b3716d1f6b8418b022ac0a35dadb27b092b645a07cda4abce710ff142f1837ef

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 02:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
Size

3.6MB
MD5

6b111ab2aa6545345c1bc2c52e5055d0
SHA1

1a7d338fe11a43476405ecf41d7f2e671f64587d
SHA256

b3716d1f6b8418b022ac0a35dadb27b092b645a07cda4abce710ff142f1837ef
SHA512

664b76ad4d175ae91d5055ae2bed570f93bead2a683441b5a1cbf90a2cc8b41db869263d9b84fca3d6a48ef32739512c195f827a8cee5f79db1f1d1b38904b2c
SSDEEP

49152:+VaCXb1QHFdczdPQPjLFVXQ/GIFt/kl0LudCTJ8qKFolYAn5jqKdxogNkQKP:+oCLK+PItNIFt/kl0cbildjqK/ogeQ

Score

1^/10

Malware Config

Signatures

Modifies registry class 45 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Vim.Application.1	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Vim.Application.1\ = "Vim"	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F0BFAE0-4C90-11D1-82D7-0004AC368519}\1.1\FLAGS\ = "0"	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0F0BFAE1-4C90-11D1-82D7-0004AC368519}\ = "Vim"	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0F0BFAE1-4C90-11D1-82D7-0004AC368519}\LocalServer32	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0F0BFAE1-4C90-11D1-82D7-0004AC368519}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe"	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0F0BFAE1-4C90-11D1-82D7-0004AC368519}\VersionIndependentProgID\ = "Vim.Application"	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Vim.Application\ = "Vim"	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F0BFAE2-4C90-11D1-82D7-0004AC368519}\ProxyStubClsid32	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F0BFAE0-4C90-11D1-82D7-0004AC368519}\1.1\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0F0BFAE1-4C90-11D1-82D7-0004AC368519}\ProgID\ = "Vim.Application.1"	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0F0BFAE1-4C90-11D1-82D7-0004AC368519}\TypeLib\ = "{0F0BFAE0-4C90-11D1-82D7-0004AC368519}"	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F0BFAE0-4C90-11D1-82D7-0004AC368519}\1.1\0\win32	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F0BFAE0-4C90-11D1-82D7-0004AC368519}\1.1\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe"	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F0BFAE0-4C90-11D1-82D7-0004AC368519}\1.1\HELPDIR	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Vim.Application.1\CLSID	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F0BFAE0-4C90-11D1-82D7-0004AC368519}\1.1	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0F0BFAE2-4C90-11D1-82D7-0004AC368519}\TypeLib\ = "{0F0BFAE0-4C90-11D1-82D7-0004AC368519}"	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F0BFAE2-4C90-11D1-82D7-0004AC368519}\TypeLib\ = "{0F0BFAE0-4C90-11D1-82D7-0004AC368519}"	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F0BFAE2-4C90-11D1-82D7-0004AC368519}\TypeLib	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0F0BFAE1-4C90-11D1-82D7-0004AC368519}\ProgID	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Vim.Application\CurVer	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Vim.Application\CurVer\ = "Vim.Application.1"	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0F0BFAE2-4C90-11D1-82D7-0004AC368519}\ProxyStubClsid32	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F0BFAE2-4C90-11D1-82D7-0004AC368519}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0F0BFAE1-4C90-11D1-82D7-0004AC368519}\TypeLib	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Vim.Application\CLSID	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0F0BFAE2-4C90-11D1-82D7-0004AC368519}\TypeLib	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0F0BFAE2-4C90-11D1-82D7-0004AC368519}\TypeLib\Version = "1.1"	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F0BFAE2-4C90-11D1-82D7-0004AC368519}\TypeLib\Version = "1.1"	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F0BFAE2-4C90-11D1-82D7-0004AC368519}	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Vim.Application	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Vim.Application	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F0BFAE0-4C90-11D1-82D7-0004AC368519}	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F0BFAE0-4C90-11D1-82D7-0004AC368519}\1.1\0	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0F0BFAE2-4C90-11D1-82D7-0004AC368519}\ = "IVim"	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Vim.Application\CLSID\ = "{0F0BFAE1-4C90-11D1-82D7-0004AC368519}"	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Vim.Application.1\CLSID\ = "{0F0BFAE1-4C90-11D1-82D7-0004AC368519}"	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F0BFAE2-4C90-11D1-82D7-0004AC368519}\ = "IVim"	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0F0BFAE2-4C90-11D1-82D7-0004AC368519}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0F0BFAE1-4C90-11D1-82D7-0004AC368519}	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0F0BFAE1-4C90-11D1-82D7-0004AC368519}\VersionIndependentProgID	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F0BFAE0-4C90-11D1-82D7-0004AC368519}\1.1\ = "Vim OLE Interface 1.1 Type Library"	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F0BFAE0-4C90-11D1-82D7-0004AC368519}\1.1\FLAGS	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0F0BFAE2-4C90-11D1-82D7-0004AC368519}	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2356	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2356	6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6b111ab2aa6545345c1bc2c52e5055d0_NeikiAnalytics.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2356

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads