Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/06/2024, 13:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
35bbc4c6380994accb4d500d19e9b730_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
35bbc4c6380994accb4d500d19e9b730_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
35bbc4c6380994accb4d500d19e9b730_NeikiAnalytics.exe
-
Size
96KB
-
MD5
35bbc4c6380994accb4d500d19e9b730
-
SHA1
9091cbf1d1b64fe0735a20da303d26b068178e80
-
SHA256
d65b9cb0ec887802b9ae9da72b6ae0c32d221580b0bf6f82d7e7ddf858f23c4a
-
SHA512
3719c72c014e9a46a179c166ed909842a8ba91314fcd7822002302cdbc41183e369e5e1387711f7da038a4a117616830a17f669bd51ffee6fc5691ea9ad1e63b
-
SSDEEP
1536:itBwSXzgzWwmhLmncdkadGVScGYJXeiyCnO+TI4K4I4i404R4Z1VcvsJOpPpMm4v:ew6QW6cOadGRJuH7ut/Tdvd+hXV/vU3K
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" mjkoq.exe -
Executes dropped EXE 1 IoCs
pid Process 2956 mjkoq.exe -
Loads dropped DLL 2 IoCs
pid Process 2304 35bbc4c6380994accb4d500d19e9b730_NeikiAnalytics.exe 2304 35bbc4c6380994accb4d500d19e9b730_NeikiAnalytics.exe -
Adds Run key to start application 2 TTPs 49 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /V" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /s" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /g" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /n" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /r" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /G" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /m" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /H" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /t" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /D" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /I" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /y" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /Y" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /l" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /U" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /W" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /Z" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /X" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /O" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /L" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /v" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /A" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /R" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /w" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /e" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /M" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /d" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /c" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /P" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /F" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /z" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /u" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /E" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /k" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /p" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /B" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /Q" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /a" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /i" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /x" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /b" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /h" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /f" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /S" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /q" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /j" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /o" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /J" mjkoq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\mjkoq = "C:\\Users\\Admin\\mjkoq.exe /K" mjkoq.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe 2956 mjkoq.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2304 35bbc4c6380994accb4d500d19e9b730_NeikiAnalytics.exe 2956 mjkoq.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2304 wrote to memory of 2956 2304 35bbc4c6380994accb4d500d19e9b730_NeikiAnalytics.exe 28 PID 2304 wrote to memory of 2956 2304 35bbc4c6380994accb4d500d19e9b730_NeikiAnalytics.exe 28 PID 2304 wrote to memory of 2956 2304 35bbc4c6380994accb4d500d19e9b730_NeikiAnalytics.exe 28 PID 2304 wrote to memory of 2956 2304 35bbc4c6380994accb4d500d19e9b730_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\35bbc4c6380994accb4d500d19e9b730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\35bbc4c6380994accb4d500d19e9b730_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\mjkoq.exe"C:\Users\Admin\mjkoq.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2956
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD51c36d4ce5682bd710018946470957bfc
SHA17a914a0ab9d2cd71ba9c44305750a6557fd75bf7
SHA256a247398759410b6cef83dd7d96674fa814263539347aef11e04ec9e89ddb9b8f
SHA5127b2e01d46f3c900bafb23e050b6312f445f5327638c0886bba5c05645d25c6d77ff2c8c80b167aa3ddc2c2e82bba11abff9375e991d797d6818ce00b49878b42