Analysis

  • max time kernel
    140s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    11/06/2024, 13:12

General

  • Target

    35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe

  • Size

    725KB

  • MD5

    35ee6f0dc7c7fd2e6da25e68d6410f90

  • SHA1

    8291ac950e09265bfe83b02b9ff4c4cec46da514

  • SHA256

    f97337ff70564a40969055924fba0f582d7a49c61eaccadae3d8a1731386fa4d

  • SHA512

    8626312544e0a12d6c8fa90b005684f83f4398d2781b38535531c0900c40379d35d50d39bdba7a2e23248f87b2441454bc31c80a735f4add063f32ea4b98bf2c

  • SSDEEP

    12288:c8VnWQLY4wpc1HCRruJcRH0wpwI1QvFudHokTFfOfFJRGkp8AQ:BUF4wpcA0wpwIOvFuqwfOfkAQ

Score
8/10

Malware Config

Signatures

  • Sets file execution options in registry 2 TTPs 6 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 12 IoCs
  • Modifies registry class 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1364
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe
      2⤵
        PID:2796
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c C:\123.bat
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1660
        • C:\Windows\SysWOW64\reg.exe
          reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
          3⤵
          • Sets file execution options in registry
          PID:3056
        • C:\Windows\SysWOW64\reg.exe
          reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
          3⤵
          • Sets file execution options in registry
          PID:1452
        • C:\Windows\SysWOW64\reg.exe
          reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
          3⤵
          • Sets file execution options in registry
          PID:3044
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c assoc .txt = exefile
        2⤵
        • Modifies registry class
        PID:936
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c ftype comfile=C:\Users\Admin\AppData\Local\Temp\35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe
        2⤵
        • Modifies system executable filetype association
        • Modifies registry class
        PID:1124
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c ftype zipfile=C:\Users\Admin\AppData\Local\Temp\35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe
        2⤵
        • Modifies registry class
        PID:976
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c ftype jpgfile=C:\Users\Admin\AppData\Local\Temp\35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe
        2⤵
        • Modifies registry class
        PID:1880
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c ftype txtfile=C:\Users\Admin\AppData\Local\Temp\35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe
        2⤵
        • Modifies registry class
        PID:1964

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\123.bat

            Filesize

            443B

            MD5

            70170ba16a737a438223b88279dc6c85

            SHA1

            cc066efa0fca9bc9f44013660dea6b28ddfd6a24

            SHA256

            d3674f4b34a8ca8167160519aa5c66b6024eb09f4cb0c9278bc44370b0efec6a

            SHA512

            37cc8c954544374d0a1ca4d012c9bd0b47781bc9bb8d0c15a8a95b9934893db3bedee867b984c20edabe54c39574abf7250de433aade6c0d544b8dd2c972c6da

          • C:\Program Files\7-Zip\7zG.exe

            Filesize

            725KB

            MD5

            58c8464a6b77e2040baddbd5bd911c69

            SHA1

            8ddaa778c2c9b7f4faa273fa2eed4352f101f70b

            SHA256

            5b6feaa2616e194f648a6e622fb14fc2df032e738d5b01334e3f2faba6d9e9c9

            SHA512

            20617d7925ebb2a6adcdddcc051926efb5a8130ea817a581a4e097e4b3bc8e3e191004db01c0af283f2750ba13332c78de1db5563866cf7df233db4364e9a064

          • memory/1364-0-0x0000000000400000-0x00000000004C3000-memory.dmp

            Filesize

            780KB

          • memory/1364-1-0x0000000000400000-0x00000000004C3000-memory.dmp

            Filesize

            780KB

          • memory/1364-2-0x0000000000400000-0x00000000004C3000-memory.dmp

            Filesize

            780KB

          • memory/1364-3-0x0000000000400000-0x00000000004C3000-memory.dmp

            Filesize

            780KB

          • memory/1364-1074-0x0000000000400000-0x00000000004C3000-memory.dmp

            Filesize

            780KB