Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 03:27
Behavioral task
behavioral1
Sample
99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe
- Size 2.5MB
- Sample240603-dz9yzsah92
- SHA256 c0cb5176e58fcddffc859b6b1b8ed748aa0765714589874f0fec915dc16f730a
- MD5 99daad51887eff4fdbed7da63e120d30
- SHA1 530a370ad6bcc440af51ab76559af980bc1f0874
- SHA512 fd2e1bdb33a87b86191769f85136fcfe24f32cef6f8c31d5c9e73ffdc9bc18e7b4760af9095be9a2f7d6012c56eaf8e6c2c5c237153b553b6a8df082650ad693
- SSDEEP 49152:dxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyxo:dxx9NUFkQx753uWuCyyxo
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ svchost.exe - Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe - Executes dropped EXE 4 IoCs
pid Process 2140 explorer.exe 4612 spoolsv.exe 2896 svchost.exe 2612 spoolsv.exe -
resource yara_rule behavioral2/memory/4592-0-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/files/0x00080000000234a5-8.dat themida behavioral2/memory/2140-10-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/files/0x00080000000234a6-15.dat themida behavioral2/memory/4612-19-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/files/0x00080000000234a9-27.dat themida behavioral2/memory/2896-28-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/2612-33-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/2612-38-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/4612-41-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/4592-42-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/2140-43-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/2896-44-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/2140-55-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/2896-62-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/2896-66-0x0000000000400000-0x0000000000A0E000-memory.dmp themida - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorer.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 4592 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe 2140 explorer.exe 4612 spoolsv.exe 2896 svchost.exe 2612 spoolsv.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\themes\explorer.exe 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4592 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe 4592 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe 4592 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe 4592 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe 4592 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe 4592 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe 4592 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe 4592 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe 4592 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe 4592 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe 4592 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe 4592 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe 4592 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe 4592 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe 4592 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe 4592 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe 4592 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe 4592 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe 4592 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe 4592 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe 4592 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe 4592 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe 4592 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe 4592 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe 4592 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe 4592 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe 4592 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe 4592 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe 4592 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe 4592 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe 4592 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe 4592 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe 4592 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe 4592 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe 2140 explorer.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2140 explorer.exe 2896 svchost.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 4592 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe 4592 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe 2140 explorer.exe 2140 explorer.exe 4612 spoolsv.exe 4612 spoolsv.exe 2896 svchost.exe 2896 svchost.exe 2612 spoolsv.exe 2612 spoolsv.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4592 wrote to memory of 2140 4592 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe 83 PID 4592 wrote to memory of 2140 4592 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe 83 PID 4592 wrote to memory of 2140 4592 99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe 83 PID 2140 wrote to memory of 4612 2140 explorer.exe 85 PID 2140 wrote to memory of 4612 2140 explorer.exe 85 PID 2140 wrote to memory of 4612 2140 explorer.exe 85 PID 4612 wrote to memory of 2896 4612 spoolsv.exe 87 PID 4612 wrote to memory of 2896 4612 spoolsv.exe 87 PID 4612 wrote to memory of 2896 4612 spoolsv.exe 87 PID 2896 wrote to memory of 2612 2896 svchost.exe 88 PID 2896 wrote to memory of 2612 2896 svchost.exe 88 PID 2896 wrote to memory of 2612 2896 svchost.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\99daad51887eff4fdbed7da63e120d30_NeikiAnalytics.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:2612
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Resources\Themes\explorer.exe
- Size 2.5MB
- SHA256 6aa4215ae2a0e548fab73843fa3839ab003896a0a7268154d2f5f291ec9130db
- MD5 7ea3e50e9aed4e776953cd7bab20168d
- SHA1 40f90a296e3b1aae133089ea635f2ff328585c08
- SHA512 bc580a7796f85ef75b58606f0702505c26f81ad5e0779db3ae93a32aa42b819a3a9d30665f752e1664d6b7ae5786a11e4428487a4e9a0aaea81dadf1c6fb37aa
- SSDEEP 49152:dxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyxE:dxx9NUFkQx753uWuCyyxE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Resources\spoolsv.exe
- Size 2.5MB
- SHA256 ed691e733032dded41743bfdb14f61b3c12f262c9ef933c521834fdfbcad1326
- MD5 301b8b14e1dcaa4e253ea11016a23e5e
- SHA1 fdfa11ab465654d44a7c58bd587eee957605c4cc
- SHA512 c82addac0936d7c168e4e89bd247721d9e84907fb179b55442813d9755b7ac6c1af4797f5cbe5adb8ffc8815d7cce8b8dd51f742007e974994912669acc5db40
- SSDEEP 49152:dxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyxP:dxx9NUFkQx753uWuCyyxP
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\windows\resources\svchost.exe
- Size 2.5MB
- SHA256 8e39f3304115b918f28030d6fa39f31047d3cbe83ce418881bb6aaafd7ed363d
- MD5 fefea540d18f133e6b97fe1d272e6fe6
- SHA1 cec0f6d55b51b8e7ec59b9a2723075bb2dc61ee0
- SHA512 075a2f9a979edde826a81e346e966a06bebaa89adfb9ea4868f0be207d4531d4a19c0e64925adbbade8d9e886dee55903aa64db3aa126147cff74b0dcbcaface
- SSDEEP 49152:dxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyxF:dxx9NUFkQx753uWuCyyxF
- MD5 SHA1 SHA512 SSDEEP