Analysis
- max time kernel
150s - max time network
93s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 13:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a52082258500e1ed2a14f1ab29583910_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
a52082258500e1ed2a14f1ab29583910_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target a52082258500e1ed2a14f1ab29583910_NeikiAnalytics.exe
- Size 139KB
- Sample240603-qv63ragb71
- SHA256 364aa0762c4e6b8b840b16a9fd5714f939db885c01abe8e3b17a6e6c52a0ed6a
- MD5 a52082258500e1ed2a14f1ab29583910
- SHA1 3e9c36929d5b62f7c6de0fa94d2e6553318aafc3
- SHA512 99d52a6126976ed8e37304ac45b2fd5b315da7df9e1ab045fd0235c8bb7c8c5c33ed8aa6b1f22e3943371340c438f14b983d366fdafb51c565cf613fdc5842ab
- SSDEEP 1536:ofsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbpwkZ:oVqoCl/YgjxEufVU0TbTyDDalxZ
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Executes dropped EXE 4 IoCs
pid Process 2400 explorer.exe 4120 spoolsv.exe 2724 svchost.exe 2112 spoolsv.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\themes\explorer.exe a52082258500e1ed2a14f1ab29583910_NeikiAnalytics.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1100 a52082258500e1ed2a14f1ab29583910_NeikiAnalytics.exe 1100 a52082258500e1ed2a14f1ab29583910_NeikiAnalytics.exe 1100 a52082258500e1ed2a14f1ab29583910_NeikiAnalytics.exe 1100 a52082258500e1ed2a14f1ab29583910_NeikiAnalytics.exe 1100 a52082258500e1ed2a14f1ab29583910_NeikiAnalytics.exe 1100 a52082258500e1ed2a14f1ab29583910_NeikiAnalytics.exe 1100 a52082258500e1ed2a14f1ab29583910_NeikiAnalytics.exe 1100 a52082258500e1ed2a14f1ab29583910_NeikiAnalytics.exe 1100 a52082258500e1ed2a14f1ab29583910_NeikiAnalytics.exe 1100 a52082258500e1ed2a14f1ab29583910_NeikiAnalytics.exe 1100 a52082258500e1ed2a14f1ab29583910_NeikiAnalytics.exe 1100 a52082258500e1ed2a14f1ab29583910_NeikiAnalytics.exe 1100 a52082258500e1ed2a14f1ab29583910_NeikiAnalytics.exe 1100 a52082258500e1ed2a14f1ab29583910_NeikiAnalytics.exe 1100 a52082258500e1ed2a14f1ab29583910_NeikiAnalytics.exe 1100 a52082258500e1ed2a14f1ab29583910_NeikiAnalytics.exe 1100 a52082258500e1ed2a14f1ab29583910_NeikiAnalytics.exe 1100 a52082258500e1ed2a14f1ab29583910_NeikiAnalytics.exe 1100 a52082258500e1ed2a14f1ab29583910_NeikiAnalytics.exe 1100 a52082258500e1ed2a14f1ab29583910_NeikiAnalytics.exe 1100 a52082258500e1ed2a14f1ab29583910_NeikiAnalytics.exe 1100 a52082258500e1ed2a14f1ab29583910_NeikiAnalytics.exe 1100 a52082258500e1ed2a14f1ab29583910_NeikiAnalytics.exe 1100 a52082258500e1ed2a14f1ab29583910_NeikiAnalytics.exe 1100 a52082258500e1ed2a14f1ab29583910_NeikiAnalytics.exe 1100 a52082258500e1ed2a14f1ab29583910_NeikiAnalytics.exe 1100 a52082258500e1ed2a14f1ab29583910_NeikiAnalytics.exe 1100 a52082258500e1ed2a14f1ab29583910_NeikiAnalytics.exe 1100 a52082258500e1ed2a14f1ab29583910_NeikiAnalytics.exe 1100 a52082258500e1ed2a14f1ab29583910_NeikiAnalytics.exe 1100 a52082258500e1ed2a14f1ab29583910_NeikiAnalytics.exe 1100 a52082258500e1ed2a14f1ab29583910_NeikiAnalytics.exe 1100 a52082258500e1ed2a14f1ab29583910_NeikiAnalytics.exe 1100 a52082258500e1ed2a14f1ab29583910_NeikiAnalytics.exe 2400 explorer.exe 2400 explorer.exe 2400 explorer.exe 2400 explorer.exe 2400 explorer.exe 2400 explorer.exe 2400 explorer.exe 2400 explorer.exe 2400 explorer.exe 2400 explorer.exe 2400 explorer.exe 2400 explorer.exe 2400 explorer.exe 2400 explorer.exe 2400 explorer.exe 2400 explorer.exe 2400 explorer.exe 2400 explorer.exe 2400 explorer.exe 2400 explorer.exe 2400 explorer.exe 2400 explorer.exe 2400 explorer.exe 2400 explorer.exe 2400 explorer.exe 2400 explorer.exe 2400 explorer.exe 2400 explorer.exe 2400 explorer.exe 2400 explorer.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2400 explorer.exe 2724 svchost.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1100 a52082258500e1ed2a14f1ab29583910_NeikiAnalytics.exe 1100 a52082258500e1ed2a14f1ab29583910_NeikiAnalytics.exe 2400 explorer.exe 2400 explorer.exe 4120 spoolsv.exe 4120 spoolsv.exe 2724 svchost.exe 2724 svchost.exe 2112 spoolsv.exe 2112 spoolsv.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1100 wrote to memory of 2400 1100 a52082258500e1ed2a14f1ab29583910_NeikiAnalytics.exe 81 PID 1100 wrote to memory of 2400 1100 a52082258500e1ed2a14f1ab29583910_NeikiAnalytics.exe 81 PID 1100 wrote to memory of 2400 1100 a52082258500e1ed2a14f1ab29583910_NeikiAnalytics.exe 81 PID 2400 wrote to memory of 4120 2400 explorer.exe 82 PID 2400 wrote to memory of 4120 2400 explorer.exe 82 PID 2400 wrote to memory of 4120 2400 explorer.exe 82 PID 4120 wrote to memory of 2724 4120 spoolsv.exe 83 PID 4120 wrote to memory of 2724 4120 spoolsv.exe 83 PID 4120 wrote to memory of 2724 4120 spoolsv.exe 83 PID 2724 wrote to memory of 2112 2724 svchost.exe 84 PID 2724 wrote to memory of 2112 2724 svchost.exe 84 PID 2724 wrote to memory of 2112 2724 svchost.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\a52082258500e1ed2a14f1ab29583910_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a52082258500e1ed2a14f1ab29583910_NeikiAnalytics.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1100 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4120 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2112
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Resources\Themes\explorer.exe
- Size 139KB
- SHA256 bcfcc5323176b58d45c598b0a2c7b2248d677b48c48a24b88303f5c86fbfcef5
- MD5 d0fcdb0d58d97d8fadc386b23839e554
- SHA1 40ae705147060e81b85ceaa70593958483e36632
- SHA512 391756e650793069f9dbc1117849936465feddc76b29973f495906460570ab3d64cae01dd5efbb7f9126347a87561b5f1001185db1c5e5debc1e9510714feb49
- SSDEEP 1536:ofsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbpwk4:oVqoCl/YgjxEufVU0TbTyDDalx4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Resources\spoolsv.exe
- Size 139KB
- SHA256 75bd358eeb5f4dcb7f2ab9b682d461b89d99f1b07376307793c83d87c96b8a94
- MD5 fa3201efde287709efc83b050f336525
- SHA1 2e09f3285c75961b0b1394ecefd255fd9b4f8923
- SHA512 cb2997728fb342f4a22acaaa369255c0ce47cc8d7af08d279fd37fd9a6f369b9dbbb2ead2a5959d1223a69b9812364f22e272191b54d38fb7678565c7b3d4c53
- SSDEEP 1536:ofsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbpwk+:oVqoCl/YgjxEufVU0TbTyDDalx+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Resources\svchost.exe
- Size 139KB
- SHA256 cd126f44c7a6ced9907d1a028bd49e6e400361609c97cd68cab019df1652ddac
- MD5 5be8697100aa62696af5e62536c127e7
- SHA1 ab8f49fabcebd15d65515f6c6c162045dde6b7b3
- SHA512 2e019755b3b7b786abd9f334982a714e535ce60bfd82cdb6d329806061c5fa46813349989d03f00ed6433a3bc78524fea26469256a1ddd4c8011e556fbf409f4
- SSDEEP 1536:ofsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbpwkv:oVqoCl/YgjxEufVU0TbTyDDalxv
- MD5 SHA1 SHA512 SSDEEP