b2c1ab1189b5f46fe09742d55022efdd860dfe3c5fbc2c58bf7d3db7e680ea9d

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 13:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e0c8f4b80de9c184ce2bcda36cdef5c0_NeikiAnalytics.dll
Size

389KB
MD5

e0c8f4b80de9c184ce2bcda36cdef5c0
SHA1

986549ed1b829351b97fc1cde247ea8a2e12c01b
SHA256

b2c1ab1189b5f46fe09742d55022efdd860dfe3c5fbc2c58bf7d3db7e680ea9d
SHA512

dce30bd0dd63f50122745a31526161ea59b657b1644d822782d0ec5e2b3ee0b7ca7fbf1591f7f2ccd7aa9d94dfb8566985bb309fef298bb3f2424d123474932d
SSDEEP

6144:n6+91F0OIVZRzEsOh7eANMU1v4P++IgN3AMOtMAwkMxiFWLzsVCPxABjY6E:ntQNzEsOZHoN3+CAwFVzsVCPH6

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2404	regsvr32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDEADE99-C265-11D0-BCED-00A0C90AB50F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDEADE9E-C265-11d0-BCED-00A0C90AB50F}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OWS.PostData\ = "OWS Post Data"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDEADE9E-C265-11D0-BCED-00A0C90AB50F}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BDEADE33-C265-11D0-BCED-00A0C90AB50F}\2.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDEADE9A-C265-11D0-BCED-00A0C90AB50F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDEADE9E-C265-11d0-BCED-00A0C90AB50F}\InprocServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDEADE9E-C265-11D0-BCED-00A0C90AB50F}\Programmable	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDEADE9E-C265-11D0-BCED-00A0C90AB50F}\Version	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDEADE9E-C265-11D0-BCED-00A0C90AB50F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDEADE9E-C265-11d0-BCED-00A0C90AB50F}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDEADE98-C265-11d0-BCED-00A0C90AB50F}\VersionIndependentProgID\ = "OWS.PostData"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDEADE98-C265-11d0-BCED-00A0C90AB50F}\MiscStatus\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDEADE98-C265-11d0-BCED-00A0C90AB50F}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SharePoint.SpreadsheetLauncher.1\CLSID\ = "{BDEADE9E-C265-11d0-BCED-00A0C90AB50F}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDEADE99-C265-11D0-BCED-00A0C90AB50F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDEADE99-C265-11D0-BCED-00A0C90AB50F}\TypeLib\ = "{BDEADE33-C265-11D0-BCED-00A0C90AB50F}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDEADE9A-C265-11D0-BCED-00A0C90AB50F}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDEADE9F-C265-11D0-BCED-00A0C90AB50F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDEADE9E-C265-11d0-BCED-00A0C90AB50F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDEADE9E-C265-11d0-BCED-00A0C90AB50F}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e0c8f4b80de9c184ce2bcda36cdef5c0_NeikiAnalytics.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDEADE9E-C265-11d0-BCED-00A0C90AB50F}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDEADE98-C265-11D0-BCED-00A0C90AB50F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDEADE98-C265-11d0-BCED-00A0C90AB50F}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e0c8f4b80de9c184ce2bcda36cdef5c0_NeikiAnalytics.dll, 215"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDEADE9F-C265-11D0-BCED-00A0C90AB50F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDEADE99-C265-11D0-BCED-00A0C90AB50F}\TypeLib\Version = "2.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SharePoint.SpreadsheetLauncher\CLSID\ = "{3FD37ABB-F90A-4de5-AA38-179629E64C2F}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDEADE9A-C265-11D0-BCED-00A0C90AB50F}\TypeLib\Version = "2.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDEADE9E-C265-11d0-BCED-00A0C90AB50F}\VersionIndependentProgID\ = "SharePoint.SpreadsheetLauncher"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDEADE9E-C265-11d0-BCED-00A0C90AB50F}\Version	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDEADE98-C265-11D0-BCED-00A0C90AB50F}\Control	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDEADE98-C265-11D0-BCED-00A0C90AB50F}\Programmable	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDEADE98-C265-11D0-BCED-00A0C90AB50F}\ToolboxBitmap32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDEADE98-C265-11D0-BCED-00A0C90AB50F}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDEADE9F-C265-11D0-BCED-00A0C90AB50F}\TypeLib\Version = "2.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDEADE9E-C265-11d0-BCED-00A0C90AB50F}\ProgID\ = "SharePoint.SpreadsheetLauncher.1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDEADE98-C265-11D0-BCED-00A0C90AB50F}\MiscStatus\1	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDEADE98-C265-11D0-BCED-00A0C90AB50F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDEADE98-C265-11d0-BCED-00A0C90AB50F}\ = "OWS Post Data"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDEADE98-C265-11d0-BCED-00A0C90AB50F}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDEADE98-C265-11d0-BCED-00A0C90AB50F}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e0c8f4b80de9c184ce2bcda36cdef5c0_NeikiAnalytics.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDEADE98-C265-11d0-BCED-00A0C90AB50F}\MiscStatus\1\ = "1024"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDEADE98-C265-11d0-BCED-00A0C90AB50F}\TypeLib\ = "{BDEADE33-C265-11D0-BCED-00A0C90AB50F}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SharePoint.SpreadsheetLauncher\CurVer\ = "SharePoint.SpreadsheetLauncher.2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDEADE99-C265-11D0-BCED-00A0C90AB50F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDEADE9F-C265-11D0-BCED-00A0C90AB50F}\TypeLib\ = "{BDEADE33-C265-11D0-BCED-00A0C90AB50F}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDEADE98-C265-11d0-BCED-00A0C90AB50F}\Control	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDEADE99-C265-11D0-BCED-00A0C90AB50F}\ = "IOWSPostData"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDEADE9A-C265-11D0-BCED-00A0C90AB50F}\TypeLib\ = "{BDEADE33-C265-11D0-BCED-00A0C90AB50F}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SharePoint.SpreadsheetLauncher.1\ = "SharePoint Spreadsheet Launcher"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OWS.PostData.1\ = "OWS Post Data"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDEADE98-C265-11d0-BCED-00A0C90AB50F}\ToolboxBitmap32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDEADE98-C265-11d0-BCED-00A0C90AB50F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BDEADE33-C265-11D0-BCED-00A0C90AB50F}\2.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e0c8f4b80de9c184ce2bcda36cdef5c0_NeikiAnalytics.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDEADE99-C265-11D0-BCED-00A0C90AB50F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDEADE9E-C265-11d0-BCED-00A0C90AB50F}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDEADE9E-C265-11d0-BCED-00A0C90AB50F}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDEADE98-C265-11d0-BCED-00A0C90AB50F}\MiscStatus\1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDEADE9F-C265-11D0-BCED-00A0C90AB50F}\ = "IOWSExcelLauncher"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDEADE9F-C265-11D0-BCED-00A0C90AB50F}\ProxyStubClsid32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDEADE9E-C265-11D0-BCED-00A0C90AB50F}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDEADE98-C265-11d0-BCED-00A0C90AB50F}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDEADE98-C265-11d0-BCED-00A0C90AB50F}\Version\ = "2.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDEADE9A-C265-11D0-BCED-00A0C90AB50F}\ProxyStubClsid32	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 2404	1632	regsvr32.exe	28
PID 1632 wrote to memory of 2404	1632	regsvr32.exe	28
PID 1632 wrote to memory of 2404	1632	regsvr32.exe	28
PID 1632 wrote to memory of 2404	1632	regsvr32.exe	28
PID 1632 wrote to memory of 2404	1632	regsvr32.exe	28
PID 1632 wrote to memory of 2404	1632	regsvr32.exe	28
PID 1632 wrote to memory of 2404	1632	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e0c8f4b80de9c184ce2bcda36cdef5c0_NeikiAnalytics.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\e0c8f4b80de9c184ce2bcda36cdef5c0_NeikiAnalytics.dll
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  PID:2404
- - C:\Users\Admin\AppData\Local\Temp\1017.tmp
    C:\Users\Admin\AppData\Local\Temp\1017.tmp
    3⤵
    PID:2632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\1017.tmp

Filesize
145KB

MD5
c610e7ccd6859872c585b2a85d7dc992

SHA1
362b3d4b72e3add687c209c79b500b7c6a246d46

SHA256
14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

SHA512
8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

Download Submit
memory/2404-0-0x00000000001E0000-0x0000000000219000-memory.dmp

Filesize
228KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads