Analysis

  • max time kernel
    147s
  • max time network
    100s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-05-2024 20:42

General

  • Target

    34b8d1f97fc49f1e045ddd0bce268880_NeikiAnalytics.exe

  • Size

    237KB

  • MD5

    34b8d1f97fc49f1e045ddd0bce268880

  • SHA1

    aa83b2e1d3fbcf95ff5a4ee1fd0a7f8dd3a3cce9

  • SHA256

    7700dda53886217863d72dd813e2a9c9b890b0e3dde2ad755d102fb4d1290259

  • SHA512

    846f7cc28ba8b3122c55ea40bbf10681408c79911e3a952ffd44fd3608fa5e018306f96fa17831ca361c6947e3a6d88eb3a30c1387043df083868145ae7e9b13

  • SSDEEP

    6144:6A2P27yTAnKGw0hjFhSR/W1nyAJ9v0pMtRCpYQ:6ATuTAnKGwUAWVycQqgj

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Modifies data under HKEY_USERS 1 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
    1⤵
      PID:2804
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of UnmapMainImage
      PID:3404
      • C:\Users\Admin\AppData\Local\Temp\34b8d1f97fc49f1e045ddd0bce268880_NeikiAnalytics.exe
        "C:\Users\Admin\AppData\Local\Temp\34b8d1f97fc49f1e045ddd0bce268880_NeikiAnalytics.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1304
        • C:\Windows\SysWOW64\winver.exe
          winver
          3⤵
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4588
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 300
            4⤵
            • Program crash
            PID:932
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 856
          3⤵
          • Program crash
          PID:4388
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
      1⤵
      • Modifies data under HKEY_USERS
      PID:3020
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4588 -ip 4588
      1⤵
        PID:460
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1304 -ip 1304
        1⤵
          PID:1284

        Network

        MITRE ATT&CK Matrix ATT&CK v13

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1304-1-0x0000000004730000-0x0000000004D88000-memory.dmp
          Filesize

          6.3MB

        • memory/1304-2-0x0000000003D40000-0x0000000003D41000-memory.dmp
          Filesize

          4KB

        • memory/1304-6-0x0000000000400000-0x000000000043F000-memory.dmp
          Filesize

          252KB

        • memory/1304-9-0x0000000005840000-0x0000000006240000-memory.dmp
          Filesize

          10.0MB

        • memory/1304-15-0x0000000005840000-0x0000000006240000-memory.dmp
          Filesize

          10.0MB

        • memory/1304-18-0x0000000004730000-0x0000000004D88000-memory.dmp
          Filesize

          6.3MB

        • memory/2804-13-0x00000000004B0000-0x00000000004B6000-memory.dmp
          Filesize

          24KB

        • memory/2804-19-0x00000000004B0000-0x00000000004B6000-memory.dmp
          Filesize

          24KB

        • memory/3404-4-0x0000000001140000-0x0000000001146000-memory.dmp
          Filesize

          24KB

        • memory/3404-5-0x0000000001140000-0x0000000001146000-memory.dmp
          Filesize

          24KB

        • memory/3404-10-0x0000000001150000-0x0000000001156000-memory.dmp
          Filesize

          24KB