Overview

overview

8

Static

static

3

43ca84c6ce...cs.exe

windows7-x64

8

43ca84c6ce...cs.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/05/2024, 00:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    43ca84c6ce357df9bf4d7d0faafb1030_NeikiAnalytics.exe

  • Size

    437KB

  • MD5

    43ca84c6ce357df9bf4d7d0faafb1030

  • SHA1

    7e10745402c4a037ec8aa3a83e4273531347f3b7

  • SHA256

    d0ba083540dacb845d43f74b494c0ee4f5b0df7424b2bdb0b7cfdd1308480adc

  • SHA512

    317787210309bd219c81e268bb39b29ada8a1bbdef263d5d9d76fc4591acba27d9bf23197e06dc85928a51329f9b87cc42875cfb7cb67491fc4217f4aae18d5a

  • SSDEEP

    6144:/MHD3/AK2Es7eVyYr9AmEcmI5qpYDb1MV+w1ILKcrsliCC+B:/MHL/ACsKVyY3EcmIopMbv1Ocr9aB

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 39 IoCs
  • Manipulates Digital Signatures 2 IoCs

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 3 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Drops desktop.ini file(s) 57 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 25 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 30 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\43ca84c6ce357df9bf4d7d0faafb1030_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\43ca84c6ce357df9bf4d7d0faafb1030_NeikiAnalytics.exe"
    1⤵
    • Drops file in Drivers directory
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3348
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Windows\AE 0124 BE.msi"
      2⤵
      • Blocklisted process makes network request
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:1200
    • C:\Windows\SysWOW64\drivers\winlogon.exe
      "C:\Windows\System32\drivers\winlogon.exe"
      2⤵
      • Drops file in Drivers directory
      • Checks computer location settings
      • Executes dropped EXE
      • Drops autorun.inf file
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4272
      • C:\Windows\AE 0124 BE.exe
        "C:\Windows\AE 0124 BE.exe"
        3⤵
        • Drops file in Drivers directory
        • Manipulates Digital Signatures
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops desktop.ini file(s)
        • Drops autorun.inf file
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2896
        • C:\Windows\SysWOW64\drivers\winlogon.exe
          "C:\Windows\System32\drivers\winlogon.exe"
          4⤵
          • Drops file in Drivers directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:3228
      • C:\Windows\SysWOW64\drivers\winlogon.exe
        "C:\Windows\System32\drivers\winlogon.exe"
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:4444
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4820
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:2160
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:2868

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Config.Msi\e578e08.rbs
            Filesize

            7KB

            MD5

            e24fb6ad6ef87c19a8e1f0416c2c6486

            SHA1

            95ff9eea42ee126f50a44293ea74fcb0d6000c90

            SHA256

            9ad64bfc930641302cae42fedc3e82b01736bfb2dd344c93d6aeb6e0178155e9

            SHA512

            e5548fa236d53bbaabf40b8b6757ce17ec456588a166f6177a6db083d94f5128c7056c8022ee6a0521a6fd9dad040c6e0d3e8eaa18230d9fca28a1bd038fa3f7

            Download Submit

          • C:\Windows\AE 0124 BE.msi
            Filesize

            437KB

            MD5

            5ce4e4d240dd24adfdee146cba3a938f

            SHA1

            5105fdf3a2bc18df9f00a314cace5ba0c21d34f8

            SHA256

            a4245e25ad8fdaa6383ed62bd4a78b025c60b6212e42b52cc604c0d2197fd4bc

            SHA512

            94411d6882cb15c8ba1ce2ad086655eabe32b1f749f75787799d0863d4bd3b9eadfb3f2aafcda3f8dacf31452fb088b8e48fff2f43d09c9d9ebeddb1d27aa0c4

            Download Submit

          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log
            Filesize

            155KB

            MD5

            e81095df961ceadce1327d59032e5264

            SHA1

            4bcaeec06a62718399b163b5cd8bc0320182d414

            SHA256

            68c9cc1dac9f5ad472481edd2efda14b93ef6bf52126de5f510b206c270e8dca

            SHA512

            df3159c5b59235fe8bb91b3ac1f723a8b61a5895f8175c01192fdbe1dcf8141c2449c177a0c8d3ff2c49af7f8d9c4e3ef85d07ed01a25197f5fe54387c858690

            Download Submit

          • C:\Windows\Msvbvm60.dll
            Filesize

            1.4MB

            MD5

            25f62c02619174b35851b0e0455b3d94

            SHA1

            4e8ee85157f1769f6e3f61c0acbe59072209da71

            SHA256

            898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

            SHA512

            f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

            Download Submit

          • C:\Windows\SysWOW64\drivers\winlogon.exe
            Filesize

            130KB

            MD5

            3c9b1eaec6c0553ec55cc981859ad52d

            SHA1

            dc1b89778d23517677327fc7265419f507ce5f60

            SHA256

            bb42a5c15238d5b38ec51c0d7069d35a62e84c058c0c3d995a934e8dfba3a728

            SHA512

            8caccc427dda37b1b40e32eea0523d67dc7391bd6ca1d3c570fed86d50a5b3e80b48395d022407049c23e82e3f9a41d3323fbab94ac7520887d6f82df358caa5

            Download Submit

          • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
            Filesize

            23.7MB

            MD5

            6bb2838515489540d0882e96863f11f9

            SHA1

            90af69bb7a9805bcbcd87c2de94470eec878c28e

            SHA256

            b3a7a9d2b35cc760f017bf4148904b4c3fc5c658afbcc4b98424331d6bafb80a

            SHA512

            8957e5d84cc681f9bdadb8c632f4483d12588525cfa53abe11775a16525090fc5c63203a2e77676b3b0fb7080919de5941e2a63d9ac6f51468b2efc5a31df3d4

            Download Submit

          • \??\Volume{b97e3c07-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{b487218e-9d44-4772-b785-9baade743c91}_OnDiskSnapshotProp
            Filesize

            6KB

            MD5

            cd0e0dbfad5f38a2688606580b6e367c

            SHA1

            a72d3ac7f2e6f4e16f99194249e5604aca17e836

            SHA256

            e6eb0ff4c4faa86325075fd9c6ec33bfea78f7e4c07915fba584c547d74e4281

            SHA512

            e36b4076fa15b6299a8a186031656c26607d8e0cd333b66de245a1c7ec170e569cbed5b8e3ad907b0a2c304dcc9a96e001a948983e33df08787d5f9a023b75e7

            Download Submit

          • \??\c:\B1uv3nth3x1.diz
            Filesize

            21B

            MD5

            9cceaa243c5d161e1ce41c7dad1903dd

            SHA1

            e3da72675df53fffa781d4377d1d62116eafb35b

            SHA256

            814649b436ea43dd2abb99693e06019d4079ee74d02a0395913add0ba92d0189

            SHA512

            af9b75dc9a0b39d12d48bf6d40eb7d778eb9dd976302792271d8d4245a916027cf4e705d6cd7a5e6582ba94953346f291122f27d377b2c1a86e45f49e92efb5b

            Download Submit