Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
09-06-2024 05:21
Behavioral task
behavioral1
Sample
10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe
-
Size
2.7MB
-
MD5
10d1c4883ccc8186cf3a868b3eab2340
-
SHA1
de2563ea862e31820485bf9dd80c2f2a64b84ba1
-
SHA256
0c0245cc8321bea32eeec4dea5505bc5dcd4579297f95d40dfe86e7811de4538
-
SHA512
c4127e061262d4cb8103693adc38176d0f58abd9bb1f7b8c126a03040fa9b325102ce94d400571b3013364cd85db011f6f91b58bc58e9595d44153572c5e7152
-
SSDEEP
49152:VtzBOauT0i7ZSQcCG1+bLthSo9/ktjPf4EXzwgb+LquT05Z:VtzaT00zcC8ahhSo9sRf44z1/5Z
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
svchost.exeexplorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
Processes:
10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exespoolsv.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe -
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
spoolsv.exesvchost.exe10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exeexplorer.exespoolsv.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorer.exe -
Executes dropped EXE 4 IoCs
Processes:
explorer.exespoolsv.exesvchost.exespoolsv.exepid process 2080 explorer.exe 2448 spoolsv.exe 2360 svchost.exe 2664 spoolsv.exe -
Loads dropped DLL 4 IoCs
Processes:
10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exepid process 2428 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 2080 explorer.exe 2448 spoolsv.exe 2360 svchost.exe -
Processes:
resource yara_rule behavioral1/memory/2428-0-0x0000000000400000-0x0000000000A60000-memory.dmp themida \Windows\Resources\Themes\explorer.exe themida behavioral1/memory/2428-11-0x00000000036D0000-0x0000000003D30000-memory.dmp themida behavioral1/memory/2080-12-0x0000000000400000-0x0000000000A60000-memory.dmp themida \Windows\Resources\spoolsv.exe themida behavioral1/memory/2448-24-0x0000000000400000-0x0000000000A60000-memory.dmp themida behavioral1/memory/2080-22-0x00000000038D0000-0x0000000003F30000-memory.dmp themida \Windows\Resources\svchost.exe themida behavioral1/memory/2360-36-0x0000000000400000-0x0000000000A60000-memory.dmp themida behavioral1/memory/2664-44-0x0000000000400000-0x0000000000A60000-memory.dmp themida behavioral1/memory/2428-43-0x0000000000400000-0x0000000000A60000-memory.dmp themida behavioral1/memory/2448-51-0x0000000000400000-0x0000000000A60000-memory.dmp themida behavioral1/memory/2664-50-0x0000000000400000-0x0000000000A60000-memory.dmp themida behavioral1/memory/2428-52-0x0000000000400000-0x0000000000A60000-memory.dmp themida behavioral1/memory/2080-53-0x0000000000400000-0x0000000000A60000-memory.dmp themida behavioral1/memory/2360-55-0x0000000000400000-0x0000000000A60000-memory.dmp themida behavioral1/memory/2080-67-0x0000000000400000-0x0000000000A60000-memory.dmp themida behavioral1/memory/2360-72-0x0000000000400000-0x0000000000A60000-memory.dmp themida behavioral1/memory/2360-78-0x0000000000400000-0x0000000000A60000-memory.dmp themida -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
svchost.exeexplorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe -
Processes:
10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exespoolsv.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorer.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe -
Drops file in System32 directory 2 IoCs
Processes:
svchost.exeexplorer.exedescription ioc process File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exespoolsv.exepid process 2428 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 2080 explorer.exe 2448 spoolsv.exe 2360 svchost.exe 2664 spoolsv.exe -
Drops file in Windows directory 4 IoCs
Processes:
explorer.exe10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Resources\tjud.exe explorer.exe File opened for modification \??\c:\windows\resources\themes\explorer.exe 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 2676 schtasks.exe 1568 schtasks.exe 2312 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exeexplorer.exesvchost.exepid process 2428 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 2428 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 2428 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 2428 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 2428 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 2428 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 2428 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 2428 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 2428 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 2428 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 2428 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 2428 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 2428 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 2428 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 2428 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 2428 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 2428 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2360 svchost.exe 2360 svchost.exe 2360 svchost.exe 2360 svchost.exe 2360 svchost.exe 2360 svchost.exe 2360 svchost.exe 2360 svchost.exe 2360 svchost.exe 2360 svchost.exe 2360 svchost.exe 2360 svchost.exe 2360 svchost.exe 2360 svchost.exe 2360 svchost.exe 2360 svchost.exe 2080 explorer.exe 2360 svchost.exe 2360 svchost.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2360 svchost.exe 2080 explorer.exe 2360 svchost.exe 2360 svchost.exe 2080 explorer.exe 2080 explorer.exe 2080 explorer.exe 2360 svchost.exe 2360 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
explorer.exesvchost.exepid process 2080 explorer.exe 2360 svchost.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exespoolsv.exepid process 2428 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 2428 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 2080 explorer.exe 2080 explorer.exe 2448 spoolsv.exe 2448 spoolsv.exe 2360 svchost.exe 2360 svchost.exe 2664 spoolsv.exe 2664 spoolsv.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exedescription pid process target process PID 2428 wrote to memory of 2080 2428 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe explorer.exe PID 2428 wrote to memory of 2080 2428 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe explorer.exe PID 2428 wrote to memory of 2080 2428 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe explorer.exe PID 2428 wrote to memory of 2080 2428 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe explorer.exe PID 2080 wrote to memory of 2448 2080 explorer.exe spoolsv.exe PID 2080 wrote to memory of 2448 2080 explorer.exe spoolsv.exe PID 2080 wrote to memory of 2448 2080 explorer.exe spoolsv.exe PID 2080 wrote to memory of 2448 2080 explorer.exe spoolsv.exe PID 2448 wrote to memory of 2360 2448 spoolsv.exe svchost.exe PID 2448 wrote to memory of 2360 2448 spoolsv.exe svchost.exe PID 2448 wrote to memory of 2360 2448 spoolsv.exe svchost.exe PID 2448 wrote to memory of 2360 2448 spoolsv.exe svchost.exe PID 2360 wrote to memory of 2664 2360 svchost.exe spoolsv.exe PID 2360 wrote to memory of 2664 2360 svchost.exe spoolsv.exe PID 2360 wrote to memory of 2664 2360 svchost.exe spoolsv.exe PID 2360 wrote to memory of 2664 2360 svchost.exe spoolsv.exe PID 2080 wrote to memory of 2644 2080 explorer.exe Explorer.exe PID 2080 wrote to memory of 2644 2080 explorer.exe Explorer.exe PID 2080 wrote to memory of 2644 2080 explorer.exe Explorer.exe PID 2080 wrote to memory of 2644 2080 explorer.exe Explorer.exe PID 2360 wrote to memory of 2676 2360 svchost.exe schtasks.exe PID 2360 wrote to memory of 2676 2360 svchost.exe schtasks.exe PID 2360 wrote to memory of 2676 2360 svchost.exe schtasks.exe PID 2360 wrote to memory of 2676 2360 svchost.exe schtasks.exe PID 2360 wrote to memory of 1568 2360 svchost.exe schtasks.exe PID 2360 wrote to memory of 1568 2360 svchost.exe schtasks.exe PID 2360 wrote to memory of 1568 2360 svchost.exe schtasks.exe PID 2360 wrote to memory of 1568 2360 svchost.exe schtasks.exe PID 2360 wrote to memory of 2312 2360 svchost.exe schtasks.exe PID 2360 wrote to memory of 2312 2360 svchost.exe schtasks.exe PID 2360 wrote to memory of 2312 2360 svchost.exe schtasks.exe PID 2360 wrote to memory of 2312 2360 svchost.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:2664 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 05:23 /f5⤵
- Creates scheduled task(s)
PID:2676 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 05:24 /f5⤵
- Creates scheduled task(s)
PID:1568 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 05:25 /f5⤵
- Creates scheduled task(s)
PID:2312 -
C:\Windows\Explorer.exeC:\Windows\Explorer.exe3⤵PID:2644
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5be9472b2a28c362e6649f79eda49c157
SHA1dd646c572bc170da250a08892c32ed0934aa4d51
SHA2560f3299572a38c10d501936f095da18b2fc6d668729b0a3dddd01fef068e22e41
SHA512f1b0192f0dea2305b70570c0a4c6f9f09aad145e5c5545580c5fdc9d7492ee115ed797b1a3d0908ab2c5a6a50f2bddb5082090a5adc44c5d8e567fcc1b57e717
-
Filesize
2.7MB
MD5f07a5b5af505ac08d979e048fba849e1
SHA107d0d4b09e1054022e16881f9172fe670e3e4b45
SHA2560017c0e4f0f80cc65db0fc7ffbb9a9795162e56bf229e88f7a742167dbb1c197
SHA5120e21f09df509aea3927c665a945f29d772c18eb1c10ba1276b3ee3af65bc898605e8e314b5b4c04253e12bb0c2df3959e665cf9887b18c20b0c0871aa81ab797
-
Filesize
2.7MB
MD544ee2b9801d077645292d930f48844ab
SHA17151571ab0aa7d4abffe27123d2e17e59f5c76b1
SHA256e4f43c2ef5c746f419f6c22dff41bdeae2f948a3b7d48a0b3aefebd19a9ce783
SHA512329ad864f41ceecd91f0d59b9596f93d6ad8f927d6f69ffd449ced04b85bfae924da5e9cd392f120a67d792cc7157f75d9ec779f7e2fcb9313438d3f3eac95de