fc901c6b656cd4dafdf3264c2a5c0542b6fbe88f11b1fcf2873d8ec93f52f133

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61d1290fa0f45f3c59763b2199e640f0_NeikiAnalytics.exe
Size

78KB
MD5

61d1290fa0f45f3c59763b2199e640f0
SHA1

7a93d74847707fd6298cab1b822ecccc1abaf91a
SHA256

fc901c6b656cd4dafdf3264c2a5c0542b6fbe88f11b1fcf2873d8ec93f52f133
SHA512

ba600b241c07805704d3ebf8173f5bc387b48864f02fff8b91f739d68f3891dc4c11f82562c1a9f19cf2efe4c193f509ec41727609cc0a20f6a664c728e36ab9
SSDEEP

1536:MDcfLfIb5Ep1uzgyXVdtnqHNWnnnJXXXcnGGGG1:MD2LTnuzgyXVd1mmXXXcd

Score

8^/10

evasion

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

2936 attrib.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2900 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

ayahost.exe

pid process

2536 ayahost.exe

pid	process
2936	attrib.exe

pid	process
2900	cmd.exe

pid	process
2536	ayahost.exe

Drops file in Windows directory 3 IoCs

Processes:

attrib.exe61d1290fa0f45f3c59763b2199e640f0_NeikiAnalytics.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\ayahost.exe	attrib.exe
File created	C:\Windows\Debug\ayahost.exe	61d1290fa0f45f3c59763b2199e640f0_NeikiAnalytics.exe
File opened for modification	C:\Windows\Debug\ayahost.exe	61d1290fa0f45f3c59763b2199e640f0_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ayahost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ayahost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ayahost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

61d1290fa0f45f3c59763b2199e640f0_NeikiAnalytics.exe

description pid process

Token: SeIncBasePriorityPrivilege 1540 61d1290fa0f45f3c59763b2199e640f0_NeikiAnalytics.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	1540	61d1290fa0f45f3c59763b2199e640f0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

61d1290fa0f45f3c59763b2199e640f0_NeikiAnalytics.exe

description	pid	process	target process
PID 1540 wrote to memory of 2936	1540	61d1290fa0f45f3c59763b2199e640f0_NeikiAnalytics.exe	attrib.exe
PID 1540 wrote to memory of 2936	1540	61d1290fa0f45f3c59763b2199e640f0_NeikiAnalytics.exe	attrib.exe
PID 1540 wrote to memory of 2936	1540	61d1290fa0f45f3c59763b2199e640f0_NeikiAnalytics.exe	attrib.exe
PID 1540 wrote to memory of 2936	1540	61d1290fa0f45f3c59763b2199e640f0_NeikiAnalytics.exe	attrib.exe
PID 1540 wrote to memory of 2900	1540	61d1290fa0f45f3c59763b2199e640f0_NeikiAnalytics.exe	cmd.exe
PID 1540 wrote to memory of 2900	1540	61d1290fa0f45f3c59763b2199e640f0_NeikiAnalytics.exe	cmd.exe
PID 1540 wrote to memory of 2900	1540	61d1290fa0f45f3c59763b2199e640f0_NeikiAnalytics.exe	cmd.exe
PID 1540 wrote to memory of 2900	1540	61d1290fa0f45f3c59763b2199e640f0_NeikiAnalytics.exe	cmd.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

2936 attrib.exe

pid	process
2936	attrib.exe

C:\Users\Admin\AppData\Local\Temp\61d1290fa0f45f3c59763b2199e640f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\61d1290fa0f45f3c59763b2199e640f0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1540

C:\Windows\SysWOW64\attrib.exe
attrib +a +s +h +r C:\Windows\Debug\ayahost.exe
2⤵
- Sets file to hidden
- Drops file in Windows directory
- Views/modifies file attributes
PID:2936

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\61D129~1.EXE > nul
2⤵
- Deletes itself
PID:2900

C:\Windows\Debug\ayahost.exe
C:\Windows\Debug\ayahost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2536

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\ayahost.exe
Filesize
78KB

MD5
ecdafeca034811bca4b2fbf23be958b4

SHA1
337ca0713abb1395db1b4f11ba3d64e4e7a37b6a

SHA256
ff696936306158354a52b96e759cdff01e0416f47561b066d71388cf49808ee7

SHA512
121c7cf2c4c9767b4a6ca65f777e164400e7af8c19d2406416227ac001f7829664aee6cd9509ce0c1a993f0f3d5625a7976db613bd23e5a6f465cac11fbe08e4

Download Submit