Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11-06-2024 05:08
Behavioral task
behavioral1
Sample
28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe
-
Size
2.5MB
-
MD5
28ac907d06f0fd383ccfbba6595615b0
-
SHA1
b07e1f1492fa23da54e04ead3c3e7eea5ffbdcdd
-
SHA256
a0a2ff1c76bd92bbd57142414f481c18176ec907002703cf940da0b20361fc8e
-
SHA512
58aff6acb313a6bbcfaa3bcfcf953094a04d6c2a722356aff0d4d69687f2b7765cfa5922f32bf29d1ba7bf167fcb137db9b91d10cff636db8d971a49b1d57bc1
-
SSDEEP
49152:hxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyxg:hxx9NUFkQx753uWuCyyxg
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
svchost.exeexplorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
Processes:
28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exespoolsv.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe -
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
spoolsv.exe28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion svchost.exe -
Executes dropped EXE 4 IoCs
Processes:
explorer.exespoolsv.exesvchost.exespoolsv.exepid process 3744 explorer.exe 224 spoolsv.exe 3228 svchost.exe 4764 spoolsv.exe -
Processes:
resource yara_rule behavioral2/memory/4380-0-0x0000000000400000-0x0000000000A0E000-memory.dmp themida C:\Windows\Resources\Themes\explorer.exe themida behavioral2/memory/3744-10-0x0000000000400000-0x0000000000A0E000-memory.dmp themida C:\Windows\Resources\spoolsv.exe themida behavioral2/memory/224-19-0x0000000000400000-0x0000000000A0E000-memory.dmp themida C:\Windows\Resources\svchost.exe themida behavioral2/memory/3228-28-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/4764-33-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/224-39-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/4764-40-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/4380-42-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/3744-43-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/3744-45-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/3228-44-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/3228-48-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/3228-52-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/3744-57-0x0000000000400000-0x0000000000A0E000-memory.dmp themida -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
explorer.exesvchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe -
Processes:
28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exespoolsv.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorer.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe -
Drops file in System32 directory 2 IoCs
Processes:
explorer.exesvchost.exedescription ioc process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exespoolsv.exepid process 4380 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 3744 explorer.exe 224 spoolsv.exe 3228 svchost.exe 4764 spoolsv.exe -
Drops file in Windows directory 4 IoCs
Processes:
28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exeexplorer.exespoolsv.exedescription ioc process File opened for modification \??\c:\windows\resources\themes\explorer.exe 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exeexplorer.exepid process 4380 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 4380 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 4380 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 4380 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 4380 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 4380 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 4380 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 4380 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 4380 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 4380 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 4380 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 4380 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 4380 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 4380 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 4380 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 4380 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 4380 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 4380 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 4380 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 4380 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 4380 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 4380 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 4380 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 4380 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 4380 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 4380 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 4380 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 4380 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 4380 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 4380 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 4380 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 4380 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 4380 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 4380 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 3744 explorer.exe 3744 explorer.exe 3744 explorer.exe 3744 explorer.exe 3744 explorer.exe 3744 explorer.exe 3744 explorer.exe 3744 explorer.exe 3744 explorer.exe 3744 explorer.exe 3744 explorer.exe 3744 explorer.exe 3744 explorer.exe 3744 explorer.exe 3744 explorer.exe 3744 explorer.exe 3744 explorer.exe 3744 explorer.exe 3744 explorer.exe 3744 explorer.exe 3744 explorer.exe 3744 explorer.exe 3744 explorer.exe 3744 explorer.exe 3744 explorer.exe 3744 explorer.exe 3744 explorer.exe 3744 explorer.exe 3744 explorer.exe 3744 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
explorer.exesvchost.exepid process 3744 explorer.exe 3228 svchost.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exespoolsv.exepid process 4380 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 4380 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe 3744 explorer.exe 3744 explorer.exe 224 spoolsv.exe 224 spoolsv.exe 3228 svchost.exe 3228 svchost.exe 4764 spoolsv.exe 4764 spoolsv.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exedescription pid process target process PID 4380 wrote to memory of 3744 4380 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe explorer.exe PID 4380 wrote to memory of 3744 4380 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe explorer.exe PID 4380 wrote to memory of 3744 4380 28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe explorer.exe PID 3744 wrote to memory of 224 3744 explorer.exe spoolsv.exe PID 3744 wrote to memory of 224 3744 explorer.exe spoolsv.exe PID 3744 wrote to memory of 224 3744 explorer.exe spoolsv.exe PID 224 wrote to memory of 3228 224 spoolsv.exe svchost.exe PID 224 wrote to memory of 3228 224 spoolsv.exe svchost.exe PID 224 wrote to memory of 3228 224 spoolsv.exe svchost.exe PID 3228 wrote to memory of 4764 3228 svchost.exe spoolsv.exe PID 3228 wrote to memory of 4764 3228 svchost.exe spoolsv.exe PID 3228 wrote to memory of 4764 3228 svchost.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\28ac907d06f0fd383ccfbba6595615b0_NeikiAnalytics.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4380 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3744 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:4764
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Resources\Themes\explorer.exeFilesize
2.5MB
MD5a5cecd9747043571f68c6926ccc5d9aa
SHA17f40859868d0a62844c414141ebb8ad26ad393de
SHA256f112550d23c583b99e3dae67be8651709fab5cd775e9f03a70de861a914dc5ab
SHA512f8a6c606006d944d18398f86f2f277044dba5350b21cd5bf558746b61ceb3bb087c725af2eeb1381908181cb65127c22edd4935d83338c622997533ac4fcd0dc
-
C:\Windows\Resources\spoolsv.exeFilesize
2.5MB
MD575139b20389be5ee74962ae0da2ad14a
SHA117d84548bc072632f8cfb5e426088b840707ed62
SHA256f563150b6fc6c9f66ec9a958265c99cfdeff5f8cb0c682b82d53fd353638ae47
SHA512edfa680d6dc381a797ef0f41b7e45d2adeed77dd0768cedd23decd7d20cc59f4f029ba6e2cb011744a96c15614a68191dc238a4c89b1c8f77365106ffdc72672
-
C:\Windows\Resources\svchost.exeFilesize
2.5MB
MD57f9be29c9736a211865563760d1f2862
SHA13ae971e224ab149adfac85f2bdae59ef608501e8
SHA256681c611883ac6aa4a72d57a9dff47b4949200f71f21b654a97364fb97fdd5ba6
SHA512eeb12ab242e85c626d084abe276eefa194574cdb60ab4179d0b954440e5ff476881431901663a60cece3351e8909111bd8bb3901e240b91f5084746ebfe17bee
-
memory/224-39-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/224-19-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/3228-52-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/3228-48-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/3228-28-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/3228-44-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/3744-43-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/3744-45-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/3744-10-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/3744-57-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/4380-42-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/4380-0-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/4380-1-0x0000000076F24000-0x0000000076F26000-memory.dmpFilesize
8KB
-
memory/4764-40-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/4764-33-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB