Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/06/2024, 13:12

General

  • Target

    35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe

  • Size

    725KB

  • MD5

    35ee6f0dc7c7fd2e6da25e68d6410f90

  • SHA1

    8291ac950e09265bfe83b02b9ff4c4cec46da514

  • SHA256

    f97337ff70564a40969055924fba0f582d7a49c61eaccadae3d8a1731386fa4d

  • SHA512

    8626312544e0a12d6c8fa90b005684f83f4398d2781b38535531c0900c40379d35d50d39bdba7a2e23248f87b2441454bc31c80a735f4add063f32ea4b98bf2c

  • SSDEEP

    12288:c8VnWQLY4wpc1HCRruJcRH0wpwI1QvFudHokTFfOfFJRGkp8AQ:BUF4wpcA0wpwIOvFuqwfOfkAQ

Score
8/10

Malware Config

Signatures

  • Sets file execution options in registry 2 TTPs 6 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Modifies registry class 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2808
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe
      2⤵
        PID:4988
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\123.bat
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4372
        • C:\Windows\SysWOW64\reg.exe
          reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
          3⤵
          • Sets file execution options in registry
          PID:2016
        • C:\Windows\SysWOW64\reg.exe
          reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
          3⤵
          • Sets file execution options in registry
          PID:2556
        • C:\Windows\SysWOW64\reg.exe
          reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
          3⤵
          • Sets file execution options in registry
          PID:3908
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c assoc .txt = exefile
        2⤵
        • Modifies registry class
        PID:4116
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c ftype comfile=C:\Users\Admin\AppData\Local\Temp\35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe
        2⤵
        • Modifies system executable filetype association
        • Modifies registry class
        PID:2256
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c ftype zipfile=C:\Users\Admin\AppData\Local\Temp\35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe
        2⤵
        • Modifies registry class
        PID:700
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c ftype jpgfile=C:\Users\Admin\AppData\Local\Temp\35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe
        2⤵
        • Modifies registry class
        PID:1092
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c ftype txtfile=C:\Users\Admin\AppData\Local\Temp\35ee6f0dc7c7fd2e6da25e68d6410f90_NeikiAnalytics.exe
        2⤵
        • Modifies registry class
        PID:1192

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\123.bat

            Filesize

            443B

            MD5

            70170ba16a737a438223b88279dc6c85

            SHA1

            cc066efa0fca9bc9f44013660dea6b28ddfd6a24

            SHA256

            d3674f4b34a8ca8167160519aa5c66b6024eb09f4cb0c9278bc44370b0efec6a

            SHA512

            37cc8c954544374d0a1ca4d012c9bd0b47781bc9bb8d0c15a8a95b9934893db3bedee867b984c20edabe54c39574abf7250de433aade6c0d544b8dd2c972c6da

          • C:\Program Files\7-Zip\7zG.exe

            Filesize

            725KB

            MD5

            1b7efa2031a6863383f1d258ee331020

            SHA1

            37621b1e8a87a0cf381698101a21fb3dda34e289

            SHA256

            00771158e1e618f16c2f19fabb49040d922a3b4d71d4b7fd0b20bc6f87ef2192

            SHA512

            74948f2b0d59e269a4653644bab58fbad2f459098da4ce4f3693afb07816d37c0603d26a3c3a011c242db316c20c42a30eae0db0d9bf147872e14180156b9e14

          • memory/2808-0-0x0000000000400000-0x00000000004C3000-memory.dmp

            Filesize

            780KB

          • memory/2808-1-0x0000000000400000-0x00000000004C3000-memory.dmp

            Filesize

            780KB

          • memory/2808-2-0x0000000000400000-0x00000000004C3000-memory.dmp

            Filesize

            780KB

          • memory/2808-3-0x0000000000400000-0x00000000004C3000-memory.dmp

            Filesize

            780KB

          • memory/2808-1019-0x0000000000400000-0x00000000004C3000-memory.dmp

            Filesize

            780KB