1c9a8a7e8889631a58f25e0941852067f1cb0cb0f997e98cdd66a9bf5f560546

Analysis

max time kernel
140s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
17-05-2024 04:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a652c4c01ee6c67f06335d8d53ecee40_NeikiAnalytics.exe
Size

986KB
MD5

a652c4c01ee6c67f06335d8d53ecee40
SHA1

b5ce90d9debf34a08db4d170136997301ad3b817
SHA256

1c9a8a7e8889631a58f25e0941852067f1cb0cb0f997e98cdd66a9bf5f560546
SHA512

372c24b55fbf461818c9ce10443a2811e00b367e3e80b039a862b0a3f9a303121498faa42ad975990378cf26fe2bac0420355dcfc0a7b7d6855d1db47c70b18e
SSDEEP

3072:MGjhaq5iL0beJQZt32wLji5DlsODxRPNDkjJHzW9hUd56JsuBSjwA2i1vP2i1a1X:Hha8iAx+1zwjJHd6vB/ANMQAnHtQT

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GGAAAG_LOADER = "C:\\Windows\\system32\\GAAG.exe"	a652c4c01ee6c67f06335d8d53ecee40_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FifefoxUpdater = "C:\\Windows\\system32\\FifefoxUpdater.scr"	a652c4c01ee6c67f06335d8d53ecee40_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinSevenUpdater = "C:\\Windows\\system32\\AVSCANNER.EXE"	a652c4c01ee6c67f06335d8d53ecee40_NeikiAnalytics.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\AVSCANNER.EXE	a652c4c01ee6c67f06335d8d53ecee40_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\GAAG.exe	a652c4c01ee6c67f06335d8d53ecee40_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\GAAG.exe	a652c4c01ee6c67f06335d8d53ecee40_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\FifefoxUpdater.scr	a652c4c01ee6c67f06335d8d53ecee40_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\FifefoxUpdater.scr	a652c4c01ee6c67f06335d8d53ecee40_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\AVSCANNER.EXE	a652c4c01ee6c67f06335d8d53ecee40_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\a652c4c01ee6c67f06335d8d53ecee40_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a652c4c01ee6c67f06335d8d53ecee40_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3716 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:3152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\AVSCANNER.EXE

Filesize
986KB

MD5
8125a32ab0ec45bbc79522a7fa9e0600

SHA1
31db35f3bb1c633bc6cb178bfb68aff2f207c72a

SHA256
378e8121b55e7e64a78590dcc224588503f350784b3db7ede2c24e63277d58ef

SHA512
dee69cf8dc0ab95754e8040c9f5722acb43e6e9ff29f233a2ef8c5e279736711908b0bafb4bc6838d17770c7165eefc98c299ff793719031199e3d87307f5972

Download Submit
memory/412-0-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/412-7-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads