e13c0f9b20ac39ee663843af86145050cbfef47387088bb6fffa9c3955bf7c10

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 14:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d620ce87694d6aaf4851ea0b203b03a0_NeikiAnalytics.exe
Size

2.0MB
MD5

d620ce87694d6aaf4851ea0b203b03a0
SHA1

e33d49f83dd531bfd0f8a595526c29e84950247f
SHA256

e13c0f9b20ac39ee663843af86145050cbfef47387088bb6fffa9c3955bf7c10
SHA512

831f6b0b3c2e675efc4dc3bafb63bcaf3f307e80eb77e4daa77deab31504187154514691814e6c13f5e87d8db225ee15e776c8c1d03f64adcc62fb91ff52d942
SSDEEP

49152:k05czfx+MZ5oqTGOFDyhFufVjyFT/28N9L7jE8usH:kIczfX6mjFtfV/8NNd

Score

4^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

NFWCHK.exe

pid process

2536 NFWCHK.exe
Loads dropped DLL 1 IoCs

Processes:

d620ce87694d6aaf4851ea0b203b03a0_NeikiAnalytics.exe

pid process

2248 d620ce87694d6aaf4851ea0b203b03a0_NeikiAnalytics.exe

pid	process
2536	NFWCHK.exe

pid	process
2248	d620ce87694d6aaf4851ea0b203b03a0_NeikiAnalytics.exe

Modifies Control Panel 1 IoCs

evasion

Processes:

d620ce87694d6aaf4851ea0b203b03a0_NeikiAnalytics.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\Desktop\MuiCached	d620ce87694d6aaf4851ea0b203b03a0_NeikiAnalytics.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

d620ce87694d6aaf4851ea0b203b03a0_NeikiAnalytics.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	d620ce87694d6aaf4851ea0b203b03a0_NeikiAnalytics.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

d620ce87694d6aaf4851ea0b203b03a0_NeikiAnalytics.exe

pid process

2248 d620ce87694d6aaf4851ea0b203b03a0_NeikiAnalytics.exe
2248 d620ce87694d6aaf4851ea0b203b03a0_NeikiAnalytics.exe

pid	process
2248	d620ce87694d6aaf4851ea0b203b03a0_NeikiAnalytics.exe
2248	d620ce87694d6aaf4851ea0b203b03a0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

d620ce87694d6aaf4851ea0b203b03a0_NeikiAnalytics.exe

description	pid	process	target process
PID 2248 wrote to memory of 2536	2248	d620ce87694d6aaf4851ea0b203b03a0_NeikiAnalytics.exe	NFWCHK.exe
PID 2248 wrote to memory of 2536	2248	d620ce87694d6aaf4851ea0b203b03a0_NeikiAnalytics.exe	NFWCHK.exe
PID 2248 wrote to memory of 2536	2248	d620ce87694d6aaf4851ea0b203b03a0_NeikiAnalytics.exe	NFWCHK.exe
PID 2248 wrote to memory of 2536	2248	d620ce87694d6aaf4851ea0b203b03a0_NeikiAnalytics.exe	NFWCHK.exe

C:\Users\Admin\AppData\Local\Temp\d620ce87694d6aaf4851ea0b203b03a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\d620ce87694d6aaf4851ea0b203b03a0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Modifies Control Panel
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Users\Public\Documents\Wondershare\NFWCHK.exe
  C:\Users\Public\Documents\Wondershare\NFWCHK.exe
  2⤵
  - Executes dropped EXE
  PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Wondershare\WAE\wsWAE.log

Filesize
2KB

MD5
338c4566d54ae13450fd7ded7034c79b

SHA1
3fcb7516820f746dbc3d9e4a8a97b473a8331588

SHA256
8ba8e2925d88ce25c2f93dad6d5912d7fbf16d2242e15b29f8397c5527560ebb

SHA512
6037ccfb38d1eba10c0e0a5df36726a00d7f24d590bb19bf1ddfe93fd6f5f8f88a69d5199127141feab607d5e7a737e4693612ba0adfa55b5c8e5eec3f5f4ee9

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsduilib.log

Filesize
7KB

MD5
f019fee5d664def61ff6008968a1cd98

SHA1
87f2a2e9074132fa967f8c5701c511b33481c327

SHA256
1751afc935692590b163fb4c6fd6c87a7e95561b9e990379e7559d5158572c95

SHA512
1f46dd09c7b23a645207e4c28b5a4721815716a8744f943f49d4cf89d560074c48500354d90e46bc986e650679ebc7c6b61c1a19a08d17e49ee196084e3e4b43

Download Submit
C:\Users\Public\Documents\Wondershare\NFWCHK.exe.config

Filesize
223B

MD5
5babf2a106c883a8e216f768db99ad51

SHA1
f39e84a226dbf563ba983c6f352e68d561523c8e

SHA256
9e676a617eb0d0535ac05a67c0ae0c0e12d4e998ab55ac786a031bfc25e28300

SHA512
d4596b0aafe03673083eef12f01413b139940269255d10256cf535853225348752499325a5def803fa1189e639f4a2966a0fbb18e32fe8d27e11c81c9e19a0bb

Download Submit
\Users\Public\Documents\Wondershare\NFWCHK.exe

Filesize
7KB

MD5
27cfb3990872caa5930fa69d57aefe7b

SHA1
5e1c80d61e8db0cdc0c9b9fa3b2e36d156d45f8f

SHA256
43881549228975c7506b050bce4d9b671412d3cdc08c7516c9dbbb7f50c25146

SHA512
a1509024872c99c1cf63f42d9f3c5f063afde4e9490c21611551ddd2322d136ce9240256113c525305346cf7b66ccca84c3df67637c8fecbfeebf14ffa373a2a

Download Submit