32 PID 1592 wrote to memory of 1152 1592 explorer.exe 32 PID 1592 wrote to memory of 1152 1592 explorer.exe 32 PID 1592 wrote to memory of 1152 1592 explorer.exe 32 PID 2760 wrote to memory of 2656 2760 svchost.exe 33 PID 2760 wrote to memory of 2656 2760 svchost.exe 33 PID 2760 wrote to memory of 2656 2760 svchost.exe 33 PID 2760 wrote to memory of 2656 2760 svchost.exe 33 PID 2760 wrote to memory of 1864 2760 svchost.exe 38 PID 2760 wrote to memory of 1864 2760 svchost.exe 38 PID 2760 wrote to memory of 1864 2760 svchost.exe 38 PID 2760 wrote to memory of 1864 2760 svchost.exe 38 PID 2760 wrote to memory of 2372 2760 svchost.exe 40 PID 2760 wrote to memory of 2372 2760 svchost.exe 40 PID 2760 wrote to memory of 2372 2760 svchost.exe 40 PID 2760 wrote to memory of 2372 2760 svchost.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\b3429ffc2662978de7693fe1c46c18f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b3429ffc2662978de7693fe1c46c18f0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2620
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 06:41 /f5⤵
- Creates scheduled task(s)
PID:2656
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 06:42 /f5⤵
- Creates scheduled task(s)
PID:1864
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 06:43 /f5⤵
- Creates scheduled task(s)
PID:2372
-
-
-
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe3⤵PID:1152
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135KB
MD553cf7cbc135c991351a5e43a32d40c78
SHA10ccaa7541235521a238c9fc295609542755f9798
SHA2562b270ed8c1c4e30c880656872d7c2ffb2a707212fd0448677243ea605a184e38
SHA51229246b9d865ad3c621e2ad46e8a8c4ffc0b8ec11b1c69461a8fc6ab962497d17d5b86fd7ee3993183370d23076e7f8e369d63c421a0407f9ec451a54d63a6639
-
Filesize
135KB
MD5c39cc081d0ff0d76b8ed66f4ea660686
SHA11ccb8e04620240f8c9e491f7138d126d7af0b61b
SHA256e6cf4066cf1614b29afcd031e7e8c739128389713fe7a2f98b7da6a0bb1fb2d8
SHA5121335236d62dbef5d307078b029640fde3a850c507d005b6e41f32cb6f9d3c4d1de45e9222e2475dd975d3dcc707a1c00893f27c75f8886812ce79bd974853885
-
Filesize
135KB
MD5c6ce83c38944db567381141102042675
SHA18363104f5902e663d09627a96992a2efc3af6ddb
SHA25638f800c286162760c24c13642d893f70a0b397d1ccdc28cccb59b5580ebe6331
SHA512c912e5d56ba0c1155a15e3c48b7b51f91cb67e341d8f2e41ddb84a5b52b036ffa43fc0dfd7b6ae45373ea908116d4465987ce4854c85aa2338721b7b3c53e43c