8d650730a5baf79f6a21260aa3594291a28d7de22e1846dc5af8c8e863527553

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 21:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

469dcd1d37a54d396dfe18d77a0196c0_NeikiAnalytics.exe
Size

436KB
MD5

469dcd1d37a54d396dfe18d77a0196c0
SHA1

a5a971a7e044178a77cc401475dcf040757189e7
SHA256

8d650730a5baf79f6a21260aa3594291a28d7de22e1846dc5af8c8e863527553
SHA512

6eb61e0d0f6ba0db880198ecca14ad4caeb838a8cc287355a91c7775a5f55734232f553f59371719265aceeb57d7b3aa6f310ae060e1304a3bd968e1e19e6eb3
SSDEEP

12288:qHrU1riIXzwz5/sviVHJRz/R3w02d7PA:0rU1riIXzQ5/BVrR12db

Score

5^/10

ransomware

Malware Config

Signatures

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

469dcd1d37a54d396dfe18d77a0196c0_NeikiAnalytics.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\bg.jpg"	469dcd1d37a54d396dfe18d77a0196c0_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 4 IoCs

evasion

Processes:

469dcd1d37a54d396dfe18d77a0196c0_NeikiAnalytics.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\Desktop\TileWallpaper = "0"	469dcd1d37a54d396dfe18d77a0196c0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\Desktop\WallpaperStyle = "2"	469dcd1d37a54d396dfe18d77a0196c0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\Desktop\Pattern	469dcd1d37a54d396dfe18d77a0196c0_NeikiAnalytics.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\Desktop	469dcd1d37a54d396dfe18d77a0196c0_NeikiAnalytics.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

469dcd1d37a54d396dfe18d77a0196c0_NeikiAnalytics.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Software\Microsoft\Internet Explorer\Desktop\General	469dcd1d37a54d396dfe18d77a0196c0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Internet Explorer\Desktop\General\WallpaperSource = "C:\\Users\\Admin\\AppData\\Local\\bg.jpg"	469dcd1d37a54d396dfe18d77a0196c0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\469dcd1d37a54d396dfe18d77a0196c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\469dcd1d37a54d396dfe18d77a0196c0_NeikiAnalytics.exe"
1⤵
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies Internet Explorer settings
PID:2104

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

T1491

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2104-1-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download