fae3e2bc39240e2b8f244b4a79be9fffaa0a55331cbd4171e0886280760dd270

General

Target

7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe
Size

1.5MB
MD5

7e6e2a883ecdaf212f05d0b6564c9460
SHA1

3b722c5588234f8eac02f133d572b6157da656c9
SHA256

fae3e2bc39240e2b8f244b4a79be9fffaa0a55331cbd4171e0886280760dd270
SHA512

506c669018f29b98a63e42cfe5e930d1600f617a14d99fd04a72344f93e16a98c8800f21189f55817fa0fae57edf9376cdbef18b1fd2719bdc7593bf782b4b09
SSDEEP

6144:+afcEHI/prnm4y3NjTjuC8xOcxphSe+dbjMMqcXmr8MMtjyhX9+FL:rHIhnmn9jT8rs3MMq/r8MMP

Score

6^/10

ransomware

Malware Config

Signatures

Enumerates connected drives 3 TTPs 10 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe

description	ioc	process
File opened (read-only)	\??\E:	7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe
File opened (read-only)	\??\H:	7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe
File opened (read-only)	\??\L:	7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe
File opened (read-only)	\??\M:	7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe
File opened (read-only)	\??\N:	7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe
File opened (read-only)	\??\O:	7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe
File opened (read-only)	\??\G:	7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe
File opened (read-only)	\??\I:	7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe
File opened (read-only)	\??\J:	7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe
File opened (read-only)	\??\K:	7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Desktop\Wallpaper = "C:\\windows\\WallPapers.jpg"	7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe

Drops file in Program Files directory 21 IoCs

Processes:

7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\readme.1xt	7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7zFM.cab	7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7zFM.exe	7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX7380.tmp	7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX7391.tmp	7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\RCX7290.tmp	7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\RCX7291.tmp	7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab	7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab	7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7z.cab	7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.cab	7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\RCX731F.tmp	7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\7z.cab	7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7z.exe	7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\RCX7320.tmp	7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\RCX7321.tmp	7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\RCX7322.tmp	7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe

Drops file in Windows directory 2 IoCs

Processes:

7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe

description	ioc	process
File created	C:\windows\readme.1xt	7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe
File created	C:\windows\WallPapers.jpg	7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3684 2996 WerFault.exe 7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe

pid	pid_target	process	target process
3684	2996	WerFault.exe	7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Desktop\General	7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Desktop\General\WallpaperSource = "C:\\windows\\WallPapers.jpg"	7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7e6e2a883ecdaf212f05d0b6564c9460_NeikiAnalytics.exe"
1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
PID:2996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 756
2⤵
- Program crash
PID:3684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 2996 -ip 2996
1⤵
PID:3644

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

1

T1491

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7z.cab
Filesize
544KB

MD5
9a1dd1d96481d61934dcc2d568971d06

SHA1
f136ef9bf8bd2fc753292fb5b7cf173a22675fb3

SHA256
8cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525

SHA512
7ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa

Download Submit
C:\Program Files\7-Zip\7z.exe
Filesize
1.5MB

MD5
cf87ac547ba109463084f58355333fc9

SHA1
bf2f0095e41c8ccea0659b9011b405109973ca90

SHA256
6cdd78f505d4ec4c35255c89c1087891a4d8d8983aca621e8eb9db51f332e8d5

SHA512
7067178405fafc49826770f5516c6d5c1da1443ea422aec392886e88472cbf9ad163efe8610a102b37227a17deb44f4b2be8a6c03e48998fef708006ea78061c

Download Submit
C:\Program Files\7-Zip\7zFM.cab
Filesize
930KB

MD5
30ac0b832d75598fb3ec37b6f2a8c86a

SHA1
6f47dbfd6ff36df7ba581a4cef024da527dc3046

SHA256
1ea0839c8dc95ad2c060af7d042c40c0daed58ce8e4524c0fba12fd73e4afb74

SHA512
505870601a4389b7ed2c8fecf85835adfd2944cbc10801f74bc4e08f5a0d6ecc9a52052fc37e216304cd1655129021862294a698ed36b3b43d428698f7263057

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX7380.tmp
Filesize
168KB

MD5
d31d478c87649a0046cc621224c46452

SHA1
da7e366a1b7845297626b51c634b41c94b6aa625

SHA256
ab8be413ba59162d4e071a9bee080aacdf344975c463e8d257430481be6a22a3

SHA512
ddd7e87d69c1fed4ae1ca10128f638d22895184048dec52a346f588e07992ebf2f07945745bda0db886f4c52868b3dde7c394a3a984a6caeffc96d94307a7d1a

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab
Filesize
2.1MB

MD5
b8d69fa2755c3ab1f12f8866a8e2a4f7

SHA1
8e3cdfb20e158c2906323ba0094a18c7dd2aaf2d

SHA256
7e0976036431640ae1d9f1c0b52bcea5dd37ef86cd3f5304dc8a96459d9483cd

SHA512
5acac46068b331216978500f67a7fa5257bc5b05133fab6d88280b670ae4885ef2d5d1f531169b66bf1952e082f56b1ad2bc3901479b740f96c53ea405adda18

Download Submit
memory/2996-1-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/2996-68-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads