Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
01/06/2024, 06:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9019f839d8d711c4ceecf73fa64fd780_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
9019f839d8d711c4ceecf73fa64fd780_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 9019f839d8d711c4ceecf73fa64fd780_NeikiAnalytics.exe
- Size 135KB
- Sample240601-grzd3acg98
- SHA256 129833f0246c1e3c96263702ce553efc33baba726e670a0ec19d414a4ede8773
- MD5 9019f839d8d711c4ceecf73fa64fd780
- SHA1 b8047cd8879f867fee361084ced6085e6a45d0ea
- SHA512 005999877aacf9168ee8d87b7903b455beed5ee62d73ce8106f4f196e95e35c4e300ee5136c9f398412ec4eab8e60651e84a72cf10f4f6e48598cb585fdf27d5
- SSDEEP 1536:XfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbg0J:XVqoCl/YgjxEufVU0TbTyDDal3J
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Executes dropped EXE 4 IoCs
pid Process 2368 explorer.exe 116 spoolsv.exe 3520 svchost.exe 4268 spoolsv.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\themes\explorer.exe 9019f839d8d711c4ceecf73fa64fd780_NeikiAnalytics.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1868 9019f839d8d711c4ceecf73fa64fd780_NeikiAnalytics.exe 1868 9019f839d8d711c4ceecf73fa64fd780_NeikiAnalytics.exe 1868 9019f839d8d711c4ceecf73fa64fd780_NeikiAnalytics.exe 1868 9019f839d8d711c4ceecf73fa64fd780_NeikiAnalytics.exe 1868 9019f839d8d711c4ceecf73fa64fd780_NeikiAnalytics.exe 1868 9019f839d8d711c4ceecf73fa64fd780_NeikiAnalytics.exe 1868 9019f839d8d711c4ceecf73fa64fd780_NeikiAnalytics.exe 1868 9019f839d8d711c4ceecf73fa64fd780_NeikiAnalytics.exe 1868 9019f839d8d711c4ceecf73fa64fd780_NeikiAnalytics.exe 1868 9019f839d8d711c4ceecf73fa64fd780_NeikiAnalytics.exe 1868 9019f839d8d711c4ceecf73fa64fd780_NeikiAnalytics.exe 1868 9019f839d8d711c4ceecf73fa64fd780_NeikiAnalytics.exe 1868 9019f839d8d711c4ceecf73fa64fd780_NeikiAnalytics.exe 1868 9019f839d8d711c4ceecf73fa64fd780_NeikiAnalytics.exe 1868 9019f839d8d711c4ceecf73fa64fd780_NeikiAnalytics.exe 1868 9019f839d8d711c4ceecf73fa64fd780_NeikiAnalytics.exe 1868 9019f839d8d711c4ceecf73fa64fd780_NeikiAnalytics.exe 1868 9019f839d8d711c4ceecf73fa64fd780_NeikiAnalytics.exe 1868 9019f839d8d711c4ceecf73fa64fd780_NeikiAnalytics.exe 1868 9019f839d8d711c4ceecf73fa64fd780_NeikiAnalytics.exe 1868 9019f839d8d711c4ceecf73fa64fd780_NeikiAnalytics.exe 1868 9019f839d8d711c4ceecf73fa64fd780_NeikiAnalytics.exe 1868 9019f839d8d711c4ceecf73fa64fd780_NeikiAnalytics.exe 1868 9019f839d8d711c4ceecf73fa64fd780_NeikiAnalytics.exe 1868 9019f839d8d711c4ceecf73fa64fd780_NeikiAnalytics.exe 1868 9019f839d8d711c4ceecf73fa64fd780_NeikiAnalytics.exe 1868 9019f839d8d711c4ceecf73fa64fd780_NeikiAnalytics.exe 1868 9019f839d8d711c4ceecf73fa64fd780_NeikiAnalytics.exe 1868 9019f839d8d711c4ceecf73fa64fd780_NeikiAnalytics.exe 1868 9019f839d8d711c4ceecf73fa64fd780_NeikiAnalytics.exe 1868 9019f839d8d711c4ceecf73fa64fd780_NeikiAnalytics.exe 1868 9019f839d8d711c4ceecf73fa64fd780_NeikiAnalytics.exe 1868 9019f839d8d711c4ceecf73fa64fd780_NeikiAnalytics.exe 1868 9019f839d8d711c4ceecf73fa64fd780_NeikiAnalytics.exe 2368 explorer.exe 2368 explorer.exe 2368 explorer.exe 2368 explorer.exe 2368 explorer.exe 2368 explorer.exe 2368 explorer.exe 2368 explorer.exe 2368 explorer.exe 2368 explorer.exe 2368 explorer.exe 2368 explorer.exe 2368 explorer.exe 2368 explorer.exe 2368 explorer.exe 2368 explorer.exe 2368 explorer.exe 2368 explorer.exe 2368 explorer.exe 2368 explorer.exe 2368 explorer.exe 2368 explorer.exe 2368 explorer.exe 2368 explorer.exe 2368 explorer.exe 2368 explorer.exe 2368 explorer.exe 2368 explorer.exe 2368 explorer.exe 2368 explorer.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2368 explorer.exe 3520 svchost.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1868 9019f839d8d711c4ceecf73fa64fd780_NeikiAnalytics.exe 1868 9019f839d8d711c4ceecf73fa64fd780_NeikiAnalytics.exe 2368 explorer.exe 2368 explorer.exe 116 spoolsv.exe 116 spoolsv.exe 3520 svchost.exe 3520 svchost.exe 4268 spoolsv.exe 4268 spoolsv.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1868 wrote to memory of 2368 1868 9019f839d8d711c4ceecf73fa64fd780_NeikiAnalytics.exe 82 PID 1868 wrote to memory of 2368 1868 9019f839d8d711c4ceecf73fa64fd780_NeikiAnalytics.exe 82 PID 1868 wrote to memory of 2368 1868 9019f839d8d711c4ceecf73fa64fd780_NeikiAnalytics.exe 82 PID 2368 wrote to memory of 116 2368 explorer.exe 83 PID 2368 wrote to memory of 116 2368 explorer.exe 83 PID 2368 wrote to memory of 116 2368 explorer.exe 83 PID 116 wrote to memory of 3520 116 spoolsv.exe 84 PID 116 wrote to memory of 3520 116 spoolsv.exe 84 PID 116 wrote to memory of 3520 116 spoolsv.exe 84 PID 3520 wrote to memory of 4268 3520 svchost.exe 85 PID 3520 wrote to memory of 4268 3520 svchost.exe 85 PID 3520 wrote to memory of 4268 3520 svchost.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\9019f839d8d711c4ceecf73fa64fd780_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9019f839d8d711c4ceecf73fa64fd780_NeikiAnalytics.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4268
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Resources\spoolsv.exe
- Size 135KB
- SHA256 eba0f08787deeffbbd42fe9e393e3b67ce43275d6aa511c37bf58a2c143b21ae
- MD5 8ccd2dccb4215cb21839245bc649b087
- SHA1 d29a41059edd897d9c7bd1a6b2f85666395d8d93
- SHA512 5550857f6dd6e361a41f38ca8640e052d42e7b03f587f5ea8ba3c9e7d3de806906bf5ba27fff0592761604f3a9066bdebfb76df66d06f1063c64c1991fcfc484
- SSDEEP 1536:XfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbg0b:XVqoCl/YgjxEufVU0TbTyDDal3b
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Resources\svchost.exe
- Size 135KB
- SHA256 663baaffdcf4fbe0d90f105ff98435ae5abedc523c5259e1866bcbe0c553eaa2
- MD5 8577342884c1cac74592476bc433b407
- SHA1 5ad805ec111e423d47c07044af92f5eda0bbeb5d
- SHA512 4a6fe26cf4b35b4fbf3886f74e941c868e4ec5fe509afb62942ddffdf5b12f8dfcf80b9d524ce5692aa48f3fa1a299c117e768b2b60efd3d0b4a94fd9cb6c4a2
- SSDEEP 1536:XfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbg0W:XVqoCl/YgjxEufVU0TbTyDDal3W
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\windows\resources\themes\explorer.exe
- Size 135KB
- SHA256 cb6aaf672800c4105258e18bbb03cef1b44d42db490a1fed7fb6e7c19177670c
- MD5 0acb8c1daf470d239ecfdad7ddd09bb8
- SHA1 196bbe36ffb43db06efeac8de2ee3cfb8de7e84d
- SHA512 f9566bea5a120cf1697f271019dffc7fb8d195212e49b20d9c0d9473f08f595164beedfd3ccfc159129cca968b43d1f2acfba488c9d98081006b3c0f3a55568c
- SSDEEP 1536:XfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbg0y:XVqoCl/YgjxEufVU0TbTyDDal3y
- MD5 SHA1 SHA512 SSDEEP