1eaa4cd7a442e8473c47a67120920af751c1cbbe7e63543c1f5d206c5bbacbfa

Analysis

max time kernel
133s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 02:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe
Size

4.1MB
MD5

503efa0bf90c646caf5dc14ac3583b30
SHA1

0d82ae4b15978167e4ce606cd4ee7b132caaa3fb
SHA256

1eaa4cd7a442e8473c47a67120920af751c1cbbe7e63543c1f5d206c5bbacbfa
SHA512

2c9288aa459a62388014097919d88e7a7691d9044aa509a1978db24a3a4c8e5b765124ad193d0ce8eac48d8a1e98b29ea27cc0fdc893500d572d8c86b8b3f89d
SSDEEP

98304:sqqTewvfzKDYxb2GA5Ir4Uu8j13PDmZ3uakQrBDhB:STlKIbBCe39mZ3uMrBDr

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe

description ioc process

File opened for modification \??\PhysicalDrive0 503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe

Modifies registry class 11 IoCs

Processes:

503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories	503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idex = "74668bfe05caf4962068c60e4133dcec"	503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idno = "1"	503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278}\Implemented Categories\{607568DD-B059-434b-B7E7-38EC51998F8E}	503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278}	503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}	503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278}\Implemented Categories	503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278}\Implemented Categories\{607568DD-B059-434b-B7E7-38EC51998F8E}\did = "471A3D0ADF8C62F55952159714192FA2"	503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}	503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe

pid	process
2936	503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe
2936	503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe
2936	503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe
2936	503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe
2936	503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe

Suspicious use of SendNotifyMessage 5 IoCs

Processes:

503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe

pid	process
2936	503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe
2936	503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe
2936	503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe
2936	503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe
2936	503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\503efa0bf90c646caf5dc14ac3583b30_NeikiAnalytics.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2936

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads