15b72f02545cc6787b82ef5c830080436d1b8af726fd5b88b75bf2e8f7bbfecb

Analysis

max time kernel
140s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-05-2024 08:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dbc9fbb503e4c12f63bf078668971a80_NeikiAnalytics.exe
Size

225KB
MD5

dbc9fbb503e4c12f63bf078668971a80
SHA1

62b1071fb4ad3508e9ebc72711bb1ee464ac2594
SHA256

15b72f02545cc6787b82ef5c830080436d1b8af726fd5b88b75bf2e8f7bbfecb
SHA512

a2c0199e47e21d2491bf5de963011c8ea6f7b0b4852baf6e4bf5e54533c19041af630034bf8d77011a5711b60adc1ddc34554ea991aa97223544eca046e234dd
SSDEEP

6144:9A2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:9ATuTAnKGwUAW3ycQqgf

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

3648 1708 WerFault.exe winver.exe
1420 3808 WerFault.exe dbc9fbb503e4c12f63bf078668971a80_NeikiAnalytics.exe

pid	pid_target	process	target process
3648	1708	WerFault.exe	winver.exe
1420	3808	WerFault.exe	dbc9fbb503e4c12f63bf078668971a80_NeikiAnalytics.exe

Modifies data under HKEY_USERS 1 IoCs

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client"	svchost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

Explorer.EXE

description	pid	process
Token: SeShutdownPrivilege	3532	Explorer.EXE
Token: SeCreatePagefilePrivilege	3532	Explorer.EXE
Token: SeShutdownPrivilege	3532	Explorer.EXE
Token: SeCreatePagefilePrivilege	3532	Explorer.EXE
Token: SeShutdownPrivilege	3532	Explorer.EXE
Token: SeCreatePagefilePrivilege	3532	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

winver.exedbc9fbb503e4c12f63bf078668971a80_NeikiAnalytics.exe

pid process

1708 winver.exe
3808 dbc9fbb503e4c12f63bf078668971a80_NeikiAnalytics.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

3532 Explorer.EXE

pid	process
1708	winver.exe
3808	dbc9fbb503e4c12f63bf078668971a80_NeikiAnalytics.exe

pid	process
3532	Explorer.EXE

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

dbc9fbb503e4c12f63bf078668971a80_NeikiAnalytics.exewinver.exe

description	pid	process	target process
PID 3808 wrote to memory of 1708	3808	dbc9fbb503e4c12f63bf078668971a80_NeikiAnalytics.exe	winver.exe
PID 3808 wrote to memory of 1708	3808	dbc9fbb503e4c12f63bf078668971a80_NeikiAnalytics.exe	winver.exe
PID 3808 wrote to memory of 1708	3808	dbc9fbb503e4c12f63bf078668971a80_NeikiAnalytics.exe	winver.exe
PID 3808 wrote to memory of 1708	3808	dbc9fbb503e4c12f63bf078668971a80_NeikiAnalytics.exe	winver.exe
PID 1708 wrote to memory of 3532	1708	winver.exe	Explorer.EXE
PID 3808 wrote to memory of 3532	3808	dbc9fbb503e4c12f63bf078668971a80_NeikiAnalytics.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3532

C:\Users\Admin\AppData\Local\Temp\dbc9fbb503e4c12f63bf078668971a80_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\dbc9fbb503e4c12f63bf078668971a80_NeikiAnalytics.exe"
2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3808

C:\Windows\SysWOW64\winver.exe
winver
3⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 300
4⤵
- Program crash
PID:3648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 760
3⤵
- Program crash
PID:1420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4184,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:8
1⤵
PID:2000

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
- Modifies data under HKEY_USERS
PID:2524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 1708 -ip 1708
1⤵
PID:3872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 3808 -ip 3808
1⤵
PID:4620

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3532-4-0x00000000006F0000-0x00000000006F6000-memory.dmp

Filesize
24KB

Download
memory/3532-5-0x00000000006F0000-0x00000000006F6000-memory.dmp

Filesize
24KB

Download
memory/3532-10-0x00000000008C0000-0x00000000008C6000-memory.dmp

Filesize
24KB

Download
memory/3808-1-0x0000000004520000-0x0000000004B78000-memory.dmp

Filesize
6.3MB

Download
memory/3808-2-0x0000000003D50000-0x0000000003D51000-memory.dmp

Filesize
4KB

Download
memory/3808-6-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3808-13-0x0000000004520000-0x0000000004B78000-memory.dmp

Filesize
6.3MB

Download