Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09-06-2024 05:21
Behavioral task
behavioral1
Sample
10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe
-
Size
2.7MB
-
MD5
10d1c4883ccc8186cf3a868b3eab2340
-
SHA1
de2563ea862e31820485bf9dd80c2f2a64b84ba1
-
SHA256
0c0245cc8321bea32eeec4dea5505bc5dcd4579297f95d40dfe86e7811de4538
-
SHA512
c4127e061262d4cb8103693adc38176d0f58abd9bb1f7b8c126a03040fa9b325102ce94d400571b3013364cd85db011f6f91b58bc58e9595d44153572c5e7152
-
SSDEEP
49152:VtzBOauT0i7ZSQcCG1+bLthSo9/ktjPf4EXzwgb+LquT05Z:VtzaT00zcC8ahhSo9sRf44z1/5Z
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
svchost.exeexplorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
Processes:
svchost.exespoolsv.exe10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exeexplorer.exespoolsv.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe -
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exeexplorer.exespoolsv.exespoolsv.exesvchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe -
Executes dropped EXE 4 IoCs
Processes:
explorer.exespoolsv.exesvchost.exespoolsv.exepid process 3672 explorer.exe 4580 spoolsv.exe 3668 svchost.exe 652 spoolsv.exe -
Processes:
resource yara_rule behavioral2/memory/4588-0-0x0000000000400000-0x0000000000A60000-memory.dmp themida C:\Windows\Resources\Themes\explorer.exe themida behavioral2/memory/3672-10-0x0000000000400000-0x0000000000A60000-memory.dmp themida C:\Windows\Resources\spoolsv.exe themida behavioral2/memory/4580-19-0x0000000000400000-0x0000000000A60000-memory.dmp themida \??\c:\windows\resources\svchost.exe themida behavioral2/memory/3668-28-0x0000000000400000-0x0000000000A60000-memory.dmp themida behavioral2/memory/652-33-0x0000000000400000-0x0000000000A60000-memory.dmp themida behavioral2/memory/652-38-0x0000000000400000-0x0000000000A60000-memory.dmp themida behavioral2/memory/4588-41-0x0000000000400000-0x0000000000A60000-memory.dmp themida behavioral2/memory/4580-42-0x0000000000400000-0x0000000000A60000-memory.dmp themida behavioral2/memory/3672-43-0x0000000000400000-0x0000000000A60000-memory.dmp themida behavioral2/memory/3672-45-0x0000000000400000-0x0000000000A60000-memory.dmp themida behavioral2/memory/3668-44-0x0000000000400000-0x0000000000A60000-memory.dmp themida behavioral2/memory/3672-56-0x0000000000400000-0x0000000000A60000-memory.dmp themida behavioral2/memory/3668-63-0x0000000000400000-0x0000000000A60000-memory.dmp themida -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
svchost.exeexplorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe -
Processes:
svchost.exespoolsv.exe10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exeexplorer.exespoolsv.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorer.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe -
Drops file in System32 directory 2 IoCs
Processes:
explorer.exesvchost.exedescription ioc process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exespoolsv.exepid process 4588 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 3672 explorer.exe 4580 spoolsv.exe 3668 svchost.exe 652 spoolsv.exe -
Drops file in Windows directory 4 IoCs
Processes:
spoolsv.exeexplorer.exe10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exedescription ioc process File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe File opened for modification \??\c:\windows\resources\themes\explorer.exe 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exeexplorer.exepid process 4588 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 4588 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 4588 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 4588 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 4588 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 4588 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 4588 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 4588 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 4588 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 4588 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 4588 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 4588 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 4588 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 4588 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 4588 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 4588 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 4588 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 4588 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 4588 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 4588 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 4588 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 4588 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 4588 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 4588 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 4588 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 4588 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 4588 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 4588 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 4588 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 4588 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 4588 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 4588 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 4588 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 4588 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 3672 explorer.exe 3672 explorer.exe 3672 explorer.exe 3672 explorer.exe 3672 explorer.exe 3672 explorer.exe 3672 explorer.exe 3672 explorer.exe 3672 explorer.exe 3672 explorer.exe 3672 explorer.exe 3672 explorer.exe 3672 explorer.exe 3672 explorer.exe 3672 explorer.exe 3672 explorer.exe 3672 explorer.exe 3672 explorer.exe 3672 explorer.exe 3672 explorer.exe 3672 explorer.exe 3672 explorer.exe 3672 explorer.exe 3672 explorer.exe 3672 explorer.exe 3672 explorer.exe 3672 explorer.exe 3672 explorer.exe 3672 explorer.exe 3672 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
explorer.exesvchost.exepid process 3672 explorer.exe 3668 svchost.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exespoolsv.exepid process 4588 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 4588 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe 3672 explorer.exe 3672 explorer.exe 4580 spoolsv.exe 4580 spoolsv.exe 3668 svchost.exe 3668 svchost.exe 652 spoolsv.exe 652 spoolsv.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exedescription pid process target process PID 4588 wrote to memory of 3672 4588 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe explorer.exe PID 4588 wrote to memory of 3672 4588 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe explorer.exe PID 4588 wrote to memory of 3672 4588 10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe explorer.exe PID 3672 wrote to memory of 4580 3672 explorer.exe spoolsv.exe PID 3672 wrote to memory of 4580 3672 explorer.exe spoolsv.exe PID 3672 wrote to memory of 4580 3672 explorer.exe spoolsv.exe PID 4580 wrote to memory of 3668 4580 spoolsv.exe svchost.exe PID 4580 wrote to memory of 3668 4580 spoolsv.exe svchost.exe PID 4580 wrote to memory of 3668 4580 spoolsv.exe svchost.exe PID 3668 wrote to memory of 652 3668 svchost.exe spoolsv.exe PID 3668 wrote to memory of 652 3668 svchost.exe spoolsv.exe PID 3668 wrote to memory of 652 3668 svchost.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\10d1c4883ccc8186cf3a868b3eab2340_NeikiAnalytics.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3668 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:652
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD53cb6000a2a84f6f1b552045328bd5b9a
SHA1abc59cbc4ea818baa9eade62aeaa84204930e78c
SHA2560169ead7985beba52c169ceaca6aa7721b19575c3037664c8be9760ab5e729e5
SHA512cc7f3299ec118ce2aa3c0792f4e300a9729bac8b316eec2d951479481b4b0680ec7440a4bffddaa8bb0874fea72e9d0cd9c8b8f5eb0621e8063dda2288736a23
-
Filesize
2.7MB
MD588267e7abb7c92ba34b69d1fa8ed1d9a
SHA1e0f5f70f64e23f303d809ac2f478b2de3421445c
SHA2562846d97dba5f1362c5ea8d9e0cc8ce693310b46c3110402a5ed21d6c839e66a2
SHA51218eabe2b8a0dd724f8210cf9f7ed4fd13f80bf6c95a1221ad1f7dff0d12df71ef104edc958dc1262f561a36cd12d27dccf36f50ae18a1f964b6fd6a22ff54538
-
Filesize
2.7MB
MD51067e6d8c1a15a73088f555b35653850
SHA1ec03d82d89494122ee02d0a09163b51f4b781261
SHA256bdc38842564bf921f72c52fe185be7a0ff81ebedc2e57a54da5ff96fca3ec62f
SHA512b309e79e57b98eb3c456f65619eaf418d0371d006ba58a12ace01db029146e2378ee48031ca8c10d537bbbc23a8f8f853a35decb6401e95b65c1c6d1b300501d