c39625f5472ac9ed6dd8fcd59c4b8a67fd358532fb3e66bfadc129e4158908d8

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-05-2024 20:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46eb961a0f42b476423f965a0dfe2950_NEIKI.exe
Size

772KB
MD5

46eb961a0f42b476423f965a0dfe2950
SHA1

ebee2b492a6724698305d82982d8713d78588f6b
SHA256

c39625f5472ac9ed6dd8fcd59c4b8a67fd358532fb3e66bfadc129e4158908d8
SHA512

40c35eb379f8528b956e270fa98428d4f2af35ff59bb8bfe05bc11a393fa7454c2bd6a4502e6a7db3e7d50c8e05c9a652596ba0282c49d72fef94f3c8b32e7c0
SSDEEP

3072:MGjhaq5iL0beJQZt32wLji5DlsODxRPNDkjJHzW9hUd56JsuBSjwA2i1vP2i1a10:Hha8iAx+1zwjJHd6vB/ANMfqyYt

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\GGAAAG_LOADER = "C:\\Windows\\system32\\GAAG.exe"	46eb961a0f42b476423f965a0dfe2950_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FifefoxUpdater = "C:\\Windows\\system32\\FifefoxUpdater.scr"	46eb961a0f42b476423f965a0dfe2950_NEIKI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinSevenUpdater = "C:\\Windows\\system32\\AVSCANNER.EXE"	46eb961a0f42b476423f965a0dfe2950_NEIKI.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\FifefoxUpdater.scr	46eb961a0f42b476423f965a0dfe2950_NEIKI.exe
File created	C:\Windows\SysWOW64\AVSCANNER.EXE	46eb961a0f42b476423f965a0dfe2950_NEIKI.exe
File opened for modification	C:\Windows\SysWOW64\AVSCANNER.EXE	46eb961a0f42b476423f965a0dfe2950_NEIKI.exe
File created	C:\Windows\SysWOW64\GAAG.exe	46eb961a0f42b476423f965a0dfe2950_NEIKI.exe
File opened for modification	C:\Windows\SysWOW64\GAAG.exe	46eb961a0f42b476423f965a0dfe2950_NEIKI.exe
File created	C:\Windows\SysWOW64\FifefoxUpdater.scr	46eb961a0f42b476423f965a0dfe2950_NEIKI.exe

C:\Users\Admin\AppData\Local\Temp\46eb961a0f42b476423f965a0dfe2950_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\46eb961a0f42b476423f965a0dfe2950_NEIKI.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:1740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\AVSCANNER.EXE

Filesize
782KB

MD5
61e25d0eefce287c913e1d5599221a92

SHA1
168c3fa69639fff07a034129d17f40a020391725

SHA256
df6c204b8e127383f7f4f17783d298f9e65d99d617b872cd5102b63e62de3cb1

SHA512
4b27590610d61f66868ac55696c6a3f426e032bda4fc2ef9c4f86e22fdb75374a871535d03c4a169dcee9fa272678586ecd2ec85f3f98fac2197a5f09ebbb328

Download Submit
memory/1740-0-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1740-7-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads