Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
05/06/2024, 11:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
51ade0d8e94a8d4ab079d9f9305d4610_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
51ade0d8e94a8d4ab079d9f9305d4610_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
51ade0d8e94a8d4ab079d9f9305d4610_NeikiAnalytics.exe
-
Size
196KB
-
MD5
51ade0d8e94a8d4ab079d9f9305d4610
-
SHA1
dca9c7f01513993a288a419a0dc10838bfd8cd77
-
SHA256
29b8397d6d9400535248dff129cfc0b50f7bfb511a229bfea0cb95abfdfb5164
-
SHA512
883426a941e90f8a65726797a5f170719806fd7956e4280d6b57e727c5838dcbb1e83674d4caa0a24a554cadce4c315e2a5a28a646e1346a2f483cfaad47dfc5
-
SSDEEP
1536:7etkj9TQOLU0GgAJx1kNmKldcBP9VexJvcC:YkjigU0GgAX9
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 51ade0d8e94a8d4ab079d9f9305d4610_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" paeije.exe -
Executes dropped EXE 1 IoCs
pid Process 3060 paeije.exe -
Loads dropped DLL 2 IoCs
pid Process 2128 51ade0d8e94a8d4ab079d9f9305d4610_NeikiAnalytics.exe 2128 51ade0d8e94a8d4ab079d9f9305d4610_NeikiAnalytics.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /b" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /p" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /y" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /h" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /v" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /C" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /H" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /E" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /N" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /m" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /K" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /T" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /l" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /O" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /n" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /a" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /R" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /U" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /t" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /b" 51ade0d8e94a8d4ab079d9f9305d4610_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /F" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /V" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /w" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /A" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /M" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /G" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /P" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /i" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /W" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /Z" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /q" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /z" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /c" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /B" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /Q" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /Y" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /j" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /D" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /s" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /x" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /e" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /k" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /X" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /J" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /L" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /f" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /d" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /g" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /I" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /u" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /o" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /r" paeije.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\paeije = "C:\\Users\\Admin\\paeije.exe /S" paeije.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2128 51ade0d8e94a8d4ab079d9f9305d4610_NeikiAnalytics.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe 3060 paeije.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2128 51ade0d8e94a8d4ab079d9f9305d4610_NeikiAnalytics.exe 3060 paeije.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2128 wrote to memory of 3060 2128 51ade0d8e94a8d4ab079d9f9305d4610_NeikiAnalytics.exe 28 PID 2128 wrote to memory of 3060 2128 51ade0d8e94a8d4ab079d9f9305d4610_NeikiAnalytics.exe 28 PID 2128 wrote to memory of 3060 2128 51ade0d8e94a8d4ab079d9f9305d4610_NeikiAnalytics.exe 28 PID 2128 wrote to memory of 3060 2128 51ade0d8e94a8d4ab079d9f9305d4610_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\51ade0d8e94a8d4ab079d9f9305d4610_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\51ade0d8e94a8d4ab079d9f9305d4610_NeikiAnalytics.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\paeije.exe"C:\Users\Admin\paeije.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3060
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
196KB
MD52cba297155bd00f0a7e45352520c6d6e
SHA1389e872402f43623a7f8cbe518aabe581e57e97e
SHA25601f8cc4d9a0887d291fade9ea982046e651953f9b1521b87119472c2fcbc3e71
SHA5121dd883f82bb8e14777eb416197bd8126b60de28c3e324dac0f2a7b1050f1946ba64dc81226e5a9060a85c643fd9b483ba158ab250fbe6a63012f00644c899bc8