Analysis
- max time kernel
149s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
01/06/2024, 04:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8d4c200911aa35e91f1c26fb14c89690_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
8d4c200911aa35e91f1c26fb14c89690_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 8d4c200911aa35e91f1c26fb14c89690_NeikiAnalytics.exe
- Size 204KB
- Sample240601-ey9ghaac77
- SHA256 2ed2d7f44906c35a1d35dbf19a3138311b99ff61550f5c86a8eb0b38db3435a2
- MD5 8d4c200911aa35e91f1c26fb14c89690
- SHA1 2aa8c37bb6b4bba2f1a57617ea53e0fdacddda25
- SHA512 ae6107cee356db9151c4346e9e4a7291b7de3aab1619b5fefe98dfc9dfba5c7ea6fd9005d50835257436118b62c5264690618f3adf1c4171bcec6c42db53082b
- SSDEEP 3072:qmQW8I0tQ9nLHbB9W0c1TqECzR/mkSYGrl9ymgYUWEz:llT4QxL7B9W0c1RCzR/fSml9
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" cryav.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 8d4c200911aa35e91f1c26fb14c89690_NeikiAnalytics.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation 8d4c200911aa35e91f1c26fb14c89690_NeikiAnalytics.exe - Executes dropped EXE 1 IoCs
pid Process 1824 cryav.exe - Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cryav = "C:\\Users\\Admin\\cryav.exe /e" cryav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cryav = "C:\\Users\\Admin\\cryav.exe /g" cryav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cryav = "C:\\Users\\Admin\\cryav.exe /p" cryav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cryav = "C:\\Users\\Admin\\cryav.exe /r" cryav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cryav = "C:\\Users\\Admin\\cryav.exe /k" cryav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cryav = "C:\\Users\\Admin\\cryav.exe /l" cryav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cryav = "C:\\Users\\Admin\\cryav.exe /x" cryav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cryav = "C:\\Users\\Admin\\cryav.exe /q" cryav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cryav = "C:\\Users\\Admin\\cryav.exe /u" cryav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cryav = "C:\\Users\\Admin\\cryav.exe /s" cryav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cryav = "C:\\Users\\Admin\\cryav.exe /d" cryav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cryav = "C:\\Users\\Admin\\cryav.exe /v" cryav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cryav = "C:\\Users\\Admin\\cryav.exe /z" cryav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cryav = "C:\\Users\\Admin\\cryav.exe /f" cryav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cryav = "C:\\Users\\Admin\\cryav.exe /j" cryav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cryav = "C:\\Users\\Admin\\cryav.exe /c" cryav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cryav = "C:\\Users\\Admin\\cryav.exe /h" cryav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cryav = "C:\\Users\\Admin\\cryav.exe /n" cryav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cryav = "C:\\Users\\Admin\\cryav.exe /m" cryav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cryav = "C:\\Users\\Admin\\cryav.exe /i" cryav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cryav = "C:\\Users\\Admin\\cryav.exe /e" 8d4c200911aa35e91f1c26fb14c89690_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cryav = "C:\\Users\\Admin\\cryav.exe /t" cryav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cryav = "C:\\Users\\Admin\\cryav.exe /o" cryav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cryav = "C:\\Users\\Admin\\cryav.exe /y" cryav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cryav = "C:\\Users\\Admin\\cryav.exe /b" cryav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cryav = "C:\\Users\\Admin\\cryav.exe /a" cryav.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cryav = "C:\\Users\\Admin\\cryav.exe /w" cryav.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3464 8d4c200911aa35e91f1c26fb14c89690_NeikiAnalytics.exe 3464 8d4c200911aa35e91f1c26fb14c89690_NeikiAnalytics.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe 1824 cryav.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3464 8d4c200911aa35e91f1c26fb14c89690_NeikiAnalytics.exe 1824 cryav.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3464 wrote to memory of 1824 3464 8d4c200911aa35e91f1c26fb14c89690_NeikiAnalytics.exe 86 PID 3464 wrote to memory of 1824 3464 8d4c200911aa35e91f1c26fb14c89690_NeikiAnalytics.exe 86 PID 3464 wrote to memory of 1824 3464 8d4c200911aa35e91f1c26fb14c89690_NeikiAnalytics.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d4c200911aa35e91f1c26fb14c89690_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8d4c200911aa35e91f1c26fb14c89690_NeikiAnalytics.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\cryav.exe"C:\Users\Admin\cryav.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1824
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\cryav.exe
- Size 204KB
- SHA256 49775ab734abe47c65774ee7657e0c61df5c9085865bb412d87e3617e9f9672f
- MD5 aa0d7558b6039a26d0977df2de9ef23c
- SHA1 06a00bfbe36002d40c89ac38bf2ef7ef71a67838
- SHA512 98c0e70e94ee06825449c29008ed94fc3b984734e60c89bea8c98be22250ff80a0e84e0d1577cafa2b157bb3fb83666dd7a4f25d273915de3a5682a7fbdfd203
- SSDEEP 3072:rmOW8GA0tQ9nLHbB9W0c1TqECzR/mkSYGrl9ymgYUWNr:6zvA4QxL7B9W0c1RCzR/fSml4
- MD5 SHA1 SHA512 SSDEEP