Analysis
-
max time kernel
140s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
13-06-2024 02:42
Static task
static1
Behavioral task
behavioral1
Sample
57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe
-
Size
1.5MB
-
MD5
57f68279ca6180f35866c1a81d66f450
-
SHA1
11fb5322e832d1323ec50af422b60fc88e6abf2f
-
SHA256
93377ae35e5bff6cff064a7a262a98b28cf8ff2e87aaf87e3db2dd418df2c30f
-
SHA512
5a8b8dcc721b91c0d534b9394448f1d018294e122fe65a7bb096c87f5f1843fd4fc552befebc92ce71fee11fe990bb0fd6fe8ad1bdb4c5e55d02666cd8e59c73
-
SSDEEP
6144:yJuXtXxog5E+FWPNfrf6yGEssQxNpbM2eWdbjMMqcXmr8MMtjyhX9+FL:u8XNE+FuNfrSyGEssQJU03MMq/r8MMP
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exedescription ioc process File opened (read-only) \??\E: 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened (read-only) \??\G: 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened (read-only) \??\H: 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened (read-only) \??\I: 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened (read-only) \??\L: 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened (read-only) \??\N: 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened (read-only) \??\J: 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened (read-only) \??\K: 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened (read-only) \??\M: 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened (read-only) \??\O: 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe -
Drops file in Program Files directory 64 IoCs
Processes:
57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exedescription ioc process File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.cab 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.cab 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.cab 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.cab 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.cab 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\RCX1369.tmp 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\chrome.cab 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File created C:\Program Files\7-Zip\7zFM.cab 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX13AC.tmp 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX13C4.tmp 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.cab 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.cab 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\mip.cab 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.cab 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\DVDMaker.cab 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX13C3.tmp 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\RCX12B6.tmp 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\RCX1464.tmp 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.cab 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.cab 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX1433.tmp 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX13C1.tmp 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\RCX1368.tmp 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.cab 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX1432.tmp 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\RCX1308.tmp 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.cab 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.cab 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File created C:\Program Files\7-Zip\7z.cab 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\7z.exe 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.cab 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\RCX1463.tmp 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File created C:\Program Files\7-Zip\7z.exe 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\RCX1306.tmp 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\RCX1319.tmp 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX13C0.tmp 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File created C:\Program Files\readme.1xt 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX13AB.tmp 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\RCX1465.tmp 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.cab 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File created C:\Program Files\7-Zip\7zFM.exe 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX13BE.tmp 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\7z.cab 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\DVDMaker.exe 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX13AA.tmp 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mip.cab 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\DVD Maker\DVDMaker.cab 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX1399.tmp 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX13BF.tmp 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe -
Drops file in Windows directory 2 IoCs
Processes:
57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exedescription ioc process File created C:\windows\readme.1xt 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File created C:\windows\WallPapers.jpg 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1840 348 WerFault.exe 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe -
Processes:
57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Desktop\General 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Desktop\General\WallpaperSource = "C:\\windows\\WallPapers.jpg" 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exedescription pid process target process PID 348 wrote to memory of 1840 348 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe WerFault.exe PID 348 wrote to memory of 1840 348 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe WerFault.exe PID 348 wrote to memory of 1840 348 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe WerFault.exe PID 348 wrote to memory of 1840 348 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe"1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 9602⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\7-Zip\7z.cabFilesize
544KB
MD59a1dd1d96481d61934dcc2d568971d06
SHA1f136ef9bf8bd2fc753292fb5b7cf173a22675fb3
SHA2568cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525
SHA5127ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa
-
C:\Program Files\7-Zip\7z.exeFilesize
1.5MB
MD54f3f6b42637b538325b513d159957711
SHA1a26ae9fa13e61e338a6f03241907c618f2a928ab
SHA256a7f61b66248c0943891399397c57d9f0250597a84029e65750fb8775349325d9
SHA5129ab402a6767a7be8a30e1c69e7494ba66788fd83c802648017e98b57555db62e64e31465e99e0a58f35ef9fa664f3dd8e1c872da1eb23a86ddaba9d40ec142b2
-
C:\Program Files\7-Zip\7zFM.cabFilesize
930KB
MD530ac0b832d75598fb3ec37b6f2a8c86a
SHA16f47dbfd6ff36df7ba581a4cef024da527dc3046
SHA2561ea0839c8dc95ad2c060af7d042c40c0daed58ce8e4524c0fba12fd73e4afb74
SHA512505870601a4389b7ed2c8fecf85835adfd2944cbc10801f74bc4e08f5a0d6ecc9a52052fc37e216304cd1655129021862294a698ed36b3b43d428698f7263057
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.cabFilesize
118KB
MD5f45a7db6aec433fd579774dfdb3eaa89
SHA12f8773cc2b720143776a0909d19b98c4954b39cc
SHA2562bc2372cfabd26933bc4012046e66a5d2efc9554c0835d1a0aa012d3bd1a6f9a
SHA51203a4b7c53373ff6308a0292bb84981dc1566923e93669bbb11cb03d9f58a8d477a1a2399aac5059f477bbf1cf14b17817d208bc7c496b8675ece83cdabec5662
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\RCX1368.tmpFilesize
174KB
MD58d9797194e3826b5ab1050f637275859
SHA1e633cc82c5ae2f57aba7cf83738a592cff2a8fc9
SHA256ed8e457251c983d7acdcd3dcbdf750d21509aa056e62fee6525034e1721941dd
SHA512aaed0b4b27ecb5616d5967226c3d6e2b9aaaa432380747f8cc5c9b83659d1a72cc175fe0157359f3b622fba4e7b94bb4626726ed97150662d1f4ded0fbb1ab18
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.cabFilesize
1.6MB
MD5527e039ba9add8a7fac3a6bc30a6d476
SHA1729a329265eda72cada039c1941e7c672addfc19
SHA2564b8a72fc81b733ed2e6e70d4c5401f954002783dbf14927849ad579860780b94
SHA5129e73e14e33a5f07a87e9c1fecfdaee09d1408471052aacfde3d1e877dad4d253b525ebefca6bddabc23cf81d8dcce0785aedcc2f135d171ecbb1feaeb922c449
-
C:\Program Files\Google\Chrome\Application\chrome.cabFilesize
2.8MB
MD5095092f4e746810c5829038d48afd55a
SHA1246eb3d41194dddc826049bbafeb6fc522ec044a
SHA2562f606012843d144610dc7be55d1716d5d106cbc6acbce57561dc0e62c38b8588
SHA5127f36fc03bfed0f3cf6ac3406c819993bf995e4f8c26a7589e9032c14b5a9c7048f5567f77b3b15f946c5282fc0be6308a92eab7879332d74c400d0c139ce8400
-
C:\Program Files\Google\Chrome\Application\chrome.exeFilesize
399KB
MD5c8cf3430300e939b9882ceeb0c0c1687
SHA106bca3a4d584b92b4353314c8af3f83d780b78e6
SHA256e39b1889dce39872208297c52efc11631e94a17d2379f93b28f519981617e99d
SHA512afe28303c2233ecf4a310e764ed988c38a2e53308e4c83cd9bc717e99504958461543b910aea5ec816ac148de3177777d56b2a705e0cfa2689edad4d048e3538
-
C:\Program Files\Google\Chrome\Application\chrome_proxy.cabFilesize
1020KB
MD5b65d7344b0a7faa207d2e1a7adaafb60
SHA1755ad15b1745b0e730d658d4a92e2b754425b7db
SHA256f4b91fbbcba8a46eefe4965e4a24c6ede3decbd1fec96e141a1953173efd1c92
SHA512f17ac73c2df7c73a31b11ce0f533d6db91bdb0cdeea653dcd52ac72c3cf28da0c236b79586ddc7a6c825fdd171290722f888465e776f12ac2cae75be82726b22
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpgFilesize
135KB
MD50d472c9720e55e9c249207de6c69722c
SHA17244426a440a268cb37b49005812b8f20f052776
SHA256bc1d3cfb69f97bc930af3af7be8601e60eb1cc78516aa844e41c65e51c316de3
SHA512f77bf33604691e0f21f1f3548187153495aad5cd5beb80b409ff50c71502e5303ddb7d64b652edc5b4177bf88e8cee0df914f91b9532b9b1116af32050291cca
-
memory/348-0-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/348-221-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB