Analysis

  • max time kernel
    140s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    19/05/2024, 20:23

General

  • Target

    306b3930a69d6db8276fc9fb9c4da000_NeikiAnalytics.exe

  • Size

    480KB

  • MD5

    306b3930a69d6db8276fc9fb9c4da000

  • SHA1

    2f62f09e8bca383537736fa777fc6442a00e293e

  • SHA256

    ea15c0d4a7d2c2dd02c61b8511a04465a8f88ec65c7f01f491a94b9c144bc5d2

  • SHA512

    7283a61e1b103915dd2e35cad265464bd7c5eb83291f13be88b3b44980989c4a1fe71bc1d2db9a3f523ed28129086a2dbd89a89794e8374d55b1d51931a19d41

  • SSDEEP

    6144:pjFRiOcXH6XWD0w1tizmtnktLJ6znvxNcCI+1jDIlnJ9+1aTEPTnOK4JKElDnT:nRDc3yWDNU+YUznzNjElWaT07NQtDT

Score
10/10

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 2 IoCs
  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 13 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\306b3930a69d6db8276fc9fb9c4da000_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\306b3930a69d6db8276fc9fb9c4da000_NeikiAnalytics.exe"
    1⤵
    • Modifies firewall policy service
    • Adds policy Run key to start application
    • Sets service image path in registry
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    PID:1676

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\msrpc.exe

    Filesize

    480KB

    MD5

    28efd25bffe3f3e6866c5ebc9435d6c8

    SHA1

    f4615ab7861a334ea701c4142883ebd3e398254a

    SHA256

    234d39243a8f9501decb004da9988cf3de819a85c34c9f34e34824ed7e01c652

    SHA512

    da5a34e7955655d80bfedab40a08dc7c2974f75ecf5dd57ae83163c945cb040626fb173365ce4c200111f4b7a34f390f82f41cb209176ded6dc1344838893ba0

  • memory/1676-0-0x00000000001B0000-0x00000000001B1000-memory.dmp

    Filesize

    4KB

  • memory/1676-1-0x0000000000400000-0x000000000047C000-memory.dmp

    Filesize

    496KB

  • memory/1676-3-0x00000000001B0000-0x00000000001B1000-memory.dmp

    Filesize

    4KB

  • memory/1676-19-0x0000000000400000-0x000000000047C000-memory.dmp

    Filesize

    496KB

  • memory/1676-20-0x0000000000400000-0x000000000047C000-memory.dmp

    Filesize

    496KB

  • memory/1676-21-0x0000000000400000-0x000000000047C000-memory.dmp

    Filesize

    496KB

  • memory/1676-23-0x0000000000400000-0x000000000047C000-memory.dmp

    Filesize

    496KB