Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
02/06/2024, 22:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
77b990a3474f3595287db4f9eec6f9d0_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
77b990a3474f3595287db4f9eec6f9d0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 77b990a3474f3595287db4f9eec6f9d0_NeikiAnalytics.exe
- Size 90KB
- Sample240602-2hrm3she5x
- SHA256 074e91ad0acdef9cd59c79633eb0de96c5b5d933eb3eac87388e6f8915073da7
- MD5 77b990a3474f3595287db4f9eec6f9d0
- SHA1 ef2bb72c06f32c8f43a91716ccbf8f5d61fa8272
- SHA512 99eb3b15cfc547664464e49a115649edecbe45a1fe8f8c0f14eedc0fa603b0b20f071299be8c96f94c998239f458fbeab65c3ca306213604cb2c10ef8f6d179f
- SSDEEP 1536:bfmto48HyF8e/O+TtSv6DhjFEA5n6qtvmzrRptAi858J8MGu1v3i6EG:X4y3
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 77b990a3474f3595287db4f9eec6f9d0_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" fupew.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation 77b990a3474f3595287db4f9eec6f9d0_NeikiAnalytics.exe - Executes dropped EXE 1 IoCs
pid Process 2868 fupew.exe - Adds Run key to start application 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fupew = "C:\\Users\\Admin\\fupew.exe /v" fupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fupew = "C:\\Users\\Admin\\fupew.exe /r" fupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fupew = "C:\\Users\\Admin\\fupew.exe /n" fupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fupew = "C:\\Users\\Admin\\fupew.exe /u" fupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fupew = "C:\\Users\\Admin\\fupew.exe /p" fupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fupew = "C:\\Users\\Admin\\fupew.exe /g" fupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fupew = "C:\\Users\\Admin\\fupew.exe /d" fupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fupew = "C:\\Users\\Admin\\fupew.exe /b" fupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fupew = "C:\\Users\\Admin\\fupew.exe /q" fupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fupew = "C:\\Users\\Admin\\fupew.exe /s" fupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fupew = "C:\\Users\\Admin\\fupew.exe /y" fupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fupew = "C:\\Users\\Admin\\fupew.exe /j" fupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fupew = "C:\\Users\\Admin\\fupew.exe /h" fupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fupew = "C:\\Users\\Admin\\fupew.exe /t" fupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fupew = "C:\\Users\\Admin\\fupew.exe /i" fupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fupew = "C:\\Users\\Admin\\fupew.exe /u" 77b990a3474f3595287db4f9eec6f9d0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fupew = "C:\\Users\\Admin\\fupew.exe /w" fupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fupew = "C:\\Users\\Admin\\fupew.exe /x" fupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fupew = "C:\\Users\\Admin\\fupew.exe /a" fupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fupew = "C:\\Users\\Admin\\fupew.exe /e" fupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fupew = "C:\\Users\\Admin\\fupew.exe /c" fupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fupew = "C:\\Users\\Admin\\fupew.exe /l" fupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fupew = "C:\\Users\\Admin\\fupew.exe /z" fupew.exe Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fupew = "C:\\Users\\Admin\\fupew.exe /f" fupew.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2712 77b990a3474f3595287db4f9eec6f9d0_NeikiAnalytics.exe 2712 77b990a3474f3595287db4f9eec6f9d0_NeikiAnalytics.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe 2868 fupew.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2712 77b990a3474f3595287db4f9eec6f9d0_NeikiAnalytics.exe 2868 fupew.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2712 wrote to memory of 2868 2712 77b990a3474f3595287db4f9eec6f9d0_NeikiAnalytics.exe 94 PID 2712 wrote to memory of 2868 2712 77b990a3474f3595287db4f9eec6f9d0_NeikiAnalytics.exe 94 PID 2712 wrote to memory of 2868 2712 77b990a3474f3595287db4f9eec6f9d0_NeikiAnalytics.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\77b990a3474f3595287db4f9eec6f9d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\77b990a3474f3595287db4f9eec6f9d0_NeikiAnalytics.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\fupew.exe"C:\Users\Admin\fupew.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2868
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\fupew.exe
- Size 90KB
- SHA256 3930a8de81bad3031cdaf447c71754a191e3a67aeb007bce6bcb96120fa6e660
- MD5 18de0e476487fab3fdd9eeea2684b011
- SHA1 84cc4def2fe7e520f4674b5b3694ebefc38971b3
- SHA512 e254432161fc49fafe8ad352c7c37c70e4d46b6e6fc179c3eb58a2806ed8cc15f4ec5ff978428e2fc9db50a1f424178ccadfa16e297bef8cee14fb808ea340cf
- SSDEEP 1536:bvmto44yF8e/O+TtSv6DhjFEA5n6qtvmzrRptAi858J8MGu1v3i6EG:X4U3
- MD5 SHA1 SHA512 SSDEEP