Analysis
-
max time kernel
142s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
08-05-2024 06:45
General
-
Target
fcc7a165d32d670c18cbab99ad3e2a80_NEIKI.exe
-
Size
5.2MB
-
MD5
fcc7a165d32d670c18cbab99ad3e2a80
-
SHA1
c80df14e1ce503a46f7d2f549c056882985785e6
-
SHA256
a2416a51d20f001713a08392f60ffc7fa50d9cf7e2e50851e2f7a021a02a2831
-
SHA512
eaf0962b9cb48c96b55c986af2eb0db498f61f80692115f58496170bdfa3397d7e00f1b4c8d7e782b5efd5ee890fd9adae9a97f021dbd7df4b784d2a2eb3c1bc
-
SSDEEP
98304:Kps6efPfBOPvLtabi4X0MV+dYdcGt7VIb4:sfefPJws3V+a
Malware Config
Signatures
-
Sets service image path in registry 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops file in System32 directory 3 IoCs
-
Drops file in Program Files directory 15 IoCs
-
Drops file in Windows directory 13 IoCs
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 20 IoCs
-
Registers COM server for autorun 1 TTPs 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 13 IoCs
-
Modifies registry class 37 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 7 IoCs
-
Suspicious use of SendNotifyMessage 5 IoCs
-
Suspicious use of WriteProcessMemory 21 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\fcc7a165d32d670c18cbab99ad3e2a80_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\fcc7a165d32d670c18cbab99ad3e2a80_NEIKI.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\02aacd0ff7720c8e\setup.msi"2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Registers COM server for autorun
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding CE6F3942B2F994912246C8206134B12A C2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI4834.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240601218 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding DBA1CA8B8BEF609D282E62A93C4F91242⤵
- Loads dropped DLL
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1B99229959649CB9739297CA77DC2709 E Global\MSI00002⤵
- Drops file in Windows directory
- Loads dropped DLL
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Program Files (x86)\ScreenConnect Client (02aacd0ff7720c8e)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (02aacd0ff7720c8e)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-cjeh24-relay.screenconnect.com&p=443&s=9337172a-ca8a-4856-8cd5-3505a89a4a16&k=BgIAAACkAABSU0ExAAgAAAEAAQDZKTW%2f%2b%2f0HZmYMCXtdMD%2bn02Nt2VBCvuFrPfNtNBBCGc%2b0LcJ9P4u2z8uxREmtJoDrc%2bj7EMgJ8x7wyzgfLtNFDv41m%2bXSlDRjrSKKim%2fbNMv%2f9mkMtRamV478yX%2fc3VlECJEYHAFK%2fpDKpPZ1F%2fGbTFkenTsR7AdEv%2f61cW%2fRNTPaJ6Fmq8qBTkD6WZDPTBFVGuZ8d39SUtwUIEQ55FCbSiB3Bc1bTHHTUu%2fsa6e4yjeX14Z1%2bcVVui7%2f50qy1%2fEG18N%2b0p1HIv955Fk4DHPNMPeDIfd9x%2f5gakn0zF5jGtpd2iIpuuK2%2fuRIp86BX4AjwN%2bQNpm9QL8W0dBt0%2fbT&c=18144219267069&c=&c=&c=&c=&c=&c=&c="1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\ScreenConnect Client (02aacd0ff7720c8e)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (02aacd0ff7720c8e)\ScreenConnect.WindowsClient.exe" "RunRole" "0a41b99b-5fd0-4bf9-a9c9-2e0bb5c414a0" "User"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Program Files (x86)\ScreenConnect Client (02aacd0ff7720c8e)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (02aacd0ff7720c8e)\ScreenConnect.WindowsClient.exe" "RunRole" "30539ccf-4796-4915-9fc9-c5dd98a00f4d" "System"2⤵
- Drops file in System32 directory
- Executes dropped EXE
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: AddClipboardFormatListener
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
213KB
MD54d8aa8629d7dfd0b14f1c84c5cb6dec6
SHA1b4962b61cd2f986905dca04c3f852f033ecdf4eb
SHA2566e29cf38d18d2608f66a43133250fab552b0ed403dc1d79241701d9bf5542c76
SHA51278a9ecc1c5708b7efcbe3396112790ea7643c4bc4f2f15064c54ffb71c62c468b3a51507f3813659af24d933aff6dc33be1d176fee8c7d0696879759738605db
-
Filesize
47KB
MD53e83a3aa62c5ff54ed98e27b3fbecf90
SHA196d8927c870a74a478864240b3ace94ad543dfb8
SHA2562d88b97d28be01abca4544c6381a4370c1a1ce05142c176742f13b44889ddf90
SHA512ea9d05a4aa1ee5cccc61c4f5e8994efba9efff0549b69577bef1f2a22cce908739124eff1e0db5cfdd69e077ad2d7cdb1307de92d79673c9309ee621cb139956
-
Filesize
26KB
MD55cd580b22da0c33ec6730b10a6c74932
SHA10b6bded7936178d80841b289769c6ff0c8eead2d
SHA256de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c
SHA512c2494533b26128fbf8149f7d20257d78d258abffb30e4e595cb9c6a742f00f1bf31b1ee202d4184661b98793b9909038cf03c04b563ce4eca1e2ee2dec3bf787
-
Filesize
188KB
MD56bc9611d5b6cee698149a18d986547a8
SHA1f36ab74e4e502fdaf81e101836b94c91d80cb8ea
SHA25617377a52eeae11e8ee01eb629d6a60c10015ad2bb8bc9768e5c8e4b6500a15ed
SHA5123f23670d0ba150de19a805db6beb6eed8538bbad6fbe3cc21d17d738a43cf411c679a23cea11549e69be0321e672f740791d40e92498aef9d1f8650743ee85ea
-
Filesize
60KB
MD522af3a23bd30484514cdacf67c5b3810
SHA1e92a4eaee9d896964de541ce2f01c2404b638258
SHA2567c5442121dba2a30ab9579ec08e111ded372cf9cf90fb3256f273980b975afa9
SHA51295e40b27e90fce7ca85e76afbbc16eb62b4bb977664702b987de2eb2294e6fe9e6df5610ec7b2362c2c68493313f30fbbcbd3446dbe8ae2fa47b89407f5d5936
-
Filesize
93KB
MD5dc615e9d8ec81cbf2e2452516373e5a0
SHA1ec83d37a4f45caeb07b1605324d0315f959452e9
SHA256e9ab064ed381c29a3930f75ca3e05605c6ee07f30a69c043f576a5461de3bafc
SHA51282fe00447fb9785264dfb8032399adf6d33d91d71058212d252742c9e5fd54f5a52f6baf4fb05e95f9a4055057c60a33a7c1c642f18a6a4e045b49be88fa5d9f
-
Filesize
1.6MB
MD529454a0cb83f28c24805e9a70e53444a
SHA1334202965b07ab69f08b16fed0ee6c7274463556
SHA256998cc3f9af5bd41ccf0f9be86192bbe20cdec08a6ff73c1199e1364195a83e14
SHA51262790920974a2f1b018d466ae3e3b5100006a3c8013f43bdb04af7074cfe5d992caaeb610de2b1b72ff0e4acf8762db1513a4a0cf331f9a340ae0ce53c3be895
-
Filesize
573KB
MD55dec65c4047de914c78816b8663e3602
SHA18807695ee8345e37efec43cbc0874277ed9b0a66
SHA25671602f6b0b27c8b7d8ad624248e6126970939effde785ec913ace19052e9960e
SHA51227b5dcb5b0aeadf246b91a173d06e5e8d6cf2cd19d86ca358e0a85b84cd9d8f2b26372ef34c3d427f57803d90f2e97cf59692c80c268a71865f08fc0e7ce42d1
-
Filesize
266B
MD5728175e20ffbceb46760bb5e1112f38b
SHA12421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA25687c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
SHA512fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
-
Filesize
746KB
MD5f01a59c5cf7ec437097d414d7c6d59c4
SHA19ea1c3fbf3b5adbe5a23578dea3b511d44e6a2dd
SHA25662b405f32a43da0c8e8ed14a58ec7b9b4422b154bfd4aed4f9be5de0bc6eb5e8
SHA512587748ad4dd18677a3b7943eab1c0f8e77fe50a45e17266ba9a0e1363eda0ff1eabcf11884a5d608e23baf86af8f011db745ad06bcdecdfd01c20430745fe4bb
-
Filesize
990B
MD5ace48c542097f3b3ddad7684110e98c5
SHA129331db5ff5dd81ff8de659aaaf411ee873925d3
SHA2564c7e293aca2e3354a5192679a5f90a86804d97f9bcb95e3c9b252767587ca6d7
SHA5124c87c4971631ffee618db3325434fd908ba58fe8aa8c84fb479ed3cef839cfad21011f09a4eeda3e4ffa7eddf2f0bc81002e30b7aa9347cc5167c70704f94a8e
-
Filesize
1017KB
MD58d94c9f4c07b76b4e32daffcc51109da
SHA162e31a89c488d6745abb72a3071f688fd6180d33
SHA2562b35c0e4088b2a7728fa7bc6a5bfdefed7665598de6d49641fdf5d1f1271a4d7
SHA5120092cbbd95777e6931864d61931efdf3a349f79c575030cad9a1771432f52e1bdc25d5640e2923d202c42c2ce242d00187486334a946e97319d48211233eb0ac
-
Filesize
172KB
MD55ef88919012e4a3d8a1e2955dc8c8d81
SHA1c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA2563e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
SHA5124544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
-
Filesize
519KB
MD5b319407e807be1a49e366f7f8ea7ee2a
SHA1b12197a877fb7e33b1cb5ba11b0da5ca706581ba
SHA256761b7e50baa229e8afcd9a50990d7f776ddb5ed1ea5fbb131c802e57cf918742
SHA512dc497643790dc608dece9c8fe7264efedd13724bd24c9bf28a60d848b405fddefb8337a60f3f32bb91518910e02c7a2aaf29fc32f86a464dfcafa365526bdb7f
-
Filesize
21KB
MD5b0585159161d50e330b7f8eda50a2770
SHA18636fab3ce6c21a42d3e5fbd495c2ddad4279162
SHA256ca9e51d51f24e16428d1b0e9a0829a44da2678bfc7ba00f0b46a57dcd6d734b8
SHA512e9ae99bdce64ca4282fa4580d3b081f7d0874c756aef77fb58e10db148e2f670ba48667ce62033c6f514ff825dc54c1bdbae2c7f8d5f9355486402cf75e1d5ad
-
Filesize
7.4MB
MD5ae5f59c9404ba3c33997efef08c385c3
SHA1e865cc79186aa41c8b552e7471a4ef4b73c5710f
SHA256730ea19831a00e7581f8badd996aed685b8169a798d94dab8f797d58af14a49d
SHA512fd76c1cb7d39b39147c1879f6a0318c9e0775aeefb62994b060c80cd994ef01abdf5e188409abf95f9c8d94de0cb9ad8552cf903b5c7c7a3bf4de058b8b8b814
-
Filesize
202KB
MD5ba84dd4e0c1408828ccc1de09f585eda
SHA1e8e10065d479f8f591b9885ea8487bc673301298
SHA2563cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
SHA5127a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
-
Filesize
24.1MB
MD5a89b5525629f9198733bad070803ff37
SHA1c2e53c74b12e31439d5e7bdace792b1997684ab3
SHA256cce939bf32af454baadcb320014f7d029c30f09f988d0ea0483c3ac72013f645
SHA512af259492e856ca75b3bb1f812814445c5d6462613fd743521e1420df45259c75fb00651876d01512d67c841af52f3f415a5c3524009551bc587215b39920287c
-
Filesize
6KB
MD53b4fc0aa6fb7fa39baeec74dbe35d4a2
SHA16749aab7e5b4656ff02d8ae8bb291c4b9038f847
SHA2562b69735b8cdefad500c711ce21c40434e4d9a378b9da72141a882d322e10870c
SHA512c832ac6949f4612736a1fab7a7665076b8ba0bb4e0e3c071acea0538e140d2f4a929fc8e6fab812a9ed10fc9170b62e13099d956a5d88f4c695359310a990a7e
-
Filesize
544KB
-
Filesize
184KB
-
Filesize
48KB
-
Filesize
136KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
544KB
-
Filesize
32KB
-
Filesize
2.8MB
-
Filesize
7.7MB
-
Filesize
760KB
-
Filesize
584KB
-
Filesize
216KB
-
Filesize
320KB
-
Filesize
5.6MB
-
Filesize
88KB
-
Filesize
1.7MB
-
Filesize
544KB
-
Filesize
1.7MB
-
Filesize
1.5MB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
216KB
-
Filesize
592KB