Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
10/05/2024, 00:17
General
-
Target
2a82a8d01b2ddc18dd140c7473d2e3f0_NeikiAnalytics.exe
-
Size
796KB
-
MD5
2a82a8d01b2ddc18dd140c7473d2e3f0
-
SHA1
c176cda981e9252dbb4f651611d0a105f23c2dc9
-
SHA256
23dbff82389243685ef46c7f0a3bcb9c52806696e5d4701c7cab562891bc4619
-
SHA512
760a78b554d3f668bc211641e57a8b700ebcccb35de6f7390ae35c5dfb344cc7ff8ba1087cb13f5b47053f35561e5f2b7465b875cadda56e5eaccae97f1bae13
-
SSDEEP
24576:CgJ8cTa1yn1R6v+3Wqdd69lgJ8cTa1yn1R6v+3WqddG:rS+gi1c+GmlS+gi1c+GmU
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\HELP_RECOVER_instructions+gnq.txt
http://pp4dehh5nlkcs.pesslaugh.com/DFDD184C756560D5
http://ss7fh33dfnourebfle.geckoyao.com/DFDD184C756560D5
http://h5534bvnrnkj345.maniupulp.com/DFDD184C756560D5
http://yez2o5lwqkmlv5lc.onion/DFDD184C756560D5
Signatures
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 5 IoCs
-
Renames multiple (431) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 3 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Modifies Internet Explorer settings 1 TTPs 34 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a82a8d01b2ddc18dd140c7473d2e3f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2a82a8d01b2ddc18dd140c7473d2e3f0_NeikiAnalytics.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2a82a8d01b2ddc18dd140c7473d2e3f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2a82a8d01b2ddc18dd140c7473d2e3f0_NeikiAnalytics.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\cmjmppr.exeC:\Users\Admin\AppData\Roaming\cmjmppr.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\cmjmppr.exeC:\Users\Admin\AppData\Roaming\cmjmppr.exe4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {current} bootems off5⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet5⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {current} advancedoptions off5⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {current} optionsedit off5⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures5⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {current} recoveryenabled off5⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\help_recover_instructions.TXT5⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\help_recover_instructions.HTM5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2704 CREDAT:275457 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet5⤵
- Interacts with shadow copies
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\2A82A8~1.EXE3⤵
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD54df3b8ab7f63ff9fbe1d8f59383aa2ec
SHA1ebe343c15fb2742f330e84f082691bf2d8cbd10f
SHA256b46e71164fdb2d7899a0c3fa09a9b701d2150366cda1630a7fc70ebfcd0c0b21
SHA51298fa053d95a247a05634ea295ca868a8e8deb3312596cb4bef5656f992ccfd1d560bfbf8fe3d05bfead9fa12cf2264819a53e8661d173dafcf3cd5865ee46c38
-
Filesize
65KB
MD572a9d1ae5d85ccfb0c20ad83d993a551
SHA171d488eaee4721486afeab4d8d8364007b131a61
SHA25670131a5b77d285be863042d3ae5f10fa232dc0d5a3a415c0822013255895442a
SHA512b1995624ed5f01d54a5715d4aed491c878baea1f3bb36ad65c22751090b8bf94968063a3c24c7bb60e4010759dcdd999a867627982a8f447ddb29db1ae44605b
-
Filesize
2KB
MD57d9d3808ca9b3e8dee435e521d976031
SHA1cae6f68f12c143e2def12c51ee6897db4cbdb357
SHA25658fd859e8119c6fa6f171441e200c922e52df3c898dd554eb735f8a9d59bcbde
SHA512aa7693066bc8f907e6641507dcfcb256c853e8be28cfef817821a5624254ff7165b39ed3ec346ee5fbc92f2a7187518950a9c274d6eb01486c96187824aa3691
-
Filesize
11KB
MD5f61a004867fe8e6844e985dfe01316a3
SHA11275147ce22788047533baca8625a5dfabd75eac
SHA25613d0522d07f32436847460daf0e132abb93d5cbd0286359f28304698bcfef7a4
SHA512d2c7309a86ac40cca7407eb827b60a11ffb6201486b49758e12ca981100680c7c51a0b11a97be0e2274d671004b738e32c590fdea08f70e6e7cc5d4390690a22
-
Filesize
109KB
MD579e40b795e91159f9c2899a0f50c69a6
SHA1f2c126e368c5bc56c446be460f38c03e72539e10
SHA25646f0b16dadbcafde74f7496a87cc4bee6bdba17821b02eeb66d09c11db03273e
SHA5120210e344da9ba082c7143f5b7ae7210b9cfcf7d461d54d648d22e735315bb6d825eecf6131b1d8035d90e018ef7a2252b91a418a927a5e833e3a46a2ef344f62
-
Filesize
173KB
MD55e8b1f231e96ee3303df462c3c01b125
SHA1f8c06a70228126e427b7dd07d7076901204972bc
SHA2564f0a07a558c078af69a51ffbe8f64ce4c16cca0d306616f1543c72f99f73f90d
SHA5120887b1172041989cfac969aa117c80acefbebaaa5549bccaa5e2752b7733f93760352bd13bc6fd0fa9cb06ae4ee1386816a7a5437b6942b43ac94c0a9f48037b
-
Filesize
344B
MD5e65a507a41788a4822037c765818d275
SHA1fc7a46f5828fcbfbc969dc66c0751bbc1dbbb29f
SHA256dcd0425a0d22395f388bfc8316a0edf0dd2596ba38e4cf84ce74de93ebaf2b16
SHA512a9581b060239a701112ada047634bc701a40af0432a8d5d1214d60cb257dc6ccffbb83cb97038a39cc3f5f664466a257ecce8ddcdf2980ac90372fc432d20a79
-
Filesize
344B
MD5c4bf5cdb4bd331d3af659f115fd39e4c
SHA18bf92d363b2ae940158e11c60603f1b74e31b94b
SHA25656e15e20c63737eefdb0296e9c53c9fe5c5ed93ab19dcec494bd3ee16999a0ae
SHA5122f707f4c89448bcf5cc3ee5a18b7d9bd5f834d5f0b0b566c8909a600cfa495a80838631fdbc262f5d0f003679a3f647164427a89bee5018ecf8e6aae7502541b
-
Filesize
344B
MD5e949b217ea0d223ab6b451a32be2f1e5
SHA141d8f325ac56f60c0823789182ed2b7c8ed7c25f
SHA25692874ca00f16ff0a412d80020d5025b3a37741e156bc21d5b12eea0a0a9ec483
SHA512cb78be60d75e4d79a6db2fbd0eaec7268ed9dcd18e99777006aed4855cc1be99a03f54b5452d9cbd3d0769995660aaf44fa661155735ef1a0430969283c22685
-
Filesize
344B
MD5d73ccc29ed0ef7e2a0e69341dc2a5c44
SHA16fdb7c9fc7e6ff3f50e9bc90b5db8277226e3016
SHA2563eb505309dc77bc2bb11bac1f4861e8b3face9e768314a582a2f39ee2652fc50
SHA51275db6e6416cf96c7502190a135e780e9413efb4e295ca766a162a42658b8d48296924039edc39b5d6c28d586c5300540dc1d7a7051b6724c82fb3a2befeff2be
-
Filesize
344B
MD5e444000dd6f02f3632c238756ff7a872
SHA1d0bab64fc227acd664c1a296ae0ffdbe42e970b7
SHA256e1e95f268517b856272c3ad427469dd1546a519b3ce6edca6f70e9efc4689650
SHA512b3eb713a4fff0c3d55bfcf26d7ac1d0add9e8d7a46d421961955c9a447b477013671ccaf37c647b574c7fe2b47018de5b96b5a63d4456e296958bb386ff2ffae
-
Filesize
344B
MD53557640e418191d7c93baed2de44a658
SHA1e9a40b466a341568aa0c13286a73b4903de1fdd5
SHA25661cfaa7b0310678eb2b244950fd262959fc92408685f14103e79e1f25af23639
SHA512a9940b4dcefcaba3ed40bf3182a0dc86dbc98542a19ce6269be35a552a13073176d6788ecfd2c43c68a3c6a5a51abaca537cc86c2a6d6a6e625dc079b717bf3c
-
Filesize
344B
MD5be91f6070ed79d676b3aa877f8d6f83e
SHA1975eaf7a90acc7fd8a41a1c3a2af55c08d4fe865
SHA256b83cfd4a2701440075a874b2137421e4e34a33bd906794cf42c86ef6234146e1
SHA5127c8398b9e087824f3712b40ed384a70b71740e45eaeb51a171d65529b5996cba4c2938e9e6b2bb7b0107a030eab21d9abcb60457f4ddbdcaa69b3708c3a0d3b0
-
Filesize
344B
MD55e12dd9d09fa37fb47cd8c79a43e1486
SHA1d9501c9481caa67f43dfba363635380de9b61c77
SHA256bbb1382a8c15f17d8786195dda8902ac09a5354f556cd841d8c00d21adfd7069
SHA5124540372f01e3562cd1a51fedcfef8397062afa2ca0047b9f5413569125853b513198b17d1472da0b64e49fd16fbc3bd159f410ff920efaecf2a32a8602994c51
-
Filesize
344B
MD5d5f09f6bcaf51b03215d33aa76a2e5f6
SHA120962a5e1a5918cdc72409ebef17ef949272c0dc
SHA25622c2d443818f3708c61ff0e87d8531f6271cd5a51817818966f68fda87ada97b
SHA51245afba39cb6cfbfdd542aa5d741d91aef545605487ca7b3b5e13d575e043b2fffe678fb8f537e4bac28eb10e6da30741ca248cbc9b1d35efe3bd3194e13be630
-
Filesize
344B
MD5a64241c6f4b02476fc5dd52cf74794fb
SHA10dc205cde0e779df6a34ebb59538f678ac242fe4
SHA256eeee31f79d3c7b18bdc8b5a36b1128813c8416f637599cdf4f3e3ea8fbdb511e
SHA5121fd7ca5fcb9af93b6388e94d9af8b91c93705a3f33a17e06ab36a000613ce399a962821e4916f958e750152df36e31037ef4e780fa8094dfca0819c2f51e169f
-
Filesize
344B
MD51c9d2c138ddf2e5218c94213d88abadc
SHA1fcf0bd3952567999e09d031b13056fded605656b
SHA2569baf7890d3a639795b45b6fbac43363fefcabc69c4bbd9f9a090f2d9c3491412
SHA5128a0694b3ed088b7b35e4412a8c7c7164cac4e8d648f42492e76d0d48e954057da25a155d3e7c4e9f1f5f213933a4890524c431a70affaa9a2ea9d02f203979e0
-
Filesize
344B
MD5735be2d27d754ca183aadda6b9a24816
SHA17904177a0cdb36d37d0f6e66306c19cb765f3f82
SHA25676c0def53d544d25a537bd5cb307011dc3bdfa5c501850a05c1cbfd958dac412
SHA51265157ce23afafceef127f3bb724a3c6f2530df41d5f63ce4ecd8e60fc8307205b98e92d314c768365ad6960ebb3c54c70b547f6026d32a15c97bb5eb7b1ac382
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
Filesize
796KB
MD52a82a8d01b2ddc18dd140c7473d2e3f0
SHA1c176cda981e9252dbb4f651611d0a105f23c2dc9
SHA25623dbff82389243685ef46c7f0a3bcb9c52806696e5d4701c7cab562891bc4619
SHA512760a78b554d3f668bc211641e57a8b700ebcccb35de6f7390ae35c5dfb344cc7ff8ba1087cb13f5b47053f35561e5f2b7465b875cadda56e5eaccae97f1bae13
-
Filesize
8KB
-
Filesize
12KB
-
Filesize
4.8MB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
8KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
4KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
4.8MB
-
Filesize
536KB
-
Filesize
536KB
