Analysis
-
max time kernel
140s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 11:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f32b4873dcd3002586548a9c1ed54910_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
f32b4873dcd3002586548a9c1ed54910_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
f32b4873dcd3002586548a9c1ed54910_NeikiAnalytics.exe
-
Size
995KB
-
MD5
f32b4873dcd3002586548a9c1ed54910
-
SHA1
b281f8ba00faf3cb72a2aaf3230721164f115df4
-
SHA256
27b92ce92445bba46c554eb898f263e4737ace3465badc6e380fe8a9cfcfcea2
-
SHA512
f196e5556ee54ba8f7ee3d73096f9a87d0a01e9607c9141d5856f2ac3573dd9dfc74e1ae2e7751af6bc0ab0ecbf8c96c95b353a572e63884b161c8d17eaaf8a0
-
SSDEEP
12288:Wh3ZukLF5fRY5a/6GX4D1DwhHd1zre/9CL7ztjfiVuNcmb60phKwBm3Nz7Ms:WhMkxlRSaiPDi3qs3J4uNcmb607P4zws
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation f32b4873dcd3002586548a9c1ed54910_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation acrotray.exe Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation acrotray .exe -
Executes dropped EXE 4 IoCs
pid Process 3872 acrotray.exe 3876 acrotray.exe 4616 acrotray .exe 4756 acrotray .exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe_Reader = "C:\\Program Files (x86)\\Adobe\\acrotray.exe" f32b4873dcd3002586548a9c1ed54910_NeikiAnalytics.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\acrotray.exe f32b4873dcd3002586548a9c1ed54910_NeikiAnalytics.exe File created \??\c:\program files (x86)\common files\java\java update\jusched.exe f32b4873dcd3002586548a9c1ed54910_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\acrotray .exe f32b4873dcd3002586548a9c1ed54910_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4107876999" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000150dfb3d7d297149b53fa5015b24f844000000000200000000001066000000010000200000007bc0202f6be7390f47b44b775dabd4e83da540075cf7c27ea542c275ec22d291000000000e8000000002000020000000e4a2fc1bf1960181c152f6d4ab5080ffc596aa53c53365a98bda405296c79d4c20000000733c7be00e4592966fbda5e8cd5f6b112339d31f661a6bed59e132d5ff7e53754000000084db2f862cc60503a62cca1ebcc6b5d00575b51dc9d36a81d5f038841b50cc3328a1642283727fbea6b0328c2d293dadb58e6545bb3a494e258e2cf0d5c645b5 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000150dfb3d7d297149b53fa5015b24f844000000000200000000001066000000010000200000008ba14907a79a0cd62dee4c1e465ce154a171f2501ca7e0cba6aea3e26ab5aa40000000000e80000000020000200000000745888b734359273e0968fde29a33ab225dbd9a8bda03f0b205de041c6c0dda2000000047e2827b7b890b1eb6f75395a6e2719f2c198d89632be752aa6fcc3b0b1bb93440000000643de8ca5891bb1a00d788d7ff235f56af454bbe663c66dacb7644c455c32695ad7bac768a82f88cf9574cac24821c2b913752eca807770967f8f1dadc31facf iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4107876999" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{2063C2F2-169B-11EF-B865-FEEB313629C0} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31107751" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0afd7f3a7aada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80e4defba7aada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31107751" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff5800000000000000de04000065020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2796 f32b4873dcd3002586548a9c1ed54910_NeikiAnalytics.exe 2796 f32b4873dcd3002586548a9c1ed54910_NeikiAnalytics.exe 2796 f32b4873dcd3002586548a9c1ed54910_NeikiAnalytics.exe 2796 f32b4873dcd3002586548a9c1ed54910_NeikiAnalytics.exe 2796 f32b4873dcd3002586548a9c1ed54910_NeikiAnalytics.exe 2796 f32b4873dcd3002586548a9c1ed54910_NeikiAnalytics.exe 3028 f32b4873dcd3002586548a9c1ed54910_neikianalytics.exe 3028 f32b4873dcd3002586548a9c1ed54910_neikianalytics.exe 3028 f32b4873dcd3002586548a9c1ed54910_neikianalytics.exe 3028 f32b4873dcd3002586548a9c1ed54910_neikianalytics.exe 3872 acrotray.exe 3872 acrotray.exe 3872 acrotray.exe 3872 acrotray.exe 3872 acrotray.exe 3872 acrotray.exe 3876 acrotray.exe 3876 acrotray.exe 3876 acrotray.exe 3876 acrotray.exe 4616 acrotray .exe 4616 acrotray .exe 4616 acrotray .exe 4616 acrotray .exe 4616 acrotray .exe 4616 acrotray .exe 4756 acrotray .exe 4756 acrotray .exe 4756 acrotray .exe 4756 acrotray .exe 3028 f32b4873dcd3002586548a9c1ed54910_neikianalytics.exe 3028 f32b4873dcd3002586548a9c1ed54910_neikianalytics.exe 3876 acrotray.exe 3876 acrotray.exe 4756 acrotray .exe 4756 acrotray .exe 3028 f32b4873dcd3002586548a9c1ed54910_neikianalytics.exe 3028 f32b4873dcd3002586548a9c1ed54910_neikianalytics.exe 3876 acrotray.exe 3876 acrotray.exe 4756 acrotray .exe 4756 acrotray .exe 3028 f32b4873dcd3002586548a9c1ed54910_neikianalytics.exe 3028 f32b4873dcd3002586548a9c1ed54910_neikianalytics.exe 3876 acrotray.exe 3876 acrotray.exe 4756 acrotray .exe 4756 acrotray .exe 3028 f32b4873dcd3002586548a9c1ed54910_neikianalytics.exe 3028 f32b4873dcd3002586548a9c1ed54910_neikianalytics.exe 3876 acrotray.exe 3876 acrotray.exe 4756 acrotray .exe 4756 acrotray .exe 3028 f32b4873dcd3002586548a9c1ed54910_neikianalytics.exe 3028 f32b4873dcd3002586548a9c1ed54910_neikianalytics.exe 3876 acrotray.exe 3876 acrotray.exe 4756 acrotray .exe 4756 acrotray .exe 3028 f32b4873dcd3002586548a9c1ed54910_neikianalytics.exe 3028 f32b4873dcd3002586548a9c1ed54910_neikianalytics.exe 3876 acrotray.exe 3876 acrotray.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2796 f32b4873dcd3002586548a9c1ed54910_NeikiAnalytics.exe Token: SeDebugPrivilege 3028 f32b4873dcd3002586548a9c1ed54910_neikianalytics.exe Token: SeDebugPrivilege 3872 acrotray.exe Token: SeDebugPrivilege 3876 acrotray.exe Token: SeDebugPrivilege 4616 acrotray .exe Token: SeDebugPrivilege 4756 acrotray .exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 424 iexplore.exe 424 iexplore.exe 424 iexplore.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 424 iexplore.exe 424 iexplore.exe 3440 IEXPLORE.EXE 3440 IEXPLORE.EXE 424 iexplore.exe 424 iexplore.exe 4512 IEXPLORE.EXE 4512 IEXPLORE.EXE 424 iexplore.exe 424 iexplore.exe 4744 IEXPLORE.EXE 4744 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2796 wrote to memory of 3028 2796 f32b4873dcd3002586548a9c1ed54910_NeikiAnalytics.exe 85 PID 2796 wrote to memory of 3028 2796 f32b4873dcd3002586548a9c1ed54910_NeikiAnalytics.exe 85 PID 2796 wrote to memory of 3028 2796 f32b4873dcd3002586548a9c1ed54910_NeikiAnalytics.exe 85 PID 2796 wrote to memory of 3872 2796 f32b4873dcd3002586548a9c1ed54910_NeikiAnalytics.exe 100 PID 2796 wrote to memory of 3872 2796 f32b4873dcd3002586548a9c1ed54910_NeikiAnalytics.exe 100 PID 2796 wrote to memory of 3872 2796 f32b4873dcd3002586548a9c1ed54910_NeikiAnalytics.exe 100 PID 424 wrote to memory of 3440 424 iexplore.exe 103 PID 424 wrote to memory of 3440 424 iexplore.exe 103 PID 424 wrote to memory of 3440 424 iexplore.exe 103 PID 3872 wrote to memory of 3876 3872 acrotray.exe 104 PID 3872 wrote to memory of 3876 3872 acrotray.exe 104 PID 3872 wrote to memory of 3876 3872 acrotray.exe 104 PID 3872 wrote to memory of 4616 3872 acrotray.exe 105 PID 3872 wrote to memory of 4616 3872 acrotray.exe 105 PID 3872 wrote to memory of 4616 3872 acrotray.exe 105 PID 4616 wrote to memory of 4756 4616 acrotray .exe 106 PID 4616 wrote to memory of 4756 4616 acrotray .exe 106 PID 4616 wrote to memory of 4756 4616 acrotray .exe 106 PID 424 wrote to memory of 4512 424 iexplore.exe 109 PID 424 wrote to memory of 4512 424 iexplore.exe 109 PID 424 wrote to memory of 4512 424 iexplore.exe 109 PID 424 wrote to memory of 4744 424 iexplore.exe 110 PID 424 wrote to memory of 4744 424 iexplore.exe 110 PID 424 wrote to memory of 4744 424 iexplore.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\f32b4873dcd3002586548a9c1ed54910_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\f32b4873dcd3002586548a9c1ed54910_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\f32b4873dcd3002586548a9c1ed54910_neikianalytics.exe"C:\Users\Admin\AppData\Local\Temp\f32b4873dcd3002586548a9c1ed54910_neikianalytics.exe" C:\Users\Admin\AppData\Local\Temp\f32b4873dcd3002586548a9c1ed54910_NeikiAnalytics.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3028
-
-
C:\Program Files (x86)\Adobe\acrotray.exe"C:\Program Files (x86)\Adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\f32b4873dcd3002586548a9c1ed54910_NeikiAnalytics.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Program Files (x86)\Adobe\acrotray.exe"C:\Program Files (x86)\Adobe\acrotray.exe" C:\Program Files (x86)\Adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\f32b4873dcd3002586548a9c1ed54910_NeikiAnalytics.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3876
-
-
C:\Program Files (x86)\Adobe\acrotray .exe"C:\Program Files (x86)\Adobe\acrotray .exe" C:\Program Files (x86)\Adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\f32b4873dcd3002586548a9c1ed54910_NeikiAnalytics.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Program Files (x86)\Adobe\acrotray .exe"C:\Program Files (x86)\Adobe\acrotray .exe" C:\Program Files (x86)\Adobe\acrotray .exe" C:\Program Files (x86)\Adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\f32b4873dcd3002586548a9c1ed54910_NeikiAnalytics.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4756
-
-
-
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵PID:3224
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:424 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:424 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3440
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:424 CREDAT:17416 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4512
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:424 CREDAT:17424 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4744
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1007KB
MD5bf7ec0555ab4c0f94c4b96f83cdd5f2a
SHA1ffd29d0418b968dd807d78d564f4d1c7d03fd969
SHA256e2542d620b2b24e6b34f11369bf8ba93992ed86ed53c08d33fc413969b3ee355
SHA51201906d1f8aef462cf41ca0ff0b77d11ac3c6a31873dabbd745d8ad8002bca025e532434bd5857015098f837ffc8ee12eaad8bb4e51ec4034e19a66bf91dcf97f
-
Filesize
1.0MB
MD5fe7996224c2c0b9323d1764422fc6172
SHA1fc2a5a1a6899fc8a7f54ad7762047fd13a5a34a5
SHA256d174c3358b0e85dfdd5ddfdde87978ed8a337ccde2a019f1cfb294e61a7c96e9
SHA512e221f782cda57775d858c621dbbc4694ef3fce10c124b315a370a0d264293df40f4b1814b40ef81754f29f7d724d2508aa795e2c608618768b89a311f010d30c