Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
25/05/2024, 22:25
Static task
static1
Behavioral task
behavioral1
Sample
2a475f8958f2f7239411bfa116c2ab30_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2a475f8958f2f7239411bfa116c2ab30_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
2a475f8958f2f7239411bfa116c2ab30_NeikiAnalytics.exe
-
Size
135KB
-
MD5
2a475f8958f2f7239411bfa116c2ab30
-
SHA1
5b8630d34cbd02e4c0a087582884bbbe53e54f75
-
SHA256
58c93c5f18b71c84c4de32d19c42a40490183ae9447764894fb5597487795d44
-
SHA512
3b4b2fa34c0d8ef473dea49a6042fa42c97d4fbaa0e15f405014babc46ccc13c22940ffff2e713293640c694dff8b56be087779ceacd5e7f4a684dc031ef56a7
-
SSDEEP
1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVXW8O8O8O8O8O8O3:UVqoCl/YgjxEufVU0TbTyDDalRW
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Executes dropped EXE 4 IoCs
pid Process 1892 explorer.exe 3700 spoolsv.exe 4216 svchost.exe 5084 spoolsv.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\themes\explorer.exe 2a475f8958f2f7239411bfa116c2ab30_NeikiAnalytics.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1448 2a475f8958f2f7239411bfa116c2ab30_NeikiAnalytics.exe 1448 2a475f8958f2f7239411bfa116c2ab30_NeikiAnalytics.exe 1448 2a475f8958f2f7239411bfa116c2ab30_NeikiAnalytics.exe 1448 2a475f8958f2f7239411bfa116c2ab30_NeikiAnalytics.exe 1448 2a475f8958f2f7239411bfa116c2ab30_NeikiAnalytics.exe 1448 2a475f8958f2f7239411bfa116c2ab30_NeikiAnalytics.exe 1448 2a475f8958f2f7239411bfa116c2ab30_NeikiAnalytics.exe 1448 2a475f8958f2f7239411bfa116c2ab30_NeikiAnalytics.exe 1448 2a475f8958f2f7239411bfa116c2ab30_NeikiAnalytics.exe 1448 2a475f8958f2f7239411bfa116c2ab30_NeikiAnalytics.exe 1448 2a475f8958f2f7239411bfa116c2ab30_NeikiAnalytics.exe 1448 2a475f8958f2f7239411bfa116c2ab30_NeikiAnalytics.exe 1448 2a475f8958f2f7239411bfa116c2ab30_NeikiAnalytics.exe 1448 2a475f8958f2f7239411bfa116c2ab30_NeikiAnalytics.exe 1448 2a475f8958f2f7239411bfa116c2ab30_NeikiAnalytics.exe 1448 2a475f8958f2f7239411bfa116c2ab30_NeikiAnalytics.exe 1448 2a475f8958f2f7239411bfa116c2ab30_NeikiAnalytics.exe 1448 2a475f8958f2f7239411bfa116c2ab30_NeikiAnalytics.exe 1448 2a475f8958f2f7239411bfa116c2ab30_NeikiAnalytics.exe 1448 2a475f8958f2f7239411bfa116c2ab30_NeikiAnalytics.exe 1448 2a475f8958f2f7239411bfa116c2ab30_NeikiAnalytics.exe 1448 2a475f8958f2f7239411bfa116c2ab30_NeikiAnalytics.exe 1448 2a475f8958f2f7239411bfa116c2ab30_NeikiAnalytics.exe 1448 2a475f8958f2f7239411bfa116c2ab30_NeikiAnalytics.exe 1448 2a475f8958f2f7239411bfa116c2ab30_NeikiAnalytics.exe 1448 2a475f8958f2f7239411bfa116c2ab30_NeikiAnalytics.exe 1448 2a475f8958f2f7239411bfa116c2ab30_NeikiAnalytics.exe 1448 2a475f8958f2f7239411bfa116c2ab30_NeikiAnalytics.exe 1448 2a475f8958f2f7239411bfa116c2ab30_NeikiAnalytics.exe 1448 2a475f8958f2f7239411bfa116c2ab30_NeikiAnalytics.exe 1448 2a475f8958f2f7239411bfa116c2ab30_NeikiAnalytics.exe 1448 2a475f8958f2f7239411bfa116c2ab30_NeikiAnalytics.exe 1448 2a475f8958f2f7239411bfa116c2ab30_NeikiAnalytics.exe 1448 2a475f8958f2f7239411bfa116c2ab30_NeikiAnalytics.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe 1892 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1892 explorer.exe 4216 svchost.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1448 2a475f8958f2f7239411bfa116c2ab30_NeikiAnalytics.exe 1448 2a475f8958f2f7239411bfa116c2ab30_NeikiAnalytics.exe 1892 explorer.exe 1892 explorer.exe 3700 spoolsv.exe 3700 spoolsv.exe 4216 svchost.exe 4216 svchost.exe 5084 spoolsv.exe 5084 spoolsv.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1448 wrote to memory of 1892 1448 2a475f8958f2f7239411bfa116c2ab30_NeikiAnalytics.exe 83 PID 1448 wrote to memory of 1892 1448 2a475f8958f2f7239411bfa116c2ab30_NeikiAnalytics.exe 83 PID 1448 wrote to memory of 1892 1448 2a475f8958f2f7239411bfa116c2ab30_NeikiAnalytics.exe 83 PID 1892 wrote to memory of 3700 1892 explorer.exe 84 PID 1892 wrote to memory of 3700 1892 explorer.exe 84 PID 1892 wrote to memory of 3700 1892 explorer.exe 84 PID 3700 wrote to memory of 4216 3700 spoolsv.exe 85 PID 3700 wrote to memory of 4216 3700 spoolsv.exe 85 PID 3700 wrote to memory of 4216 3700 spoolsv.exe 85 PID 4216 wrote to memory of 5084 4216 svchost.exe 86 PID 4216 wrote to memory of 5084 4216 svchost.exe 86 PID 4216 wrote to memory of 5084 4216 svchost.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a475f8958f2f7239411bfa116c2ab30_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2a475f8958f2f7239411bfa116c2ab30_NeikiAnalytics.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5084
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135KB
MD53fd6380fa5a2cc5f8410b2bad9bebb17
SHA1dfc0f6b338005133f9596ebf0cf9d79b9281c8f0
SHA256a980216fcd2c8ab471f3c95e887c3c83f371bad2c2c1954443405d6bcad12fc0
SHA51277762cde5472731322c108629d1ae4bd1b53b647c1eb20b9b8da18be8cb90620d84f8281a900ff2ae31dc9893df7779e273cb2b3db0c4a20cd1a08e7dc97b619
-
Filesize
135KB
MD57f189b51c1af53dcfe3fd487db54bf54
SHA17b713609b989ddf740e38477365448396b68b1a7
SHA2564d2bff28c6e6f6aca0d86eb61c4bffa1745dbd62738c4cadc5d0f05e19889ee4
SHA512ac1199a38f366f4cd1dca2fc410372889a28779cd5e0bc856afcfb42f29888f3a4933ba6524de43c0674adf3f7d34936859d592ef51de71a21f14b09394e9e0d
-
Filesize
135KB
MD5a646086f283199b31739416713031f8b
SHA1737674815997880a29ad8f0371a2a48a77ba3569
SHA25603ba4b476b58830e4c991e9b53853711b03218fcb88676ee6dc0ef1a3e33249f
SHA512aae3111926d2a6eb141d65e15192cd8f6ea0222a3fc686a8f776218fde2b55992885508e0fcf9c85f8646d38bebda33aaa248043c35476e43df7614fe870e5dd