Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 00:17
Behavioral task
behavioral1
Sample
602594871eaff7990d32336e4928eaf0_NeikiAnalytics.pdf
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
602594871eaff7990d32336e4928eaf0_NeikiAnalytics.pdf
Resource
win10v2004-20240508-en
General
-
Target
602594871eaff7990d32336e4928eaf0_NeikiAnalytics.pdf
-
Size
155KB
-
MD5
602594871eaff7990d32336e4928eaf0
-
SHA1
81315771ce381b51504f715d86483796bdce9e7b
-
SHA256
30a9723114f177ff4093535eb43472ed3d0407c77e47d8be8fcf4fa41aaa7b32
-
SHA512
8ff429e877857b613a0b927a89e592f29f06d1862fd24689c7d11eb9fdd10ba7c4892afc9728f2d5fa2d918bcdee8f4a33890a66ef287edcca15bf4c4826b1e8
-
SSDEEP
3072:nbsi56CLq0VahjnvBmH7m7yjZmfuQ+oECH0ivLfi835X0O8djg9k:nbsXeKjnvB+mLfunoEQLfi83E
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 4264 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
AcroRd32.exepid process 4264 AcroRd32.exe 4264 AcroRd32.exe 4264 AcroRd32.exe 4264 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
AcroRd32.exeRdrCEF.exedescription pid process target process PID 4264 wrote to memory of 3712 4264 AcroRd32.exe RdrCEF.exe PID 4264 wrote to memory of 3712 4264 AcroRd32.exe RdrCEF.exe PID 4264 wrote to memory of 3712 4264 AcroRd32.exe RdrCEF.exe PID 3712 wrote to memory of 2164 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 2164 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 2164 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 2164 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 2164 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 2164 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 2164 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 2164 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 2164 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 2164 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 2164 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 2164 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 2164 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 2164 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 2164 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 2164 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 2164 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 2164 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 2164 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 2164 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 2164 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 2164 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 2164 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 2164 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 2164 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 2164 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 2164 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 2164 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 2164 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 2164 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 2164 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 2164 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 2164 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 2164 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 2164 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 2164 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 2164 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 2164 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 2164 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 2164 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 2164 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 3372 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 3372 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 3372 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 3372 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 3372 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 3372 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 3372 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 3372 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 3372 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 3372 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 3372 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 3372 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 3372 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 3372 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 3372 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 3372 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 3372 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 3372 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 3372 3712 RdrCEF.exe RdrCEF.exe PID 3712 wrote to memory of 3372 3712 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\602594871eaff7990d32336e4928eaf0_NeikiAnalytics.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B697D2E3CE81C7FC7F878A1228EC2AB2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=762A758203A87219094A874573717B5F --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=762A758203A87219094A874573717B5F --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=09BC435BD31E6B3D74B1B04146A5155B --mojo-platform-channel-handle=2324 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9F6DAC272D495BB83428E5E41F3A1EC7 --mojo-platform-channel-handle=1940 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=DCA256AED4AC249EE07F0C5AE10F630A --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=DCA256AED4AC249EE07F0C5AE10F630A --renderer-client-id=6 --mojo-platform-channel-handle=2352 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2AE4481F197FC53E0A9C75ECA581A821 --mojo-platform-channel-handle=2672 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessagesFilesize
64KB
MD501905e287f34d4ffa0d851ed7a99206f
SHA171095d71f01763f4c432a48be2c31dfe74d988bb
SHA256d1dded1375b59bc4c395c1941ffa7e3dd0f5cf962a6abe6a5610827f33da440f
SHA512bc8428ddbe146d3ae1962037a87c2baac04052b314cdb89e3b690b8ea2f720ad78b6f23ed8ce18502fcc99157217e14b8a43206d81cb0655c4c10ed31a72fbd1
-
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessagesFilesize
64KB
MD569717004e13aca17b71cd7da879c4877
SHA1aea4c1a54ebaaa574283623b6c1c3b434c5dc343
SHA256fa144906b9f19fc714dfea0e0baf53f06453eb0787b941c2fc22eed2aa6b92ce
SHA512c3f21cee4626d7b75fc67dbccf826020eb7a4087af1a71dbdf4e6774640d88df5084e1b91542670440548a1d1d21eecfed05b4e44fb573cba1c2f61fdeaab472