Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 12:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a2d77f0ea46062efc4a32c16cdcd8410_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
a2d77f0ea46062efc4a32c16cdcd8410_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target a2d77f0ea46062efc4a32c16cdcd8410_NeikiAnalytics.exe
- Size 72KB
- Sample240603-n992vafb34
- SHA256 654b2c270e9e1d6d07265d716358c629d12035605f8a20400af36fd863410dc9
- MD5 a2d77f0ea46062efc4a32c16cdcd8410
- SHA1 f0a7c624ddd473f422e4a6aa06ba7126917c2a95
- SHA512 328d568ddb06fd9540a56d3b765ccfdaee2a391c3e42e93f7032d72e1ee7ded39de7efa7f0126d1ac7b69d7764dc69ccf2b108612fed6bf7baa9f7af0c2b3f8f
- SSDEEP 768:jP+w1owYOWJOao0KdDOXfLGiieXM89Oty/N/X+YVhP5itZfP6v+Xyt5:j+w1owcVfdJ8OEmNfP8Sv+A5
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" kaioz.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation a2d77f0ea46062efc4a32c16cdcd8410_NeikiAnalytics.exe - Executes dropped EXE 1 IoCs
pid Process 4708 kaioz.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaioz = "C:\\Users\\Admin\\kaioz.exe" kaioz.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe 4708 kaioz.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3148 a2d77f0ea46062efc4a32c16cdcd8410_NeikiAnalytics.exe 4708 kaioz.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3148 wrote to memory of 4708 3148 a2d77f0ea46062efc4a32c16cdcd8410_NeikiAnalytics.exe 91 PID 3148 wrote to memory of 4708 3148 a2d77f0ea46062efc4a32c16cdcd8410_NeikiAnalytics.exe 91 PID 3148 wrote to memory of 4708 3148 a2d77f0ea46062efc4a32c16cdcd8410_NeikiAnalytics.exe 91 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90 PID 4708 wrote to memory of 3148 4708 kaioz.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2d77f0ea46062efc4a32c16cdcd8410_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a2d77f0ea46062efc4a32c16cdcd8410_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\kaioz.exe"C:\Users\Admin\kaioz.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4332 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:81⤵PID:3488
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\kaioz.exe
- Size 72KB
- SHA256 bf0c886895cf0e31fcdc1b57724b3a44d3ec2a8a8aa2198599aefb119779297f
- MD5 007ab6286f33331cc8c8cc9cba4e663f
- SHA1 654181f6e44d24b55d75ed166230b84f4560da99
- SHA512 2aa7a2300e649853c7e412561d0fd68457789cc18fbdd60e843b3bc23858f9c8b654b521aa979ec8c5395f92bc242630f7f68a078797a57090b1e10046169cdc
- SSDEEP 768:joBw1owYOWJOaow/d8KXfLbd6NzQe/k+X+7k9Oty/N/X+YVhP5itZfP6v+Xyik:sBw1owcNfV6NzDc2+72EmNfP8Sv+7k
- MD5 SHA1 SHA512 SSDEEP