Analysis
-
max time kernel
150s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10-06-2024 22:20
Behavioral task
behavioral1
Sample
1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe
-
Size
2.5MB
-
MD5
1d7c209d3fe49b48f00d22a367a25d20
-
SHA1
e188291b372a858870658efc1d965f04f89cbeb1
-
SHA256
b9264329c052618a08c48ba39c16263c7e06af5dee8704d78d73222cb820e4c6
-
SHA512
a55c758417613332c6f68fa1405906e4c673bebd4827cc52797c5e6fe8ff65ad34468f8a932528d8ea672db7bb0c8b652d183542828f3b587d4867b12548ce29
-
SSDEEP
49152:hxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyx4:hxx9NUFkQx753uWuCyyx4
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
explorer.exesvchost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
Processes:
1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exespoolsv.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe -
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exespoolsv.exesvchost.exespoolsv.exeexplorer.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe -
Executes dropped EXE 4 IoCs
Processes:
explorer.exespoolsv.exesvchost.exespoolsv.exepid process 4680 explorer.exe 3932 spoolsv.exe 4424 svchost.exe 2476 spoolsv.exe -
Processes:
resource yara_rule behavioral2/memory/3276-0-0x0000000000400000-0x0000000000A0E000-memory.dmp themida C:\Windows\Resources\Themes\explorer.exe themida behavioral2/memory/4680-10-0x0000000000400000-0x0000000000A0E000-memory.dmp themida C:\Windows\Resources\spoolsv.exe themida behavioral2/memory/3932-19-0x0000000000400000-0x0000000000A0E000-memory.dmp themida C:\Windows\Resources\svchost.exe themida behavioral2/memory/4424-28-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/2476-33-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/3932-39-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/2476-40-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/3276-42-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/4680-43-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/4680-45-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/4424-44-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/4680-50-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/4680-56-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/4424-65-0x0000000000400000-0x0000000000A0E000-memory.dmp themida -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
svchost.exeexplorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe -
Processes:
svchost.exespoolsv.exe1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exeexplorer.exespoolsv.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorer.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe -
Drops file in System32 directory 2 IoCs
Processes:
explorer.exesvchost.exedescription ioc process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exespoolsv.exepid process 3276 1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe 4680 explorer.exe 3932 spoolsv.exe 4424 svchost.exe 2476 spoolsv.exe -
Drops file in Windows directory 4 IoCs
Processes:
explorer.exe1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Resources\tjud.exe explorer.exe File opened for modification \??\c:\windows\resources\themes\explorer.exe 1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exeexplorer.exepid process 3276 1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe 3276 1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe 3276 1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe 3276 1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe 3276 1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe 3276 1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe 3276 1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe 3276 1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe 3276 1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe 3276 1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe 3276 1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe 3276 1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe 3276 1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe 3276 1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe 3276 1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe 3276 1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe 3276 1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe 3276 1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe 3276 1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe 3276 1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe 3276 1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe 3276 1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe 3276 1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe 3276 1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe 3276 1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe 3276 1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe 3276 1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe 3276 1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe 3276 1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe 3276 1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe 3276 1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe 3276 1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe 3276 1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe 3276 1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe 4680 explorer.exe 4680 explorer.exe 4680 explorer.exe 4680 explorer.exe 4680 explorer.exe 4680 explorer.exe 4680 explorer.exe 4680 explorer.exe 4680 explorer.exe 4680 explorer.exe 4680 explorer.exe 4680 explorer.exe 4680 explorer.exe 4680 explorer.exe 4680 explorer.exe 4680 explorer.exe 4680 explorer.exe 4680 explorer.exe 4680 explorer.exe 4680 explorer.exe 4680 explorer.exe 4680 explorer.exe 4680 explorer.exe 4680 explorer.exe 4680 explorer.exe 4680 explorer.exe 4680 explorer.exe 4680 explorer.exe 4680 explorer.exe 4680 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
explorer.exesvchost.exepid process 4680 explorer.exe 4424 svchost.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exespoolsv.exepid process 3276 1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe 3276 1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe 4680 explorer.exe 4680 explorer.exe 3932 spoolsv.exe 3932 spoolsv.exe 4424 svchost.exe 4424 svchost.exe 2476 spoolsv.exe 2476 spoolsv.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exedescription pid process target process PID 3276 wrote to memory of 4680 3276 1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe explorer.exe PID 3276 wrote to memory of 4680 3276 1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe explorer.exe PID 3276 wrote to memory of 4680 3276 1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe explorer.exe PID 4680 wrote to memory of 3932 4680 explorer.exe spoolsv.exe PID 4680 wrote to memory of 3932 4680 explorer.exe spoolsv.exe PID 4680 wrote to memory of 3932 4680 explorer.exe spoolsv.exe PID 3932 wrote to memory of 4424 3932 spoolsv.exe svchost.exe PID 3932 wrote to memory of 4424 3932 spoolsv.exe svchost.exe PID 3932 wrote to memory of 4424 3932 spoolsv.exe svchost.exe PID 4424 wrote to memory of 2476 4424 svchost.exe spoolsv.exe PID 4424 wrote to memory of 2476 4424 svchost.exe spoolsv.exe PID 4424 wrote to memory of 2476 4424 svchost.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1d7c209d3fe49b48f00d22a367a25d20_NeikiAnalytics.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3276 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4680 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3932 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:2476
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Resources\Themes\explorer.exeFilesize
2.5MB
MD563b702604aea9bf8bf5e1b41d4de5076
SHA122d63fbb88dab2d3138b54ad771b3a647254b4f2
SHA25658d2592da74c4ddffbccc25469fffbeccfac8724c7477510ed40e8de5d8109b0
SHA51294c9d2e1599687355314ae7aeb9ef214e92b306b4a638377c0962960d06f23039b3aeb436a459371225b8eb37002f00f1b612a3a940ae7f391319b78a44d74af
-
C:\Windows\Resources\spoolsv.exeFilesize
2.5MB
MD59fa74c5aced43054951794a8a6143e7e
SHA1e10d024ff612298f53e317b1a1c86ccffc616270
SHA25643eb1de6bc4f1536b877612bd153c3a384f7ce9f5db4bc5002503415408d667f
SHA5120fd19df956294da518109af49bd9ed97e07b6723c6f0f75988142f65a8ad7b860d55f4429fd8b9d61bb70a03a8f2d9c51f58fec4ba64368d1f2dc4f13bfea2da
-
C:\Windows\Resources\svchost.exeFilesize
2.5MB
MD54d34ea94dac5e5b843f7ed4ab3f077b2
SHA1a306ba1359695f479d8c88896090911485337015
SHA256aec95982ba50c8bd2eca8a980ed68cff1f74294b4e90d72d57b07c6b676236ca
SHA51291ac4500fa5fe37170ad59ee5d94812a032ba162321ea4306353146917340912403eea686daad0e2c902fb02551f11a5c6f2a344336d62fc614f4981b9348398
-
memory/2476-33-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/2476-40-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/3276-1-0x0000000077B24000-0x0000000077B26000-memory.dmpFilesize
8KB
-
memory/3276-42-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/3276-0-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/3932-19-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/3932-39-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/4424-28-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/4424-44-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/4424-65-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/4680-10-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/4680-43-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/4680-45-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/4680-50-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/4680-56-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB