51eade92812328b91a4598f30f618360545b24f0810a6a0ff6de396ed1aa5965

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 05:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
346769d0be51619911c10a2f5f427740_NeikiAnalytics.exe
Size 42KB
Sample240604-ghyfeafb6w
SHA256 51eade92812328b91a4598f30f618360545b24f0810a6a0ff6de396ed1aa5965
MD5 346769d0be51619911c10a2f5f427740
SHA1 a58a6657436b0bc94a0e656cd592b8f6fec66c39
SHA512 2c22ac7b4de73d6e9a18cdea18ef1313ba67bba3c1b9cb60861662987d90d6322054eaf5d77f6e00f319063131c0152da0d794867faee08f2aff1f1c553ece17
SSDEEP 768:tdAkXGqv1GypfcHrk1DqAHNS/BHPmeWcTeYdC9VOV0rxAdeVQe:tdAkXGqECcwYgw9PNSa0Gle
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

microsoft persistence phishing product:outlook upx

Malware Config

Signatures

Detected microsoft outlook phishing page
phishing microsoft product:outlook

Executes dropped EXE 1 IoCs

pid	Process
4480	services.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000800000002326c-4.dat	upx
behavioral2/memory/4480-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4480-13-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4480-17-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4480-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4480-22-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4480-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4480-30-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4480-31-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4480-87-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4480-270-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4480-271-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4480-275-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4480-276-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4480-469-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4480-572-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	346769d0be51619911c10a2f5f427740_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	346769d0be51619911c10a2f5f427740_NeikiAnalytics.exe
File opened for modification	C:\Windows\java.exe	346769d0be51619911c10a2f5f427740_NeikiAnalytics.exe
File created	C:\Windows\java.exe	346769d0be51619911c10a2f5f427740_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 4480	4832	346769d0be51619911c10a2f5f427740_NeikiAnalytics.exe	91
PID 4832 wrote to memory of 4480	4832	346769d0be51619911c10a2f5f427740_NeikiAnalytics.exe	91
PID 4832 wrote to memory of 4480	4832	346769d0be51619911c10a2f5f427740_NeikiAnalytics.exe	91

C:\Users\Admin\AppData\Local\Temp\346769d0be51619911c10a2f5f427740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\346769d0be51619911c10a2f5f427740_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:4480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4440 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:3348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

UCXQC3FU.htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8ZO46T3J\UCXQC3FU.htm
Size 176KB
SHA256 28842dc8bcfab8099f6cff18fe6f85682843155df37c205bffd0c55ca907d096
MD5 5d112122789caf3997e4de8c7f16529b
SHA1 2ef9463e29279d16858bd6dcf15db4c57682dd44
SHA512 950e9a3933c7660ae532026385666988c0aa84d82450ea39e1b9f896ae22776e479b654c488c3e2be6853fe64da3cbfb4f38b8095dd34bd21a669f7afd1ca5a2
SSDEEP 1536:4jADsyoamI1MGAzVbGAQU7+P1S0kyFK++zG58TJLDPbNnoamI1MGoamI1MdWMi6G:bWIeGAzVCbS0ZK+QG58TJLCIetIeqfdT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Y2HN2AQV.htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8ZO46T3J\Y2HN2AQV.htm
Size 176KB
SHA256 60b212113e35d520ef73e236ed1bb80ca1c97c41e1fa15e18a95a2ddc95bfaf8
MD5 c680af1252fa6c6609ae2db5c7393e8a
SHA1 9dacc26169b795a6043fef6806228c711d961cc1
SHA512 8055fa7efbc7494936552d0d71e566ca72114fbd01fd230198b156f8e7380e8ca988b13473b6512506d2441a29c2610b01dae4723f7babddb8747ccb29a6790d
SSDEEP 1536:4jDDsAoamI1MGAzVbGAQU7+P1S0kyFK++zG58TJLDPCNkoamI1MGoamI1MdBUQkN:QsIeGAzVCbS0ZK+QG58TJLSIetIevNET
MD5 SHA1 SHA512 SSDEEP

Submit Download

results[5].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8ZO46T3J\results[5].htm
Size 1KB
SHA256 a4e6ba8c1fe3df423e6f17fcbeeaa7e90e2bd2fffe8f98ff4b3e6ed970e32c61
MD5 ee4aed56584bf64c08683064e422b722
SHA1 45e5ba33f57c6848e84b66e7e856a6b60af6c4a8
SHA512 058f023cb934a00c8f1c689001438c9bdd067d923ddcbe7a951f54d3ca82218803e0e81fbc9af5c56375ff7961deed0359af1ffa7335d41379ee97d01a76ded6
MD5 SHA1 SHA512

Submit Download

search[10].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8ZO46T3J\search[10].htm
Size 141KB
SHA256 446bfa67ef1b6ffac3fdd07fda5f6686758ae7a6079b79dda20ef146bed00e58
MD5 19eda4f066432fbfb2cc23713daf2ae2
SHA1 d0f13be2b1cf9c17094f41d3699d04e2cf7291f5
SHA512 e2396243469399f7bf247ad1bac4042bcb1661f0f07c2897f7857b080455297cda19a954ea50077ed260f09b0a876bde4f82f6f214a7cf49a3a249e938b6d555
SSDEEP 3072:2WIePIFVPVS2V/0GJKardtw7fHCjQ3Kfrp8edhS23n3dPXxjDp878L8a8c8q8X8k:2lFmgQX5HM6OCbh
MD5 SHA1 SHA512 SSDEEP

Submit Download

default[2].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BHC2O5WS\default[2].htm
Size 312B
SHA256 5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7
MD5 c15952329e9cd008b41f979b6c76b9a2
SHA1 53c58cc742b5a0273df8d01ba2779a979c1ff967
SHA512 6aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296
MD5 SHA1 SHA512

Submit Download

search[2].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BHC2O5WS\search[2].htm
Size 25B
SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
MD5 8ba61a16b71609a08bfa35bc213fce49
SHA1 8374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA512 5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
MD5 SHA1 SHA512

Submit Download

search[3].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BHC2O5WS\search[3].htm
Size 114KB
SHA256 8e175b8b6816bfbaf4eeba0cfcb8dafd63023f3df6bf9d3564ab49f16344f7a3
MD5 320c86aa35b3732486be23c01447a4a2
SHA1 e8500da6dfcb592070e1efc67e2230a64883b758
SHA512 eecfdbcb56829fb43998d129324c1299ae55a526db75862415732dc955b1b656377cb3f1d74975fadd7c3c246d44bbc6f612ec48f2b98a2a4f6c1501faa470cd
SSDEEP 3072:oWIeRFFRIeuD1CkP+NyGjYTaefjR8d8c8HICAnv:oeFz65oCev
MD5 SHA1 SHA512 SSDEEP

Submit Download

CCKB4WCP.htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\CCKB4WCP.htm
Size 176KB
SHA256 55563ee9055ba22ab6c7d91bc9f79acbe841b7c2ce88f01f3181ef6d809eb380
MD5 453296676bf6591a55a5fe3a6239bbbc
SHA1 22ba08f6a934d00247365eefe60eaa098ae58595
SHA512 7b8e05ac3c7be1d2434fff625507fdee41fa0c7be4237440a879a95c167f980704296fcb1420faa1fae442919f803cd3f42e0d9c6aa274cb2fb8a9e7591a9c46
SSDEEP 1536:4j8DsKoamI1MGAzVbGAQU7+P1S0kyFK++zG58TJLDPPNToamI1MGoamI1MdM0y4T:XiIeGAzVCbS0ZK+QG58TJLqIetIeIcT
MD5 SHA1 SHA512 SSDEEP

Submit Download

results[4].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\results[4].htm
Size 1KB
SHA256 aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5
MD5 211da0345fa466aa8dbde830c83c19f8
SHA1 779ece4d54a099274b2814a9780000ba49af1b81
SHA512 37fd7ef6e11a1866e844439318ae813059106fbd52c24f580781d90da3f64829cf9654acac0dd0f2098081256c5dcdf35c70b2cbef6cbe3f0b91bd2d8edd22ca
MD5 SHA1 SHA512

Submit Download

search[3].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\search[3].htm
Size 145KB
SHA256 a9fdf80514398520da7b3a227a14b4d63705132c9c54eea92b54591e4e2ecfb9
MD5 fa1ad3fb35481e5413553df797acb53a
SHA1 37a03e9cedee2dbb691fddc2bc3852f477ef99f5
SHA512 97c69e652792d5726cf6188c9ce2e582b4061e491c63eeb2f6cbc495d1b9b49c868a64dd1b999617175c01d54c0b7a3b206097e6a3a8ab7479325838724fbf20
SSDEEP 3072:4WIeNhnQLjgIKTuFXUF70S0csg3LnnBkxCwjA/yaCppbTZw/XvvQGLxzPf8V8x8U:44FaMA0Ot5RJCbVJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

search5YZVT4J6.htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X0OFMNIL\search5YZVT4J6.htm
Size 140KB
SHA256 d79e1deaee026b298e3a9a50ae03056e40d295fbfaa120ca6c56a364ab4277ad
MD5 5718680cae0981b863c89cf1e16ec874
SHA1 ce156c37fec7152555b7c6ec62ba794d75f78615
SHA512 2857e3c8dbf0ae36280b11be181be08f387ddce8b6142522aba79e0d7fb0216cc0ff59f81006f7875b0384fb61b6e0d44a014798cae2702e5c3713b531a57773
SSDEEP 3072:sWIeHSX/FCv/8g42KpMsxUPqF5Q6ANpM8r8u8O8V8n8n8o8Zo7rqMx:szF0O/Awb7i881y7uu
MD5 SHA1 SHA512 SSDEEP

Submit Download

searchO3CUJH46.htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X0OFMNIL\searchO3CUJH46.htm
Size 114KB
SHA256 ab8c8aa83d26a2d60a94339985c0d8af0e5d4af0aa7ec4d0308d07df64ec1e62
MD5 70f5601e6b5e09a02e7dabd4cb668daf
SHA1 9484ca176fa6f110aa537dbec91a2b919ba5b421
SHA512 9f98434909fb10693f9af028990b7f4a8a0539b35a80c7c8f59d7166c792f124d8c2cbed727e74df5a1af845051efb184ced869696dd20cb44d1f380d8dc4e1c
SSDEEP 3072:6WIezxF7vppOJSLi0ft3bag83858R8A8f8v8X8V/yZt9:6cFlesGu9kUMhyv9
MD5 SHA1 SHA512 SSDEEP

Submit Download

search[5].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X0OFMNIL\search[5].htm
Size 158KB
SHA256 1ff872c5224996ef297981a77120264e2486a27250be991b850619f90091df08
MD5 17c6689bf5ebcb95ee2ca87ce82f0367
SHA1 f02448e8c59af14027e109ec810cd2edf6a6b8be
SHA512 9aa87a49d51e2d07a738c60dd60e43772d29d4ef5b1021a1f434038bd582235d5b006827d34d26a5746e3fdecf6dbd8da0525205313b9b09a9a52f4701154bd1
SSDEEP 3072:iWIe40HMDbsUODSs6pFhd/zz5x1OJua9bfUEUmcEiT09axXnaq3rObABm8/8d8j8:i3FKQE6YznOdQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

search[6].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X0OFMNIL\search[6].htm
Size 109KB
SHA256 bc899766df4d32b66157c8e0cc570759ec01dd7ce25f7ec53b85ed572f81eff3
MD5 7cd3efcf7bd746679b0584f24e4575a7
SHA1 7f90b36714f58af19c324e9550fd0ab296ef8c9d
SHA512 f01172699a6721f8b4ba381eae49abfa0605613601109bb3efc6566a292b080f06da685512dd798f6f1dd90bae262939dd1938e2175f9942eff360e32da60b8a
SSDEEP 3072:GWIeq+FUTVlD6wBJ1bBi848m8L8K8I868u89DO0lc:GEFAljQnV3bpOMc
MD5 SHA1 SHA512 SSDEEP

Submit Download

search[7].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X0OFMNIL\search[7].htm
Size 109KB
SHA256 b990e2e629d7b002a9ae80df1e3d7ff93846fc34156042fb9e4f26f143311333
MD5 1d8ad0a136a6298869bceaff0254030e
SHA1 8fb6956e241993d2343544db68d4fd2371935d80
SHA512 3e56d0369db43d64be5e18e89db004fce185b90b3595cd0801f56ff16ac9bf8ce1a350ed82edd9794de0094e03ec9c301052c2a0d2a99d10179d5dd044aeb662
SSDEEP 3072:OWIeCjFJVXKNl5ISQqcP8t8/8d8D8R8z8J876pmZj:ONFcqE64uI2epSj
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp3706.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp3706.tmp
Size 42KB
SHA256 638720c8c392b2ed627aa523e06c46b2fb72ff6625df1c92e490b31787d0b79a
MD5 8c9b30bf41aa6f4964bd4e6d83d0e2d4
SHA1 c5ef4c88d8c4b0d44870f6ed338fb777dbe6dfaa
SHA512 308b87a898cad174836415905bd42b63ffaa176b200f5b8e450312b38e2c75f49edbc6612e338a119852af9a858ccef63da7486016e2c345fab118f377ca638a
SSDEEP 768:tdAkXGqv1GypfcHrk1DqAHNS/BHPmeWcTeYdC9VOV0rxAdeVD:tdAkXGqECcwYgw9PNSa0Gq
MD5 SHA1 SHA512 SSDEEP

Submit Download

zincite.log

Path C:\Users\Admin\AppData\Local\Temp\zincite.log
Size 96B
SHA256 281cf1f9b8e807d81d12de03395ee3dc3301edcdbea6f62bc74e06fb488766a6
MD5 328bcac063202f42dc620a9533b34e71
SHA1 08d15f2ce2901e81dfc388b1e5077cf46b226292
SHA512 e120b0749a6f605cb87489c26c06c286cf29b7d764fbe3401bf8a420ad978c7a8ffcda09936a86f2967eb0a4cb77b0fe252fbf0ca1cd6df9c8c01062f5163e9e
MD5 SHA1 SHA512

Submit Download

zincite.log

Path C:\Users\Admin\AppData\Local\Temp\zincite.log
Size 96B
SHA256 b85f240b73ac708b2746248fd917db872d9d1c4f2e2445da2a63feb5339f30a1
MD5 822ef1ce831b931852d7d9042646a1f4
SHA1 0be9ffe56d0cdae825835ad372716e85adc44eb6
SHA512 53bc49610058a38827d59f15b91580e171965a4956bfc2d824703e1d353c79b79fc818f841fbc87175352634e10b6e33ec17548ceb0a9f7d43a68384d573d0b0
MD5 SHA1 SHA512

Submit Download

services.exe

Path C:\Windows\services.exe
Size 8KB
SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
MD5 b0fe74719b1b647e2056641931907f4a
SHA1 e858c206d2d1542a79936cb00d85da853bfc95e2
SHA512 9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
SSDEEP 192:tZWNqWKIzebvOZnzCj6juhEJS3/Uf/tpfmG62X9f3:tZ6qWTYvczfahX/UHtF6e9f3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4480-275-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4480-13-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4480-22-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4480-270-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4480-271-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4480-87-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4480-276-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4480-572-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4480-21-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4480-17-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4480-26-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4480-469-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4480-30-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4480-5-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4480-31-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4832-0-0x0000000000500000-0x0000000000511000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads