Analysis
-
max time kernel
54s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
22-05-2024 20:46
General
-
Target
3797826ad5f0e02b68a9be8a85d24420_NeikiAnalytics.exe
-
Size
1.4MB
-
MD5
3797826ad5f0e02b68a9be8a85d24420
-
SHA1
8006fbf5ae2b740c26533f76ee77fd92be46c580
-
SHA256
b61fef75e35dbfe215c5dc51eee277c7b7ad676d8200d8ca638f5c399f8cce82
-
SHA512
3be887fe2a066a879290d805d4541d79c5e2443079203dbec32f71ea434559d22e6bb1b365e8562de9b95495d4b4138277879990fdd657a13cee126358e7a5a7
-
SSDEEP
24576:NgXkeGFgXR1q52AvtMq6vgOiL3oWkunEMrmjRNEVQEPFdzLZjRT4YB6PXXx:vdVvtMq6vgh3oWPEBjRqXdfZyXh
Score
8/10
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 3 IoCs
-
Enumerates connected drives 3 TTPs 6 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 32 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 51 IoCs
-
Suspicious use of SendNotifyMessage 34 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3797826ad5f0e02b68a9be8a85d24420_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3797826ad5f0e02b68a9be8a85d24420_NeikiAnalytics.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3756 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:81⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53Filesize
471B
MD545654e26b54abaef678dbdb46a9eb535
SHA1a23cc33fe546ee53bdb07589548d84c2101d6ab0
SHA256329924597f143dd23c32377fbcbde16a057c28500ff47149dfc4768df5853030
SHA512313a7c6066b6be2cad54272cab1931fdf6f42b68c3ee78fd06eb4f4574df788a2e9892be74bed3f6198aab652fa3dcf36ccfff9f777d62d3c1d51acd0cff7f9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53Filesize
412B
MD528ad04d2a051bc7a53367054349fc80c
SHA1e021f66edfdb1e8fde46a687f15ccaea66a0962f
SHA256c8fdf68815a0c65fe497a54126edb70a45337a403154138c5cb9dac282be2904
SHA51282abe953b5fa23094850af1d92a0f305787462ca9393b4717105812eca69a0fc5b529278c0d971d7270c0b9846c32db2856fbdfa7613004609da85b658b0306e
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbresFilesize
2KB
MD537a8e481b70cc2e16877959854520f1a
SHA1752df4ad48b065fa6511b76c6b273300a32fc2d9
SHA25664be43e46c40c3f158fc16d49f8ab990cf25d8b75ff34d6df5f7f9f5a89581fe
SHA5123f77f6134984f79b1765c9f3563963718188e67932b890159ff48339651af911e009fea64ef26d6f2b8380d6371c060b15422b6c2ecb7cb17e136744e6c2b4b7
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\5MIHM5LV\microsoft.windows[1].xmlFilesize
96B
MD584209e171da10686915fe7efcd51552d
SHA16bf96e86a533a68eba4d703833de374e18ce6113
SHA25604d6050009ea3c99cc718ad1c07c5d15268b459fcfb63fcb990bc9761738907b
SHA51248d2524000911cfb68ef866dedac78ee430d79aa3f4b68399f645dc2066841e6962e11a3362cbcec46680357dcd3e58cfef9994450fed1d8af04df44f76b0dfd
-
memory/884-1092-0x000001BC563A0000-0x000001BC563C0000-memory.dmpFilesize
128KB
-
memory/884-1099-0x000001BC569B0000-0x000001BC569D0000-memory.dmpFilesize
128KB
-
memory/884-1068-0x000001BC563E0000-0x000001BC56400000-memory.dmpFilesize
128KB
-
memory/884-1062-0x000001BC55500000-0x000001BC55600000-memory.dmpFilesize
1024KB
-
memory/1188-502-0x00000186838C0000-0x00000186838E0000-memory.dmpFilesize
128KB
-
memory/1188-465-0x0000018682500000-0x0000018682600000-memory.dmpFilesize
1024KB
-
memory/1188-470-0x00000186832D0000-0x00000186832F0000-memory.dmpFilesize
128KB
-
memory/1188-467-0x0000018682500000-0x0000018682600000-memory.dmpFilesize
1024KB
-
memory/1188-501-0x0000018683290000-0x00000186832B0000-memory.dmpFilesize
128KB
-
memory/1256-309-0x0000000003020000-0x0000000003021000-memory.dmpFilesize
4KB
-
memory/1316-770-0x00000000042E0000-0x00000000042E1000-memory.dmpFilesize
4KB
-
memory/1560-809-0x000001635E510000-0x000001635E530000-memory.dmpFilesize
128KB
-
memory/1560-807-0x000001635E100000-0x000001635E120000-memory.dmpFilesize
128KB
-
memory/1560-778-0x000001635E140000-0x000001635E160000-memory.dmpFilesize
128KB
-
memory/1620-159-0x0000000002460000-0x0000000002461000-memory.dmpFilesize
4KB
-
memory/2176-185-0x0000027C9D690000-0x0000027C9D6B0000-memory.dmpFilesize
128KB
-
memory/2176-160-0x0000027C9C740000-0x0000027C9C840000-memory.dmpFilesize
1024KB
-
memory/2176-196-0x0000027C9DCA0000-0x0000027C9DCC0000-memory.dmpFilesize
128KB
-
memory/2176-166-0x0000027C9D6D0000-0x0000027C9D6F0000-memory.dmpFilesize
128KB
-
memory/2332-1371-0x000001B283290000-0x000001B2832B0000-memory.dmpFilesize
128KB
-
memory/2332-1394-0x000001B2838A0000-0x000001B2838C0000-memory.dmpFilesize
128KB
-
memory/2332-1359-0x000001B281280000-0x000001B281380000-memory.dmpFilesize
1024KB
-
memory/2332-1362-0x000001B2832D0000-0x000001B2832F0000-memory.dmpFilesize
128KB
-
memory/2332-1357-0x000001B281280000-0x000001B281380000-memory.dmpFilesize
1024KB
-
memory/2332-1358-0x000001B281280000-0x000001B281380000-memory.dmpFilesize
1024KB
-
memory/2356-1356-0x0000000004800000-0x0000000004801000-memory.dmpFilesize
4KB
-
memory/2868-10-0x00000000044C0000-0x00000000044C1000-memory.dmpFilesize
4KB
-
memory/2972-614-0x00000000048C0000-0x00000000048C1000-memory.dmpFilesize
4KB
-
memory/3200-1205-0x0000000003FB0000-0x0000000003FB1000-memory.dmpFilesize
4KB
-
memory/3676-311-0x00000000046F0000-0x00000000046F1000-memory.dmpFilesize
4KB
-
memory/3820-1061-0x0000000002E90000-0x0000000002E91000-memory.dmpFilesize
4KB
-
memory/4000-642-0x000001E2A95C0000-0x000001E2A95E0000-memory.dmpFilesize
128KB
-
memory/4000-657-0x000001E2A9950000-0x000001E2A9970000-memory.dmpFilesize
128KB
-
memory/4000-622-0x000001E2A9600000-0x000001E2A9620000-memory.dmpFilesize
128KB
-
memory/4000-616-0x000001E2A8500000-0x000001E2A8600000-memory.dmpFilesize
1024KB
-
memory/4108-911-0x0000000004330000-0x0000000004331000-memory.dmpFilesize
4KB
-
memory/4284-1207-0x000002D40E640000-0x000002D40E740000-memory.dmpFilesize
1024KB
-
memory/4284-1213-0x000002D40F790000-0x000002D40F7B0000-memory.dmpFilesize
128KB
-
memory/4284-1230-0x000002D40F750000-0x000002D40F770000-memory.dmpFilesize
128KB
-
memory/4284-1244-0x000002D40FBF0000-0x000002D40FC10000-memory.dmpFilesize
128KB
-
memory/4552-313-0x000001B22B920000-0x000001B22BA20000-memory.dmpFilesize
1024KB
-
memory/4552-319-0x000001BA2DA80000-0x000001BA2DAA0000-memory.dmpFilesize
128KB
-
memory/4552-350-0x000001BA2DE80000-0x000001BA2DEA0000-memory.dmpFilesize
128KB
-
memory/4552-340-0x000001BA2DA40000-0x000001BA2DA60000-memory.dmpFilesize
128KB
-
memory/4820-464-0x0000000004CD0000-0x0000000004CD1000-memory.dmpFilesize
4KB
-
memory/4896-950-0x000002515AF10000-0x000002515AF30000-memory.dmpFilesize
128KB
-
memory/4896-919-0x000002515AB40000-0x000002515AB60000-memory.dmpFilesize
128KB
-
memory/4896-939-0x000002515AB00000-0x000002515AB20000-memory.dmpFilesize
128KB
-
memory/4952-46-0x000001882BFB0000-0x000001882BFD0000-memory.dmpFilesize
128KB
-
memory/4952-48-0x000001882C3C0000-0x000001882C3E0000-memory.dmpFilesize
128KB
-
memory/4952-17-0x000001882BFF0000-0x000001882C010000-memory.dmpFilesize
128KB