2aedf4746fa4cd41ddcdc200c74d5dabf58e358b8edb6b848da5cae0eaa08345

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 17:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a97dbab45fe24e468fd08afc9345a790_NeikiAnalytics.exe
Size

58KB
MD5

a97dbab45fe24e468fd08afc9345a790
SHA1

a14ba70e58334c30fba2c42b7147c31ce2f098dc
SHA256

2aedf4746fa4cd41ddcdc200c74d5dabf58e358b8edb6b848da5cae0eaa08345
SHA512

34fb29e6a38cbe2871ffa4972c77ba3b8610869cdaedd8397fe864a5fdb9afdc995eb7ba1c367d8a2f3428d1442798ce00c843fea0b619937dc912e5060c0e32
SSDEEP

1536:mzQjJuw3c6hqh1kJaJrNKx5tzzevaCpzqFFzWcXdqu7mOYhngYFD:4QduF60Q0X036aCBqXcY6tgYFD

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

a97dbab45fe24e468fd08afc9345a790_NeikiAnalytics.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	a97dbab45fe24e468fd08afc9345a790_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	a97dbab45fe24e468fd08afc9345a790_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	a97dbab45fe24e468fd08afc9345a790_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	a97dbab45fe24e468fd08afc9345a790_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	a97dbab45fe24e468fd08afc9345a790_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	a97dbab45fe24e468fd08afc9345a790_NeikiAnalytics.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

a97dbab45fe24e468fd08afc9345a790_NeikiAnalytics.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	a97dbab45fe24e468fd08afc9345a790_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	a97dbab45fe24e468fd08afc9345a790_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	a97dbab45fe24e468fd08afc9345a790_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	a97dbab45fe24e468fd08afc9345a790_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	a97dbab45fe24e468fd08afc9345a790_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	a97dbab45fe24e468fd08afc9345a790_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	a97dbab45fe24e468fd08afc9345a790_NeikiAnalytics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

a97dbab45fe24e468fd08afc9345a790_NeikiAnalytics.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Update Service = "C:\\Users\\Admin\\winupdsvcs.exe"	a97dbab45fe24e468fd08afc9345a790_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\a97dbab45fe24e468fd08afc9345a790_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a97dbab45fe24e468fd08afc9345a790_NeikiAnalytics.exe"
1⤵
- Windows security bypass
- Windows security modification
- Adds Run key to start application
PID:3672

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads