Analysis
-
max time kernel
118s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 06:18
Static task
static1
Behavioral task
behavioral1
Sample
c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe
-
Size
97KB
-
MD5
c31aaf5a06d1f8743f767d86aa17f5b0
-
SHA1
12ae691074c721fc537314f954f98e58c3781a94
-
SHA256
41987d9da52b7990aba18c5eb4bfdfc56b54f020489af1da3e433b0d62bcc5e2
-
SHA512
7f459d2d3164ba93ecc96cf30d71d7a44b87e1641425b6ff8a29531920298aaa32daf21eb4c42806c53dc880a8e26a0f9fef9d2133b56d72c6dc89941c9903bf
-
SSDEEP
1536:01Jmj3upmh5geYjyXiVcuz2zw1ixNwCy064BLXCw/Q:0Oz3h5geYeXiVcuOw1cNwCCPG
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe -
Processes:
c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe -
Processes:
c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe -
Processes:
resource yara_rule behavioral1/memory/640-1-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/640-24-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/640-5-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/640-4-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/640-8-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/640-10-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/640-3-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/640-9-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/640-6-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/640-7-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/640-11-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/640-33-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/640-34-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/640-35-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/640-36-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/640-37-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/640-39-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/640-40-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/640-41-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/640-44-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/640-57-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/640-59-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/640-60-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/640-64-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/640-63-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/640-67-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/640-72-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/640-71-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/640-75-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/640-77-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/640-79-0x00000000006F0000-0x00000000017AA000-memory.dmp upx behavioral1/memory/640-102-0x00000000006F0000-0x00000000017AA000-memory.dmp upx -
Processes:
c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe -
Processes:
c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe -
Enumerates connected drives 3 TTPs 13 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exedescription ioc process File opened (read-only) \??\L: c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe File opened (read-only) \??\M: c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe File opened (read-only) \??\O: c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe File opened (read-only) \??\P: c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe File opened (read-only) \??\H: c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe File opened (read-only) \??\J: c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe File opened (read-only) \??\N: c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe File opened (read-only) \??\K: c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe File opened (read-only) \??\E: c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe File opened (read-only) \??\G: c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe File opened (read-only) \??\I: c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe File opened (read-only) \??\Q: c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe File opened (read-only) \??\R: c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe -
Drops file in Windows directory 2 IoCs
Processes:
c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exedescription ioc process File created C:\Windows\f769878 c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe File opened for modification C:\Windows\SYSTEM.INI c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exepid process 640 c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe 640 c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
Processes:
c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exedescription pid process Token: SeDebugPrivilege 640 c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe Token: SeDebugPrivilege 640 c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe Token: SeDebugPrivilege 640 c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe Token: SeDebugPrivilege 640 c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe Token: SeDebugPrivilege 640 c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe Token: SeDebugPrivilege 640 c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe Token: SeDebugPrivilege 640 c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe Token: SeDebugPrivilege 640 c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe Token: SeDebugPrivilege 640 c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe Token: SeDebugPrivilege 640 c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe Token: SeDebugPrivilege 640 c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe Token: SeDebugPrivilege 640 c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe Token: SeDebugPrivilege 640 c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe Token: SeDebugPrivilege 640 c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe Token: SeDebugPrivilege 640 c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe Token: SeDebugPrivilege 640 c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe Token: SeDebugPrivilege 640 c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe Token: SeDebugPrivilege 640 c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe Token: SeDebugPrivilege 640 c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe Token: SeDebugPrivilege 640 c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe Token: SeDebugPrivilege 640 c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exedescription pid process target process PID 640 wrote to memory of 1132 640 c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe taskhost.exe PID 640 wrote to memory of 1188 640 c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe Dwm.exe PID 640 wrote to memory of 1216 640 c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe Explorer.EXE PID 640 wrote to memory of 2316 640 c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe DllHost.exe PID 640 wrote to memory of 1132 640 c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe taskhost.exe PID 640 wrote to memory of 1188 640 c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe Dwm.exe PID 640 wrote to memory of 1216 640 c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe Explorer.EXE -
System policy modification 1 TTPs 1 IoCs
Processes:
c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1132
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1188
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\c31aaf5a06d1f8743f767d86aa17f5b0_NeikiAnalytics.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:640
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:2316
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5