Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
21/05/2024, 06:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1461203a29d11512ea7aa494520f8f06887a75875bd4f16add9f0c84dfd3e504_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
1461203a29d11512ea7aa494520f8f06887a75875bd4f16add9f0c84dfd3e504_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
1461203a29d11512ea7aa494520f8f06887a75875bd4f16add9f0c84dfd3e504_NeikiAnalytics.exe
-
Size
135KB
-
MD5
5cbab93cd47c2f95ac9fd8045514f039
-
SHA1
b0926376cf2fae189476d8dfd76281dcbca87c76
-
SHA256
1461203a29d11512ea7aa494520f8f06887a75875bd4f16add9f0c84dfd3e504
-
SHA512
7ac0932721ced4a7205eac499632a6200128c897f1ede91f9140bd6828fa68f1b78e12f0aa6f29b6ac9b8fc0b417a3c36773e7d30986e9e7b040d02d748f742c
-
SSDEEP
1536:4fsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVBcjjjjjjjjjjjjZ:4VqoCl/YgjxEufVU0TbTyDDal7g
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Executes dropped EXE 4 IoCs
pid Process 2596 explorer.exe 1732 spoolsv.exe 2732 svchost.exe 2620 spoolsv.exe -
Loads dropped DLL 4 IoCs
pid Process 1636 1461203a29d11512ea7aa494520f8f06887a75875bd4f16add9f0c84dfd3e504_NeikiAnalytics.exe 2596 explorer.exe 1732 spoolsv.exe 2732 svchost.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\themes\explorer.exe 1461203a29d11512ea7aa494520f8f06887a75875bd4f16add9f0c84dfd3e504_NeikiAnalytics.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2780 schtasks.exe 1300 schtasks.exe 2256 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1636 1461203a29d11512ea7aa494520f8f06887a75875bd4f16add9f0c84dfd3e504_NeikiAnalytics.exe 1636 1461203a29d11512ea7aa494520f8f06887a75875bd4f16add9f0c84dfd3e504_NeikiAnalytics.exe 1636 1461203a29d11512ea7aa494520f8f06887a75875bd4f16add9f0c84dfd3e504_NeikiAnalytics.exe 1636 1461203a29d11512ea7aa494520f8f06887a75875bd4f16add9f0c84dfd3e504_NeikiAnalytics.exe 1636 1461203a29d11512ea7aa494520f8f06887a75875bd4f16add9f0c84dfd3e504_NeikiAnalytics.exe 1636 1461203a29d11512ea7aa494520f8f06887a75875bd4f16add9f0c84dfd3e504_NeikiAnalytics.exe 1636 1461203a29d11512ea7aa494520f8f06887a75875bd4f16add9f0c84dfd3e504_NeikiAnalytics.exe 1636 1461203a29d11512ea7aa494520f8f06887a75875bd4f16add9f0c84dfd3e504_NeikiAnalytics.exe 1636 1461203a29d11512ea7aa494520f8f06887a75875bd4f16add9f0c84dfd3e504_NeikiAnalytics.exe 1636 1461203a29d11512ea7aa494520f8f06887a75875bd4f16add9f0c84dfd3e504_NeikiAnalytics.exe 1636 1461203a29d11512ea7aa494520f8f06887a75875bd4f16add9f0c84dfd3e504_NeikiAnalytics.exe 1636 1461203a29d11512ea7aa494520f8f06887a75875bd4f16add9f0c84dfd3e504_NeikiAnalytics.exe 1636 1461203a29d11512ea7aa494520f8f06887a75875bd4f16add9f0c84dfd3e504_NeikiAnalytics.exe 1636 1461203a29d11512ea7aa494520f8f06887a75875bd4f16add9f0c84dfd3e504_NeikiAnalytics.exe 1636 1461203a29d11512ea7aa494520f8f06887a75875bd4f16add9f0c84dfd3e504_NeikiAnalytics.exe 1636 1461203a29d11512ea7aa494520f8f06887a75875bd4f16add9f0c84dfd3e504_NeikiAnalytics.exe 1636 1461203a29d11512ea7aa494520f8f06887a75875bd4f16add9f0c84dfd3e504_NeikiAnalytics.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2732 svchost.exe 2732 svchost.exe 2732 svchost.exe 2732 svchost.exe 2732 svchost.exe 2732 svchost.exe 2732 svchost.exe 2732 svchost.exe 2732 svchost.exe 2732 svchost.exe 2732 svchost.exe 2732 svchost.exe 2732 svchost.exe 2732 svchost.exe 2732 svchost.exe 2732 svchost.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2596 explorer.exe 2732 svchost.exe 2732 svchost.exe 2596 explorer.exe 2732 svchost.exe 2596 explorer.exe 2732 svchost.exe 2596 explorer.exe 2732 svchost.exe 2596 explorer.exe 2732 svchost.exe 2596 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2596 explorer.exe 2732 svchost.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1636 1461203a29d11512ea7aa494520f8f06887a75875bd4f16add9f0c84dfd3e504_NeikiAnalytics.exe 1636 1461203a29d11512ea7aa494520f8f06887a75875bd4f16add9f0c84dfd3e504_NeikiAnalytics.exe 2596 explorer.exe 2596 explorer.exe 1732 spoolsv.exe 1732 spoolsv.exe 2732 svchost.exe 2732 svchost.exe 2620 spoolsv.exe 2620 spoolsv.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1636 wrote to memory of 2596 1636 1461203a29d11512ea7aa494520f8f06887a75875bd4f16add9f0c84dfd3e504_NeikiAnalytics.exe 28 PID 1636 wrote to memory of 2596 1636 1461203a29d11512ea7aa494520f8f06887a75875bd4f16add9f0c84dfd3e504_NeikiAnalytics.exe 28 PID 1636 wrote to memory of 2596 1636 1461203a29d11512ea7aa494520f8f06887a75875bd4f16add9f0c84dfd3e504_NeikiAnalytics.exe 28 PID 1636 wrote to memory of 2596 1636 1461203a29d11512ea7aa494520f8f06887a75875bd4f16add9f0c84dfd3e504_NeikiAnalytics.exe 28 PID 2596 wrote to memory of 1732 2596 explorer.exe 29 PID 2596 wrote to memory of 1732 2596 explorer.exe 29 PID 2596 wrote to memory of 1732 2596 explorer.exe 29 PID 2596 wrote to memory of 1732 2596 explorer.exe 29 PID 1732 wrote to memory of 2732 1732 spoolsv.exe 30 PID 1732 wrote to memory of 2732 1732 spoolsv.exe 30 PID 1732 wrote to memory of 2732 1732 spoolsv.exe 30 PID 1732 wrote to memory of 2732 1732 spoolsv.exe 30 PID 2732 wrote to memory of 2620 2732 svchost.exe 31 PID 2732 wrote to memory of 2620 2732 svchost.exe 31 PID 2732 wrote to memory of 2620 2732 svchost.exe 31 PID 2732 wrote to memory of 2620 2732 svchost.exe 31 PID 2596 wrote to memory of 2824 2596 explorer.exe 32 PID 2596 wrote to memory of 2824 2596 explorer.exe 32 PID 2596 wrote to memory of 2824 2596 explorer.exe 32 PID 2596 wrote to memory of 2824 2596 explorer.exe 32 PID 2732 wrote to memory of 2780 2732 svchost.exe 33 PID 2732 wrote to memory of 2780 2732 svchost.exe 33 PID 2732 wrote to memory of 2780 2732 svchost.exe 33 PID 2732 wrote to memory of 2780 2732 svchost.exe 33 PID 2732 wrote to memory of 1300 2732 svchost.exe 38 PID 2732 wrote to memory of 1300 2732 svchost.exe 38 PID 2732 wrote to memory of 1300 2732 svchost.exe 38 PID 2732 wrote to memory of 1300 2732 svchost.exe 38 PID 2732 wrote to memory of 2256 2732 svchost.exe 40 PID 2732 wrote to memory of 2256 2732 svchost.exe 40 PID 2732 wrote to memory of 2256 2732 svchost.exe 40 PID 2732 wrote to memory of 2256 2732 svchost.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\1461203a29d11512ea7aa494520f8f06887a75875bd4f16add9f0c84dfd3e504_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1461203a29d11512ea7aa494520f8f06887a75875bd4f16add9f0c84dfd3e504_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2620
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 08:10 /f5⤵
- Creates scheduled task(s)
PID:2780
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 08:11 /f5⤵
- Creates scheduled task(s)
PID:1300
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 08:12 /f5⤵
- Creates scheduled task(s)
PID:2256
-
-
-
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe3⤵PID:2824
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135KB
MD58b7f8746ae42d4a49091060a74371647
SHA1a8d86ecb6e14413fa3045d3c957f94bd5417b446
SHA25635690d2fc138af90471f1d57d88c9b87528e2dab232021d257f292c4d2ead17d
SHA512259012dd5b635bf36d61fd219044b7cb2e0a17b8f11d7fd630db7316607abaeecfd1ff86ff94719cf04798905c7e05744768b3fd41a71662eb137d2414f113d8
-
Filesize
135KB
MD50db5a0fba3746117fec5ef9bef84c7ac
SHA1d13180b73980cb89e77ec0449b098cbe4909400e
SHA2568c67536ccce322e9855c4552534f001994d7d73452266398da4ecc32de74541f
SHA512d5fa290c7025ec083f1d3f5c9f1b6508910fc2abbbc1a3d595cd5c1dcba78355f8184c57437dec66beaa5466509e866b25184d51eb10bfcfe09702cb3963c7b3
-
Filesize
135KB
MD52f427f337174805e3ba09c8d9b988f1a
SHA1bb7e674ab853ca506a769bca5919effeafe2fd19
SHA256608585520f3022ab0592e8298641504425652a54b6eadf8eb83c076aa2614d6f
SHA512fd8f77c86e23b2c639cd06a36b4bd8059a976295509a2c891b50f2b50d8caa82d16698138fe574b9bd817ee475b97538477be0dbd9d569b00bc070a70d27270d