General

  • Target

    a1274e0a0ad9a6e693f7b41c6606d380_NeikiAnalytics

  • Size

    90KB

  • Sample

    240513-g7qf4aad3z

  • MD5

    a1274e0a0ad9a6e693f7b41c6606d380

  • SHA1

    aea4143356ca4158247d1fac0e101880c63cee17

  • SHA256

    962c78f83732d10ac644631bfa24febe292aea04997e82d0b36cbb2186cd8421

  • SHA512

    abe9b325d71b2f8557f4b39e1ba673294f496b1d495b7be42268c1a3019d36c7803bf9f9e0bc6f0a9d4f7afdc15d746f6436b6f91a3d7f21a6669873d9b6ee30

  • SSDEEP

    1536:XRsjdLaslqdBXvTUL0Hnouy8VjgRsjdLaslqdBXvTUL0Hnouy8Vj:XOJKqsout9gOJKqsout9

Score
10/10

Malware Config

Targets

    • Target

      a1274e0a0ad9a6e693f7b41c6606d380_NeikiAnalytics

    • Size

      90KB

    • MD5

      a1274e0a0ad9a6e693f7b41c6606d380

    • SHA1

      aea4143356ca4158247d1fac0e101880c63cee17

    • SHA256

      962c78f83732d10ac644631bfa24febe292aea04997e82d0b36cbb2186cd8421

    • SHA512

      abe9b325d71b2f8557f4b39e1ba673294f496b1d495b7be42268c1a3019d36c7803bf9f9e0bc6f0a9d4f7afdc15d746f6436b6f91a3d7f21a6669873d9b6ee30

    • SSDEEP

      1536:XRsjdLaslqdBXvTUL0Hnouy8VjgRsjdLaslqdBXvTUL0Hnouy8Vj:XOJKqsout9gOJKqsout9

    Score
    10/10
    • Modifies WinLogon for persistence

    • Modifies visibility of file extensions in Explorer

    • Modifies visiblity of hidden/system files in Explorer

    • Disables RegEdit via registry modification

    • Disables use of System Restore points

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks