83e008af2866c030d2a19a545633d3e224ffbbfa24d731418c6546f469ed57a7

Analysis

max time kernel
140s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 02:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

980cd8e8692a878e8532f29cf3035070_NeikiAnalytics.exe
Size

212KB
MD5

980cd8e8692a878e8532f29cf3035070
SHA1

c607252213212dd8ae144d26544cd00c5d878de4
SHA256

83e008af2866c030d2a19a545633d3e224ffbbfa24d731418c6546f469ed57a7
SHA512

3be83070954aeec234bc7a74869290c18503b5070b3481ed04587b0c4e1b1ad878f0a468cc68b6fa5126a45896f3cfe56d6a49726ac8838dfb1b23f66d1314ad
SSDEEP

1536:0QqX1EEpwljTSWebPmgPB6FVqX+O3m/TkmL4oDHTjCWSpAnE5s:A1UpoqQ+ICakHdSpAnA

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3916	spoolsv.exe

Enumerates connected drives 3 TTPs 34 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	980cd8e8692a878e8532f29cf3035070_NeikiAnalytics.exe
File opened (read-only)	\??\P:	980cd8e8692a878e8532f29cf3035070_NeikiAnalytics.exe
File opened (read-only)	\??\Q:	980cd8e8692a878e8532f29cf3035070_NeikiAnalytics.exe
File opened (read-only)	\??\J:	spoolsv.exe
File opened (read-only)	\??\J:	980cd8e8692a878e8532f29cf3035070_NeikiAnalytics.exe
File opened (read-only)	\??\K:	980cd8e8692a878e8532f29cf3035070_NeikiAnalytics.exe
File opened (read-only)	\??\N:	spoolsv.exe
File opened (read-only)	\??\O:	980cd8e8692a878e8532f29cf3035070_NeikiAnalytics.exe
File opened (read-only)	\??\K:	spoolsv.exe
File opened (read-only)	\??\R:	980cd8e8692a878e8532f29cf3035070_NeikiAnalytics.exe
File opened (read-only)	\??\L:	spoolsv.exe
File opened (read-only)	\??\E:	980cd8e8692a878e8532f29cf3035070_NeikiAnalytics.exe
File opened (read-only)	\??\M:	980cd8e8692a878e8532f29cf3035070_NeikiAnalytics.exe
File opened (read-only)	\??\Q:	spoolsv.exe
File opened (read-only)	\??\S:	spoolsv.exe
File opened (read-only)	\??\E:	spoolsv.exe
File opened (read-only)	\??\I:	spoolsv.exe
File opened (read-only)	\??\T:	spoolsv.exe
File opened (read-only)	\??\O:	spoolsv.exe
File opened (read-only)	\??\R:	spoolsv.exe
File opened (read-only)	\??\I:	980cd8e8692a878e8532f29cf3035070_NeikiAnalytics.exe
File opened (read-only)	\??\L:	980cd8e8692a878e8532f29cf3035070_NeikiAnalytics.exe
File opened (read-only)	\??\S:	980cd8e8692a878e8532f29cf3035070_NeikiAnalytics.exe
File opened (read-only)	\??\V:	980cd8e8692a878e8532f29cf3035070_NeikiAnalytics.exe
File opened (read-only)	\??\G:	spoolsv.exe
File opened (read-only)	\??\M:	spoolsv.exe
File opened (read-only)	\??\G:	980cd8e8692a878e8532f29cf3035070_NeikiAnalytics.exe
File opened (read-only)	\??\H:	980cd8e8692a878e8532f29cf3035070_NeikiAnalytics.exe
File opened (read-only)	\??\P:	spoolsv.exe
File opened (read-only)	\??\U:	spoolsv.exe
File opened (read-only)	\??\T:	980cd8e8692a878e8532f29cf3035070_NeikiAnalytics.exe
File opened (read-only)	\??\U:	980cd8e8692a878e8532f29cf3035070_NeikiAnalytics.exe
File opened (read-only)	\??\H:	spoolsv.exe
File opened (read-only)	\??\V:	spoolsv.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\spoolsv.exe	980cd8e8692a878e8532f29cf3035070_NeikiAnalytics.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BFWorkFile1007PV	980cd8e8692a878e8532f29cf3035070_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BFWorkFile1007PV\EFile = "051045064052044078097225048044098122041066221139242028041045168023045089248224035222123098241224180174111077041168161101059035201049177056004"	980cd8e8692a878e8532f29cf3035070_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BFWorkFile1007PV\DFile	980cd8e8692a878e8532f29cf3035070_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BFWorkFile1007PV	spoolsv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BFWorkFile1007PV\DFile	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2248	980cd8e8692a878e8532f29cf3035070_NeikiAnalytics.exe
2248	980cd8e8692a878e8532f29cf3035070_NeikiAnalytics.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3916	spoolsv.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 3916	2248	980cd8e8692a878e8532f29cf3035070_NeikiAnalytics.exe	82
PID 2248 wrote to memory of 3916	2248	980cd8e8692a878e8532f29cf3035070_NeikiAnalytics.exe	82
PID 2248 wrote to memory of 3916	2248	980cd8e8692a878e8532f29cf3035070_NeikiAnalytics.exe	82

C:\Users\Admin\AppData\Local\Temp\980cd8e8692a878e8532f29cf3035070_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\980cd8e8692a878e8532f29cf3035070_NeikiAnalytics.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Program Files (x86)\spoolsv.exe
  "C:\Program Files (x86)\spoolsv.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\spoolsv.exe

Filesize
212KB

MD5
a9b752b173638329fd28b528c5cf4167

SHA1
8c6ab338bc32464f6a02839d72e1b86f1818bdbe

SHA256
0c532ec78f17694571f3d4a3b1a05574edda6d85615887021d7b0e924fa426cd

SHA512
34ee8a1ca0f9c3a83fcfeb4a7b8ab1a566840029367d98df0ff92851b52219a73b63debea5df09de0e4297b6e4963867c37cc94036b12feadf6fb2ffa549fe6b

Download Submit
memory/2248-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3916-6-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3916-17-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3916-18-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download