f702e3fce4fd5bb9999f2f8fc566123358bebd3e5eddff2975ffec181280c513

Analysis

max time kernel
140s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 02:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
89f90c6536e4ef8e1ae2da1f0cee7b80_NeikiAnalytics.exe
Size 65KB
Sample240601-cxffxsef7s
SHA256 f702e3fce4fd5bb9999f2f8fc566123358bebd3e5eddff2975ffec181280c513
MD5 89f90c6536e4ef8e1ae2da1f0cee7b80
SHA1 53058f113397d1326d17bcb0a1f69eed6d5ffe80
SHA512 0fc0b10446aa882efac7e5f762682e3cd54aed1f370f4d994de339ae0b3dd9b04547abbd96d554cbfd106caf89efb5cf53c884fc0409592243704ca8bd35ffcf
SSDEEP 768:ZrItKyw5WHXfQIhIiIk9ecAaVPD96KyX6F:Zr3Z5IfQIR81ad5yX6F
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

evasion

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
3968	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	89f90c6536e4ef8e1ae2da1f0cee7b80_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
1964	jkmhost.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\jkmhost.exe	89f90c6536e4ef8e1ae2da1f0cee7b80_NeikiAnalytics.exe
File opened for modification	C:\Windows\Debug\jkmhost.exe	attrib.exe
File created	C:\Windows\Debug\jkmhost.exe	89f90c6536e4ef8e1ae2da1f0cee7b80_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4852	89f90c6536e4ef8e1ae2da1f0cee7b80_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 3968	4852	89f90c6536e4ef8e1ae2da1f0cee7b80_NeikiAnalytics.exe	82
PID 4852 wrote to memory of 3968	4852	89f90c6536e4ef8e1ae2da1f0cee7b80_NeikiAnalytics.exe	82
PID 4852 wrote to memory of 3968	4852	89f90c6536e4ef8e1ae2da1f0cee7b80_NeikiAnalytics.exe	82
PID 4852 wrote to memory of 1552	4852	89f90c6536e4ef8e1ae2da1f0cee7b80_NeikiAnalytics.exe	88
PID 4852 wrote to memory of 1552	4852	89f90c6536e4ef8e1ae2da1f0cee7b80_NeikiAnalytics.exe	88
PID 4852 wrote to memory of 1552	4852	89f90c6536e4ef8e1ae2da1f0cee7b80_NeikiAnalytics.exe	88

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3968	attrib.exe

C:\Users\Admin\AppData\Local\Temp\89f90c6536e4ef8e1ae2da1f0cee7b80_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\89f90c6536e4ef8e1ae2da1f0cee7b80_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Windows\SysWOW64\attrib.exe
  attrib +a +s +h +r C:\Windows\Debug\jkmhost.exe
  2⤵
  - Sets file to hidden
  - Drops file in Windows directory
  - Views/modifies file attributes
  PID:3968
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\89F90C~1.EXE > nul
  2⤵
  PID:1552

C:\Windows\Debug\jkmhost.exe
C:\Windows\Debug\jkmhost.exe
1⤵
- Executes dropped EXE
PID:1964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jkmhost.exe

Path C:\Windows\debug\jkmhost.exe
Size 65KB
SHA256 5319a5f9719af5a4807e7d5719611306357ee58932e66a75be5dafecab4eab73
MD5 9700337b19518b00f4a28bc8baacc99f
SHA1 bd6591a1c3641e587d9ebd7f93ae3a5a7e9e3a76
SHA512 5b51be17969e7dbb6ee08cb9123f69066e25015b6aef561ed007ab205af9d3df6e80175a15a3addc3fce6fd5b4b534490a81923be80c356e49655bce96ee86bf
SSDEEP 768:ZrItKyw5WHXfQIhIiIk9ecAaVPD96KyX6M:Zr3Z5IfQIR81ad5yX6M
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1964-6-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/4852-0-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/4852-5-0x0000000000400000-0x0000000000411000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads