Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27/05/2024, 19:06
Static task
static1
Behavioral task
behavioral1
Sample
0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe
-
Size
2.1MB
-
MD5
0f0cbb820e78029d86b8646df081f840
-
SHA1
deed7be3d6216dfb55e76cbed70755ac07ecbe32
-
SHA256
d1ff936ea7f9fb510c9fb5cbde514b1290f956c0913b604367c6a92427f2e137
-
SHA512
22e5447c135789172127129911c7fd3b305955d679bb22dca70cfca26b4811aa6afde9c00b15120254094f404fe12b32db4d93baf21675e67e3d2eb22052d18b
-
SSDEEP
49152:+8Y/4O8b8ITDnlaTeEXGF+6z8zmqtqCK3RTeyay+hviOZ8afQf2PynO:L2rw+6zEmqtqCKkT6OWO
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 1068 vbe7visual.exe 2924 microsoftsystem.exe 568 technologymsitss.exe 2672 microsoftrhxdsui.exe -
Loads dropped DLL 4 IoCs
pid Process 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe -
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BCSSync = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\BCSSync.exe\" /DelayServices" 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SendToOneNoteUIMicrosoft = "c:\\program files (x86)\\microsoft office\\office14\\onenote\\sendtoonenoteprintdriverfiltersendtoonenoteui14.0.4763.1000.exe" 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HelpMicrosoft = "c:\\program files (x86)\\common files\\microsoft shared\\help\\technologymsitss.exe" 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\msinfoOperating6.1.7600.16385 = "c:\\program files (x86)\\common files\\microsoft shared\\msinfo\\systemwindows.exe" 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\SystemWindows6.1.7600.16385 = "c:\\program files (x86)\\common files\\system\\microsoftsystem.exe" 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\MicrosoftRHelp2.05.50727.4039 = "c:\\program files (x86)\\common files\\microsoft shared\\help\\1042\\microsoftrhxdsui.exe" 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\EngineSource = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe" 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\EnvironmentBasic = "c:\\program files (x86)\\common files\\microsoft shared\\vba\\vba7\\vbe7visual.exe" 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\EngineOffice = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe" 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\ntdll.dll.dll technologymsitss.exe File created C:\Windows\SysWOW64\ntdll.dll.dll microsoftrhxdsui.exe File created C:\Windows\SysWOW64\ntdll.dll.dll 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\SysWOW64\ntdll.dll.dll vbe7visual.exe File created C:\Windows\SysWOW64\ntdll.dll.dll microsoftsystem.exe -
Drops file in Program Files directory 17 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft Office\Office14\OneNote\SendToOneNotePrintDriverFilterSendToOneNoteUI14.0.4763.1000.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OneNote\SendToOneNotePrintDriverFilterSendToOneNoteUI14.0.4763.1000.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\VBE7Visual.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\RCX2898.tmp 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Common Files\System\RCX3DED.tmp 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\SystemWindows.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\VBE7Visual.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\System\MicrosoftSystem.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OneNote\RCX2848.tmp 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\SystemWindows.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\TechnologyMSITSS.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\RCX2888.tmp 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\MicrosoftRHXDSUI.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Common Files\System\MicrosoftSystem.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\RCX3DFE.tmp 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\TechnologyMSITSS.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\RCX3E2E.tmp 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe -
Checks processor information in registry 2 TTPs 15 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 vbe7visual.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 microsoftsystem.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier microsoftsystem.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier technologymsitss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString microsoftsystem.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 technologymsitss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString technologymsitss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier vbe7visual.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString microsoftrhxdsui.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier microsoftrhxdsui.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString vbe7visual.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 microsoftrhxdsui.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1068 vbe7visual.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2924 microsoftsystem.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 568 technologymsitss.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2672 microsoftrhxdsui.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1852 wrote to memory of 1068 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 30 PID 1852 wrote to memory of 1068 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 30 PID 1852 wrote to memory of 1068 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 30 PID 1852 wrote to memory of 1068 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 30 PID 1852 wrote to memory of 2924 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 32 PID 1852 wrote to memory of 2924 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 32 PID 1852 wrote to memory of 2924 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 32 PID 1852 wrote to memory of 2924 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 32 PID 1852 wrote to memory of 568 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 34 PID 1852 wrote to memory of 568 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 34 PID 1852 wrote to memory of 568 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 34 PID 1852 wrote to memory of 568 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 34 PID 1852 wrote to memory of 2672 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 35 PID 1852 wrote to memory of 2672 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 35 PID 1852 wrote to memory of 2672 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 35 PID 1852 wrote to memory of 2672 1852 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\program files (x86)\common files\microsoft shared\vba\vba7\vbe7visual.exe"c:\program files (x86)\common files\microsoft shared\vba\vba7\vbe7visual.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1068
-
-
\??\c:\program files (x86)\common files\system\microsoftsystem.exe"c:\program files (x86)\common files\system\microsoftsystem.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2924
-
-
\??\c:\program files (x86)\common files\microsoft shared\help\technologymsitss.exe"c:\program files (x86)\common files\microsoft shared\help\technologymsitss.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:568
-
-
\??\c:\program files (x86)\common files\microsoft shared\help\1042\microsoftrhxdsui.exe"c:\program files (x86)\common files\microsoft shared\help\1042\microsoftrhxdsui.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2672
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.3MB
MD5a94a5913554e49da13cb33e891416dcf
SHA10b59dc05c165b728c6da54f5a7f9cd5141192d79
SHA25631bc090dc557e5c6d31ecaa459511c898291f8cc60b1d6507baaee673f8f7057
SHA512e11655816bd307fa433e9e357938c870e6e6fde74599a48a4298766f0c883fdbed15d3f995b7c55f033bbaf02a5a2db0563f6f089abdc916d13522d33a664846
-
C:\Program Files (x86)\Microsoft Office\Office14\OneNote\SendToOneNotePrintDriverFilterSendToOneNoteUI14.0.4763.1000.exe
Filesize2.1MB
MD50f0cbb820e78029d86b8646df081f840
SHA1deed7be3d6216dfb55e76cbed70755ac07ecbe32
SHA256d1ff936ea7f9fb510c9fb5cbde514b1290f956c0913b604367c6a92427f2e137
SHA51222e5447c135789172127129911c7fd3b305955d679bb22dca70cfca26b4811aa6afde9c00b15120254094f404fe12b32db4d93baf21675e67e3d2eb22052d18b