b32648ba02456631796b22073f3a75384ccb7488dc4c2741baf00993d1693692

General

Target

77d4dfb228eebf33c57abdd613022af0_NeikiAnalytics.dll
Size

428KB
MD5

77d4dfb228eebf33c57abdd613022af0
SHA1

56506d132f139a348e19a102b159b1b1dc6f2d34
SHA256

b32648ba02456631796b22073f3a75384ccb7488dc4c2741baf00993d1693692
SHA512

ecd220461cd84a1392025af81ec2f55c831843fe0f236d60df37f5336696a10a8f4708ad3497712224e06e9c8c4107d2eb7e76309022dd0ed7db8c7208acedbe
SSDEEP

6144:rLYRAAm1IbaX8e5MFtx9D6KCGdTB2hMFkIlj0cTG6VtRFjEtFn9fLrs:rLKkIbmDQGKXdTcCZjFjEtFn9z

Score

1^/10

Malware Config

Signatures

Modifies registry class 45 IoCs

Processes:

regsvr32.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{44FF397C-0B47-11DA-8BDE-F66BAD1E3F3A}\Pins\Output\AllowedMany = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CakewalkPlugIns	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4D884C3C-0B47-11DA-8BDE-F66BAD1E3F3A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\77d4dfb228eebf33c57abdd613022af0_NeikiAnalytics.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Filter\{44FF397C-0B47-11DA-8BDE-F66BAD1E3F3A}	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{44FF397C-0B47-11DA-8BDE-F66BAD1E3F3A}\Pins\Input\IsRendered = "0"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{44FF397C-0B47-11DA-8BDE-F66BAD1E3F3A}\Pins\Input\AllowedMany = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{44FF397C-0B47-11DA-8BDE-F66BAD1E3F3A}\Pins\Input\Types\{73647561-0000-0010-8000-00AA00389B71}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CakewalkPlugIns\{44FF397C-0B47-11DA-8BDE-F66BAD1E3F3A}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CakewalkPlugIns\{44FF397C-0B47-11DA-8BDE-F66BAD1E3F3A}\HelpFilePath	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{44FF397C-0B47-11DA-8BDE-F66BAD1E3F3A}\ = "Wave Arts FinalPlug 5"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{44FF397C-0B47-11DA-8BDE-F66BAD1E3F3A}\CLSID = "{44FF397C-0B47-11DA-8BDE-F66BAD1E3F3A}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{44FF397C-0B47-11DA-8BDE-F66BAD1E3F3A}	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{44FF397C-0B47-11DA-8BDE-F66BAD1E3F3A}\Pins\Output\Direction = "1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{44FF397C-0B47-11DA-8BDE-F66BAD1E3F3A}\Pins\Output\ConnectsToPin = "Input"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4D884C3C-0B47-11DA-8BDE-F66BAD1E3F3A}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4D884C3C-0B47-11DA-8BDE-F66BAD1E3F3A}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{44FF397C-0B47-11DA-8BDE-F66BAD1E3F3A}\FriendlyName = "Wave Arts FinalPlug 5"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Filter	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{44FF397C-0B47-11DA-8BDE-F66BAD1E3F3A}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Filter\{44FF397C-0B47-11DA-8BDE-F66BAD1E3F3A}\ = "Wave Arts FinalPlug 5"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{44FF397C-0B47-11DA-8BDE-F66BAD1E3F3A}\Pins\Input\Direction = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{44FF397C-0B47-11DA-8BDE-F66BAD1E3F3A}\Pins\Output\Types\{73647561-0000-0010-8000-00AA00389B71}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{44FF397C-0B47-11DA-8BDE-F66BAD1E3F3A}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{44FF397C-0B47-11DA-8BDE-F66BAD1E3F3A}\Pins\Output\Types	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{44FF397C-0B47-11DA-8BDE-F66BAD1E3F3A}\Pins\Output\IsRendered = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4D884C3C-0B47-11DA-8BDE-F66BAD1E3F3A}\ = "Wave Arts FinalPlug 5"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{44FF397C-0B47-11DA-8BDE-F66BAD1E3F3A}\FilterData = 0200000000002000020000000000000030706933000000000000000001000000000000000000000030747933000000006000000070000000317069330800000000000000010000000000000000000000307479330000000060000000700000006175647300001000800000aa00389b7100000000000000000000000000000000	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{44FF397C-0B47-11DA-8BDE-F66BAD1E3F3A}\Pins	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{44FF397C-0B47-11DA-8BDE-F66BAD1E3F3A}\Pins\Input\AllowedZero = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{44FF397C-0B47-11DA-8BDE-F66BAD1E3F3A}\Pins\Output\AllowedZero = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{44FF397C-0B47-11DA-8BDE-F66BAD1E3F3A}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{44FF397C-0B47-11DA-8BDE-F66BAD1E3F3A}\Pins\Input\Types	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{44FF397C-0B47-11DA-8BDE-F66BAD1E3F3A}\Pins\Input\ConnectsToPin = "Output"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{44FF397C-0B47-11DA-8BDE-F66BAD1E3F3A}\Pins\Input\Types\{73647561-0000-0010-8000-00AA00389B71}\{00000000-0000-0000-0000-000000000000}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{44FF397C-0B47-11DA-8BDE-F66BAD1E3F3A}\Pins\Output	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{44FF397C-0B47-11DA-8BDE-F66BAD1E3F3A}\Pins\Output\Types\{73647561-0000-0010-8000-00AA00389B71}\{00000000-0000-0000-0000-000000000000}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CakewalkPlugIns\{44FF397C-0B47-11DA-8BDE-F66BAD1E3F3A}\Description = "Wave Arts FinalPlug 5"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{44FF397C-0B47-11DA-8BDE-F66BAD1E3F3A}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{44FF397C-0B47-11DA-8BDE-F66BAD1E3F3A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\77d4dfb228eebf33c57abdd613022af0_NeikiAnalytics.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4D884C3C-0B47-11DA-8BDE-F66BAD1E3F3A}	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{44FF397C-0B47-11DA-8BDE-F66BAD1E3F3A}\Merit = "2097152"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{44FF397C-0B47-11DA-8BDE-F66BAD1E3F3A}\Pins\Input	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CakewalkPlugIns\{44FF397C-0B47-11DA-8BDE-F66BAD1E3F3A}\HelpFileTopic	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2212 wrote to memory of 2984	2212	regsvr32.exe	regsvr32.exe
PID 2212 wrote to memory of 2984	2212	regsvr32.exe	regsvr32.exe
PID 2212 wrote to memory of 2984	2212	regsvr32.exe	regsvr32.exe
PID 2212 wrote to memory of 2984	2212	regsvr32.exe	regsvr32.exe
PID 2212 wrote to memory of 2984	2212	regsvr32.exe	regsvr32.exe
PID 2212 wrote to memory of 2984	2212	regsvr32.exe	regsvr32.exe
PID 2212 wrote to memory of 2984	2212	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\77d4dfb228eebf33c57abdd613022af0_NeikiAnalytics.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2212

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\77d4dfb228eebf33c57abdd613022af0_NeikiAnalytics.dll
2⤵
- Modifies registry class
PID:2984

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads