Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30/05/2024, 22:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6b3f3345f2506dd4d18d937799aa6080_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
6b3f3345f2506dd4d18d937799aa6080_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
6b3f3345f2506dd4d18d937799aa6080_NeikiAnalytics.exe
-
Size
48KB
-
MD5
6b3f3345f2506dd4d18d937799aa6080
-
SHA1
4de89c8d4a8db1f9d775f605c56c08d6c42f7086
-
SHA256
db42d43da7a3987f85416c57cdb4485e7b4d9281b09f8c8eec186d1a9b389f72
-
SHA512
cfc8244b7754b653e6e8a8a93bb30fe1bc4c3cdf21d10e8d7cada5f1c9d572492f5366ec3810454f57a30569dde55754590f1c6fbb8bdf3b5d0d06a8b783734e
-
SSDEEP
768:nvopkk3z/QjaNfjx8pEYQKhuQxM/aCra1Re:nvaksMaVSODKHC/aCy
Score
1/10
Malware Config
Signatures
-
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "197" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe -
Suspicious behavior: LoadsDriver 64 IoCs
pid Process 2944 Process not Found 2592 Process not Found 5112 Process not Found 1312 Process not Found 3140 Process not Found 388 Process not Found 904 Process not Found 4816 Process not Found 1852 Process not Found 1000 Process not Found 5052 Process not Found 2280 Process not Found 1540 Process not Found 4240 Process not Found 4564 Process not Found 2384 Process not Found 4448 Process not Found 2156 Process not Found 400 Process not Found 4044 Process not Found 4676 Process not Found 4576 Process not Found 2672 Process not Found 1692 Process not Found 740 Process not Found 3116 Process not Found 1728 Process not Found 3452 Process not Found 1988 Process not Found 1476 Process not Found 556 Process not Found 2464 Process not Found 4116 Process not Found 1996 Process not Found 2160 Process not Found 1232 Process not Found 3332 Process not Found 4984 Process not Found 4720 Process not Found 1668 Process not Found 3604 Process not Found 1632 Process not Found 4408 Process not Found 4060 Process not Found 4584 Process not Found 4736 Process not Found 1816 Process not Found 3912 Process not Found 4620 Process not Found 3828 Process not Found 4856 Process not Found 868 Process not Found 3064 Process not Found 2956 Process not Found 4684 Process not Found 4508 Process not Found 2008 Process not Found 4972 Process not Found 3008 Process not Found 2848 Process not Found 1040 Process not Found 1956 Process not Found 2096 Process not Found 4372 Process not Found -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2292 LogonUI.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b3f3345f2506dd4d18d937799aa6080_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6b3f3345f2506dd4d18d937799aa6080_NeikiAnalytics.exe"1⤵PID:2800
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39a3855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2292