Analysis
- max time kernel
150s - max time network
103s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
26/05/2024, 02:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4f397b415da03ff183d1c2fc3aa3e010_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
4f397b415da03ff183d1c2fc3aa3e010_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 4f397b415da03ff183d1c2fc3aa3e010_NeikiAnalytics.exe
- Size 135KB
- Sample240526-ch8h6aba4w
- SHA256 7bab1429e254debde52b699e8b65455e4d463f63ec28d2b19f3a0237f1bc0e37
- MD5 4f397b415da03ff183d1c2fc3aa3e010
- SHA1 ca9e776f00d16d5545275cbb8df9ea532eca0c2b
- SHA512 66981941c82df349c6ceb11f397ae2336e362839487c3ce5872bfbd6aa3fc4044a051d288f2cc0041c4e4c2cc7fa039f59342b2e89db2dc559a719c21b93820d
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVVKv:UVqoCl/YgjxEufVU0TbTyDDalLKv
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Executes dropped EXE 4 IoCs
pid Process 3376 explorer.exe 2044 spoolsv.exe 2640 svchost.exe 428 spoolsv.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\themes\explorer.exe 4f397b415da03ff183d1c2fc3aa3e010_NeikiAnalytics.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4892 4f397b415da03ff183d1c2fc3aa3e010_NeikiAnalytics.exe 4892 4f397b415da03ff183d1c2fc3aa3e010_NeikiAnalytics.exe 4892 4f397b415da03ff183d1c2fc3aa3e010_NeikiAnalytics.exe 4892 4f397b415da03ff183d1c2fc3aa3e010_NeikiAnalytics.exe 4892 4f397b415da03ff183d1c2fc3aa3e010_NeikiAnalytics.exe 4892 4f397b415da03ff183d1c2fc3aa3e010_NeikiAnalytics.exe 4892 4f397b415da03ff183d1c2fc3aa3e010_NeikiAnalytics.exe 4892 4f397b415da03ff183d1c2fc3aa3e010_NeikiAnalytics.exe 4892 4f397b415da03ff183d1c2fc3aa3e010_NeikiAnalytics.exe 4892 4f397b415da03ff183d1c2fc3aa3e010_NeikiAnalytics.exe 4892 4f397b415da03ff183d1c2fc3aa3e010_NeikiAnalytics.exe 4892 4f397b415da03ff183d1c2fc3aa3e010_NeikiAnalytics.exe 4892 4f397b415da03ff183d1c2fc3aa3e010_NeikiAnalytics.exe 4892 4f397b415da03ff183d1c2fc3aa3e010_NeikiAnalytics.exe 4892 4f397b415da03ff183d1c2fc3aa3e010_NeikiAnalytics.exe 4892 4f397b415da03ff183d1c2fc3aa3e010_NeikiAnalytics.exe 4892 4f397b415da03ff183d1c2fc3aa3e010_NeikiAnalytics.exe 4892 4f397b415da03ff183d1c2fc3aa3e010_NeikiAnalytics.exe 4892 4f397b415da03ff183d1c2fc3aa3e010_NeikiAnalytics.exe 4892 4f397b415da03ff183d1c2fc3aa3e010_NeikiAnalytics.exe 4892 4f397b415da03ff183d1c2fc3aa3e010_NeikiAnalytics.exe 4892 4f397b415da03ff183d1c2fc3aa3e010_NeikiAnalytics.exe 4892 4f397b415da03ff183d1c2fc3aa3e010_NeikiAnalytics.exe 4892 4f397b415da03ff183d1c2fc3aa3e010_NeikiAnalytics.exe 4892 4f397b415da03ff183d1c2fc3aa3e010_NeikiAnalytics.exe 4892 4f397b415da03ff183d1c2fc3aa3e010_NeikiAnalytics.exe 4892 4f397b415da03ff183d1c2fc3aa3e010_NeikiAnalytics.exe 4892 4f397b415da03ff183d1c2fc3aa3e010_NeikiAnalytics.exe 4892 4f397b415da03ff183d1c2fc3aa3e010_NeikiAnalytics.exe 4892 4f397b415da03ff183d1c2fc3aa3e010_NeikiAnalytics.exe 4892 4f397b415da03ff183d1c2fc3aa3e010_NeikiAnalytics.exe 4892 4f397b415da03ff183d1c2fc3aa3e010_NeikiAnalytics.exe 4892 4f397b415da03ff183d1c2fc3aa3e010_NeikiAnalytics.exe 4892 4f397b415da03ff183d1c2fc3aa3e010_NeikiAnalytics.exe 3376 explorer.exe 3376 explorer.exe 3376 explorer.exe 3376 explorer.exe 3376 explorer.exe 3376 explorer.exe 3376 explorer.exe 3376 explorer.exe 3376 explorer.exe 3376 explorer.exe 3376 explorer.exe 3376 explorer.exe 3376 explorer.exe 3376 explorer.exe 3376 explorer.exe 3376 explorer.exe 3376 explorer.exe 3376 explorer.exe 3376 explorer.exe 3376 explorer.exe 3376 explorer.exe 3376 explorer.exe 3376 explorer.exe 3376 explorer.exe 3376 explorer.exe 3376 explorer.exe 3376 explorer.exe 3376 explorer.exe 3376 explorer.exe 3376 explorer.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2640 svchost.exe 3376 explorer.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 4892 4f397b415da03ff183d1c2fc3aa3e010_NeikiAnalytics.exe 4892 4f397b415da03ff183d1c2fc3aa3e010_NeikiAnalytics.exe 3376 explorer.exe 3376 explorer.exe 2044 spoolsv.exe 2044 spoolsv.exe 2640 svchost.exe 2640 svchost.exe 428 spoolsv.exe 428 spoolsv.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4892 wrote to memory of 3376 4892 4f397b415da03ff183d1c2fc3aa3e010_NeikiAnalytics.exe 83 PID 4892 wrote to memory of 3376 4892 4f397b415da03ff183d1c2fc3aa3e010_NeikiAnalytics.exe 83 PID 4892 wrote to memory of 3376 4892 4f397b415da03ff183d1c2fc3aa3e010_NeikiAnalytics.exe 83 PID 3376 wrote to memory of 2044 3376 explorer.exe 84 PID 3376 wrote to memory of 2044 3376 explorer.exe 84 PID 3376 wrote to memory of 2044 3376 explorer.exe 84 PID 2044 wrote to memory of 2640 2044 spoolsv.exe 85 PID 2044 wrote to memory of 2640 2044 spoolsv.exe 85 PID 2044 wrote to memory of 2640 2044 spoolsv.exe 85 PID 2640 wrote to memory of 428 2640 svchost.exe 86 PID 2640 wrote to memory of 428 2640 svchost.exe 86 PID 2640 wrote to memory of 428 2640 svchost.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f397b415da03ff183d1c2fc3aa3e010_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4f397b415da03ff183d1c2fc3aa3e010_NeikiAnalytics.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3376 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:428
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Resources\Themes\explorer.exe
- Size 135KB
- SHA256 3bc1e83eb20d98c7d46e248e6e7e3364a61d41e3264c74a4ecf843e97aa11e1a
- MD5 a9b573c08898c5269b3ea3c24afed275
- SHA1 29ba654f330fa2dbcce1a9884931fb88b0932fc6
- SHA512 9ef545944fa929367cf8fd6971acb109035e4002b13df650cb8cfe2556dcd685867ca38cf53d788f572fa8f4c2a6e05521591f9614e4f1052c5f82025616c217
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVVKA:UVqoCl/YgjxEufVU0TbTyDDalLKA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Resources\spoolsv.exe
- Size 135KB
- SHA256 d17e39eabb2039e065c6de123351acba085d66a973c6f6b11f5a2b75d1460c57
- MD5 0bc1234e663b12db5fbea2074ea28f94
- SHA1 8df7e0d0b6c96a84a81a1bae3c0ecf24cac820b4
- SHA512 0cffd76579f47a1d9c90211178ddc264cc49574f11324941e20e1cd823c9c9c6bf120be19dc65694cc50f486fcae2431d68dd38a6802f135784f1a20405fbb67
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVVKJ:UVqoCl/YgjxEufVU0TbTyDDalLKJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Resources\svchost.exe
- Size 135KB
- SHA256 2ece8f58591203677668420f70ae8ae2294156a788d5bb0d4da331f561d07e5f
- MD5 325a184c4673283598f4632bb0109358
- SHA1 6f2ff65eee481fc7f2d1304bd914cb47724df224
- SHA512 24577d7e648a4b843ca24b5dcaef3f6da7e1545c99bc82607c85c5de1509268c1419ca46313698e6f8a09e1e5d09efd304fd88b14d3064a755fc6911129d05fe
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVVK/:UVqoCl/YgjxEufVU0TbTyDDalLK/
- MD5 SHA1 SHA512 SSDEEP