Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    13/05/2024, 10:32

General

  • Target

    b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe

  • Size

    319KB

  • MD5

    b2c1b7deb8895437ea28a79ae38fa2b0

  • SHA1

    159905247750942dc080c86155b7bb28c07e0c15

  • SHA256

    0c120bba8d75c0b1994f6273766316a5f537a7ab5a8c4649aa52c38f7fc8e346

  • SHA512

    ec81f0fce3b198ba33ed100609ce24fe0d734f39b5541559f087f7722644c0ddc60d706ea2483466c127db53041e5cfb54f3bcded5a779d66d9f2e22600edef1

  • SSDEEP

    6144:oAecbuBQy7Sb0riExpMMF9yyjeEUxmLSOBMvNOzc3m/JSrSrrwZsPHItIPA:becyG+F9yynUazcW/JCM8Uoj

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • AutoIT Executable 17 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\b2c1b7deb8895437ea28a79ae38fa2b0_NeikiAnalytics.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1716
    • C:\Windows\svhost.exe
      C:\Windows\svhost.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1688

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Documents and Settings.exe

          Filesize

          319KB

          MD5

          c9d8208a53429eec993d20032a67a432

          SHA1

          51cc2db997c87a7eb2cb8a682957968ce040d2b0

          SHA256

          c9e565c38cd754a55f25e4dfad6e7e8336e7f2972ae3e01fdeabaaf74d545aec

          SHA512

          d7d0dbbbf5a9e3c19741caa605d0d7682672132d58e2830167079fe6c4b52ae9b74b3f351cca256f787e226828ff54fc3fb3b43138b60c088cfa02f75dc998d8

        • C:\Windows\Driver.db

          Filesize

          82B

          MD5

          c2d2dc50dca8a2bfdc8e2d59dfa5796d

          SHA1

          7a6150fc53244e28d1bcea437c0c9d276c41ccad

          SHA256

          b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960

          SHA512

          6cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4

        • C:\Windows\svhost.exe

          Filesize

          319KB

          MD5

          5c6ae73a4bc604c3f0428e3bda220f9f

          SHA1

          42b191cabd8936454c616e7e1721a147368bffef

          SHA256

          f396e3b3221258eaf16a0fe0dee88f16216329c77836723818db51938ae2e1f0

          SHA512

          268575fcf0dfafa8b492b1b6d4d98db82134170ea8060198f3cf302a77e126e79bc1e9b208e7e21fd01495ca5afb0533b902a86538370dd8896b8922372194c0

        • memory/1688-10330-0x0000000000400000-0x00000000004C0000-memory.dmp

          Filesize

          768KB

        • memory/1688-6889-0x0000000000400000-0x00000000004C0000-memory.dmp

          Filesize

          768KB

        • memory/1688-15884-0x0000000000400000-0x00000000004C0000-memory.dmp

          Filesize

          768KB

        • memory/1688-1324-0x0000000000400000-0x00000000004C0000-memory.dmp

          Filesize

          768KB

        • memory/1688-2386-0x0000000000400000-0x00000000004C0000-memory.dmp

          Filesize

          768KB

        • memory/1688-2655-0x0000000000400000-0x00000000004C0000-memory.dmp

          Filesize

          768KB

        • memory/1688-3448-0x0000000000400000-0x00000000004C0000-memory.dmp

          Filesize

          768KB

        • memory/1688-4766-0x0000000000400000-0x00000000004C0000-memory.dmp

          Filesize

          768KB

        • memory/1688-5830-0x0000000000400000-0x00000000004C0000-memory.dmp

          Filesize

          768KB

        • memory/1688-6-0x0000000000400000-0x00000000004C0000-memory.dmp

          Filesize

          768KB

        • memory/1688-7946-0x0000000000400000-0x00000000004C0000-memory.dmp

          Filesize

          768KB

        • memory/1688-9271-0x0000000000400000-0x00000000004C0000-memory.dmp

          Filesize

          768KB

        • memory/1688-14828-0x0000000000400000-0x00000000004C0000-memory.dmp

          Filesize

          768KB

        • memory/1688-11387-0x0000000000400000-0x00000000004C0000-memory.dmp

          Filesize

          768KB

        • memory/1688-12441-0x0000000000400000-0x00000000004C0000-memory.dmp

          Filesize

          768KB

        • memory/1688-13771-0x0000000000400000-0x00000000004C0000-memory.dmp

          Filesize

          768KB

        • memory/1716-0-0x0000000000400000-0x00000000004C0000-memory.dmp

          Filesize

          768KB

        • memory/1716-794-0x0000000000400000-0x00000000004C0000-memory.dmp

          Filesize

          768KB