e0fd32068113943a8582201a82d58ba9ec79c5be78c49680a240da2ef6c75f25

Analysis

max time kernel
125s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14-05-2024 06:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91970b5fc9e24784d9e9621434a36170_NeikiAnalytics.exe
Size

94KB
MD5

91970b5fc9e24784d9e9621434a36170
SHA1

2a2a527a9b35f78ec0f9206160c82da965793ad8
SHA256

e0fd32068113943a8582201a82d58ba9ec79c5be78c49680a240da2ef6c75f25
SHA512

df2515768a55cb210d1f0a3172e2badbfc2ad96d193142afe1e8c0f14608e191ed8d74b9e27beea5e6dc8b220ae717f9895034655e2cbee76a1f74c3f13dbeed
SSDEEP

1536:PGYU/W2/HG6QMauSV3ixJHABLrmhH7i9CO+WHg7zRZICrWaGZh7ub:PfU/WF6QMauSuiWNi9CO+WARJrWNZ4

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	91970b5fc9e24784d9e9621434a36170_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
4964	wuauclt.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Window Update = "\"C:\\ProgramData\\Update\\wuauclt.exe\" /run"	91970b5fc9e24784d9e9621434a36170_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 4964	928	91970b5fc9e24784d9e9621434a36170_NeikiAnalytics.exe	90
PID 928 wrote to memory of 4964	928	91970b5fc9e24784d9e9621434a36170_NeikiAnalytics.exe	90
PID 928 wrote to memory of 4964	928	91970b5fc9e24784d9e9621434a36170_NeikiAnalytics.exe	90
PID 928 wrote to memory of 3564	928	91970b5fc9e24784d9e9621434a36170_NeikiAnalytics.exe	100
PID 928 wrote to memory of 3564	928	91970b5fc9e24784d9e9621434a36170_NeikiAnalytics.exe	100
PID 928 wrote to memory of 3564	928	91970b5fc9e24784d9e9621434a36170_NeikiAnalytics.exe	100

C:\Users\Admin\AppData\Local\Temp\91970b5fc9e24784d9e9621434a36170_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\91970b5fc9e24784d9e9621434a36170_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:928
- C:\ProgramData\Update\wuauclt.exe
  "C:\ProgramData\Update\wuauclt.exe" /run
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\windows\SysWOW64\cmd.exe
  "C:\windows\system32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\91970b5fc9e24784d9e9621434a36170_NeikiAnalytics.exe" >> NUL
  2⤵
  PID:3564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4256,i,13640054265074968359,8146127767143474550,262144 --variations-seed-version --mojo-platform-channel-handle=3924 /prefetch:8
1⤵
PID:4148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Update\wuauclt.exe

Filesize
94KB

MD5
ba2fd08de1dbe220b5ecd78901ebfbe0

SHA1
19003b6d8efbcffcbfd53a8729b3163111244828

SHA256
2b3fc91f3ed6d04db88bd8a4486138dc7f0a45025c41fdb9ad34db613bae7288

SHA512
849939d0cb4d10e248814b390a6148dff469fb27aad1446f1416fc1b2ab0a756315e8e0836c521ac27fb168637b80da1179f4ed2d50b4b28ed7b07041d395976

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads