1f53af55248c1fe207874627247fb7e1cbdfd7899205213c0977931aa6e784b7

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 02:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
89f3dec734b37d0ece0554f10066f970_NeikiAnalytics.exe
Size 74KB
Sample240601-cw36laef6t
SHA256 1f53af55248c1fe207874627247fb7e1cbdfd7899205213c0977931aa6e784b7
MD5 89f3dec734b37d0ece0554f10066f970
SHA1 d5ff675b5cb430563acdb21a2fd3bcb2f7df9e2c
SHA512 52faaca20f847868f2998532dd4f3b7082b6fd77a07e2fa44c81629d9663517b0b8161e36b74fc336a06b6cb6c30eaec378a525b5499e8a847786908ef58b11a
SSDEEP 384:+41DuuOFZyUVpULCgDb2prxVTn24X/m7Q6Al6z+yXpI5555R0y:fDcZyUpULCgo24T96ayXvy
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

evasion

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
3912	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	89f3dec734b37d0ece0554f10066f970_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
1844	ooohost.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Debug\ooohost.exe	89f3dec734b37d0ece0554f10066f970_NeikiAnalytics.exe
File opened for modification	C:\Windows\Debug\ooohost.exe	89f3dec734b37d0ece0554f10066f970_NeikiAnalytics.exe
File opened for modification	C:\Windows\Debug\ooohost.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2456	89f3dec734b37d0ece0554f10066f970_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 3912	2456	89f3dec734b37d0ece0554f10066f970_NeikiAnalytics.exe	82
PID 2456 wrote to memory of 3912	2456	89f3dec734b37d0ece0554f10066f970_NeikiAnalytics.exe	82
PID 2456 wrote to memory of 3912	2456	89f3dec734b37d0ece0554f10066f970_NeikiAnalytics.exe	82
PID 2456 wrote to memory of 3792	2456	89f3dec734b37d0ece0554f10066f970_NeikiAnalytics.exe	88
PID 2456 wrote to memory of 3792	2456	89f3dec734b37d0ece0554f10066f970_NeikiAnalytics.exe	88
PID 2456 wrote to memory of 3792	2456	89f3dec734b37d0ece0554f10066f970_NeikiAnalytics.exe	88

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3912	attrib.exe

C:\Users\Admin\AppData\Local\Temp\89f3dec734b37d0ece0554f10066f970_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\89f3dec734b37d0ece0554f10066f970_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Windows\SysWOW64\attrib.exe
  attrib +a +s +h +r C:\Windows\Debug\ooohost.exe
  2⤵
  - Sets file to hidden
  - Drops file in Windows directory
  - Views/modifies file attributes
  PID:3912
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\89F3DE~1.EXE > nul
  2⤵
  PID:3792

C:\Windows\Debug\ooohost.exe
C:\Windows\Debug\ooohost.exe
1⤵
- Executes dropped EXE
PID:1844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ooohost.exe

Path C:\Windows\debug\ooohost.exe
Size 75KB
SHA256 6c1a2b31656fb6415c80db8fa66e87d189d9ab675d880ede817af7cf9ed242bc
MD5 02e74a53bfef994610e4f29be023815a
SHA1 afe2072c32323c020811fd6c78fe16f9a703fecc
SHA512 731792ae592cc593af01744c9dbc46a61b1ef9117b29c7c5dda17f407d7d5142eff7382888a0d3e680791df3efa5938316c01b9bb68f3970b3d5d8f83c9ff475
SSDEEP 384:+41DuuOFZyUVpULCgDb2prxVTn24X/m7Q6Al6z+yXpI5555R0t:fDcZyUpULCgo24T96ayXvt
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1844-5-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/1844-6-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/2456-0-0x0000000000400000-0x0000000000413000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads