Overview

overview

8

Static

static

7

2e6ebe92ab...cs.exe

windows7-x64

8

2e6ebe92ab...cs.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/06/2024, 09:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2e6ebe92ab8f6419d7f19390f0239a10_NeikiAnalytics.exe

  • Size

    447KB

  • MD5

    2e6ebe92ab8f6419d7f19390f0239a10

  • SHA1

    ed5ce71ae8ae88a1557b20397db02a5682e70dd8

  • SHA256

    474e11fcc707d3afabf2fa75bd0a57a7e2f08d29a3c3b83bcc8d3c0d8054fc50

  • SHA512

    6df14a6564e686a87b95beac34f9d50598bc925a39e1590eb752771694f5fd13680dbfde7e32ca7235aae48b7514afc1f400c5b18ad388dbc177ec05f4e2c227

  • SSDEEP

    6144:DP+PtrmEs7eVyYr9AmEcmI5qpYDb1MV+w1ILKcVzjol2:DP+Pt9sKVyY3EcmIopMbv1Ochb

Score
8/10
upx

Malware Config

Signatures

  • Drops file in Drivers directory 39 IoCs
  • Manipulates Digital Signatures 2 IoCs

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 3 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops desktop.ini file(s) 57 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 26 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 49 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2e6ebe92ab8f6419d7f19390f0239a10_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\2e6ebe92ab8f6419d7f19390f0239a10_NeikiAnalytics.exe"
    1⤵
    • Drops file in Drivers directory
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1160
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Windows\AE 0124 BE.msi"
      2⤵
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:3428
    • C:\Windows\SysWOW64\drivers\winlogon.exe
      "C:\Windows\System32\drivers\winlogon.exe"
      2⤵
      • Drops file in Drivers directory
      • Checks computer location settings
      • Executes dropped EXE
      • Drops autorun.inf file
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2940
      • C:\Windows\AE 0124 BE.exe
        "C:\Windows\AE 0124 BE.exe"
        3⤵
        • Drops file in Drivers directory
        • Manipulates Digital Signatures
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops desktop.ini file(s)
        • Drops autorun.inf file
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2836
        • C:\Windows\SysWOW64\drivers\winlogon.exe
          "C:\Windows\System32\drivers\winlogon.exe"
          4⤵
          • Drops file in Drivers directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:4648
      • C:\Windows\SysWOW64\drivers\winlogon.exe
        "C:\Windows\System32\drivers\winlogon.exe"
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:2252
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4332
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2932
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:2480

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\AE 0124 BE.msi
    Filesize

    447KB

    MD5

    aa4aea3c61f2c866ad638afa740d96aa

    SHA1

    9eeb30aa24a99ec7fbd90daf8a2b122f2af31982

    SHA256

    9da94c4b791b5d73c1822801afaec76b1d150fa7ffe97dcb3465d42985b0351c

    SHA512

    ac672de62379ea9b33263a6fa39d72faf07c38c497a27e35d48339155685ef8d8a3eedd4bfe583ff08a49cc94fa56bf9c6861bf170f8d875c1abcda75446a4a1

    Download Submit

  • C:\Windows\Msvbvm60.dll
    Filesize

    1.4MB

    MD5

    25f62c02619174b35851b0e0455b3d94

    SHA1

    4e8ee85157f1769f6e3f61c0acbe59072209da71

    SHA256

    898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

    SHA512

    f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

    Download Submit

  • C:\Windows\SysWOW64\drivers\winlogon.exe
    Filesize

    94KB

    MD5

    c9bbc3081799a8fecfa8360c8d0ba1a9

    SHA1

    956f852d525de269c36d356a73b43a42f839aba7

    SHA256

    1f13f61b6ab1621c02ba45ff6c5a0feb655a90226b05b0e2b5511d3a175a432f

    SHA512

    e62ba334df0c9921b7e9e8c79d1791a4e9c8f8181013bf46514b4b507d3092015d5626a4e1a9d1c62454deabcca6aad2a54cb311fe48c89bf73c93f29489a522

    Download Submit

  • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
    Filesize

    23.7MB

    MD5

    2553d0c498a39ae73fff49d9a04f1d66

    SHA1

    a93bccc098478dc116ca5dce1a5ea662ea644399

    SHA256

    b959db35c2e9d46f6ca712c04865cc590c4374f952ad1bf9112471e335b38c05

    SHA512

    e60d991fe62706ed7a2980979d65478127fe81f206e68c54b23aae42b3180c3bd39a0be92b302576285304821317285df2c786ea928dbd6a44f8b37cba534c17

    Download Submit

  • \??\Volume{8a2a71c9-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{314b22ae-b086-44f1-b038-372afba1aa3c}_OnDiskSnapshotProp
    Filesize

    6KB

    MD5

    2152bf1f3df52da4482c9f5cd5ee6d3b

    SHA1

    b50af16664b6faabc262d72161ccfbf496098c89

    SHA256

    d300d100f52edebc0828d25e530fa8534aaad1313c0eb9b625295b54766a8bc8

    SHA512

    eeec5e4f5c1e81ef1edec85052c06b186e3bc196abedc709b16a75df5bed3e1b77cb732d0b66b61c86f0d1b38d9d224466700a7271a525c4f71804dfe50f08d8

    Download Submit

  • \??\c:\B1uv3nth3x1.diz
    Filesize

    21B

    MD5

    9cceaa243c5d161e1ce41c7dad1903dd

    SHA1

    e3da72675df53fffa781d4377d1d62116eafb35b

    SHA256

    814649b436ea43dd2abb99693e06019d4079ee74d02a0395913add0ba92d0189

    SHA512

    af9b75dc9a0b39d12d48bf6d40eb7d778eb9dd976302792271d8d4245a916027cf4e705d6cd7a5e6582ba94953346f291122f27d377b2c1a86e45f49e92efb5b

    Download Submit

  • memory/1160-59-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/1160-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2252-81-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2836-448-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2836-467-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2940-447-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/4648-88-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download