93377ae35e5bff6cff064a7a262a98b28cf8ff2e87aaf87e3db2dd418df2c30f

General

Target
57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe
Size 1.5MB
Sample240613-c685lavfrk
SHA256 93377ae35e5bff6cff064a7a262a98b28cf8ff2e87aaf87e3db2dd418df2c30f
MD5 57f68279ca6180f35866c1a81d66f450
SHA1 11fb5322e832d1323ec50af422b60fc88e6abf2f
SHA512 5a8b8dcc721b91c0d534b9394448f1d018294e122fe65a7bb096c87f5f1843fd4fc552befebc92ce71fee11fe990bb0fd6fe8ad1bdb4c5e55d02666cd8e59c73
SSDEEP 6144:yJuXtXxog5E+FWPNfrf6yGEssQxNpbM2eWdbjMMqcXmr8MMtjyhX9+FL:u8XNE+FuNfrSyGEssQJU03MMq/r8MMP
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

ransomware

Malware Config

Signatures

Enumerates connected drives 3 TTPs 10 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe
File opened (read-only)	\??\J:	57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe
File opened (read-only)	\??\N:	57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe
File opened (read-only)	\??\E:	57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe
File opened (read-only)	\??\I:	57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe
File opened (read-only)	\??\K:	57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe
File opened (read-only)	\??\L:	57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe
File opened (read-only)	\??\M:	57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe
File opened (read-only)	\??\O:	57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe
File opened (read-only)	\??\H:	57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Desktop\Wallpaper = "C:\\windows\\WallPapers.jpg"	57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7z.cab	57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7zFM.exe	57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\RCX3FBC.tmp	57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\RCX3F9C.tmp	57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\RCX3FBD.tmp	57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\RCX3F6A.tmp	57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\RCX3F9B.tmp	57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.cab	57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe
File created	C:\Program Files\readme.1xt	57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7z.cab	57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\RCX3F7B.tmp	57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab	57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab	57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX3FFD.tmp	57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX400D.tmp	57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7z.exe	57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7zFM.cab	57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\windows\readme.1xt	57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe
File created	C:\windows\WallPapers.jpg	57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4448	1832	WerFault.exe	81

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Desktop\General\WallpaperSource = "C:\\windows\\WallPapers.jpg"	57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Desktop\General	57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe"
1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
PID:1832
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 720
  2⤵
  - Program crash
  PID:4448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1832 -ip 1832
1⤵
PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

7z.cab

Path C:\Program Files\7-Zip\7z.cab
Size 544KB
SHA256 8cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525
MD5 9a1dd1d96481d61934dcc2d568971d06
SHA1 f136ef9bf8bd2fc753292fb5b7cf173a22675fb3
SHA512 7ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa
SSDEEP 6144:mE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHQQf+L+G:d7a3iwbihym2g7XO3LWUQfh4Co
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 219KB
SHA256 a6d79ba95ab72ac86edce041983113ca851bc0d8e9d2c70e42f9d877f09f179e
MD5 caceb914dc6aaf9fe746b1c0464bd21a
SHA1 d1121c44667bc286b91b3d547c0f8e5d21e8cab2
SHA512 d721b4fd7d7db7e14a7b39e55271da7a8fc9207ee6c1ae93290ce9ee0d1d5eeddfc06c4124c5428fdd697596001266083e8dfc005ea87871b71f4a4ed5351112
SSDEEP 3072:12RnucDy0eXDto6loV1Zmh5cvqUsFWdoyW4QpAjvf6G9/Go++smDQVXNpbu5UalI:gJuXtXxog5E+FWPNfrf6yGEssQxNpbM
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.cab

Path C:\Program Files\7-Zip\7zFM.cab
Size 930KB
SHA256 1ea0839c8dc95ad2c060af7d042c40c0daed58ce8e4524c0fba12fd73e4afb74
MD5 30ac0b832d75598fb3ec37b6f2a8c86a
SHA1 6f47dbfd6ff36df7ba581a4cef024da527dc3046
SHA512 505870601a4389b7ed2c8fecf85835adfd2944cbc10801f74bc4e08f5a0d6ecc9a52052fc37e216304cd1655129021862294a698ed36b3b43d428698f7263057
SSDEEP 12288:kRKcv8Nh7py6Rmi78gkPH3aPI9vyVg/0paQuj3IdD02fKBjtp/:JBpDRmi78gkPXlyo0G/jr
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 93377ae35e5bff6cff064a7a262a98b28cf8ff2e87aaf87e3db2dd418df2c30f
MD5 57f68279ca6180f35866c1a81d66f450
SHA1 11fb5322e832d1323ec50af422b60fc88e6abf2f
SHA512 5a8b8dcc721b91c0d534b9394448f1d018294e122fe65a7bb096c87f5f1843fd4fc552befebc92ce71fee11fe990bb0fd6fe8ad1bdb4c5e55d02666cd8e59c73
SSDEEP 6144:yJuXtXxog5E+FWPNfrf6yGEssQxNpbM2eWdbjMMqcXmr8MMtjyhX9+FL:u8XNE+FuNfrSyGEssQJU03MMq/r8MMP
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.cab

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab
Size 2.1MB
SHA256 7e0976036431640ae1d9f1c0b52bcea5dd37ef86cd3f5304dc8a96459d9483cd
MD5 b8d69fa2755c3ab1f12f8866a8e2a4f7
SHA1 8e3cdfb20e158c2906323ba0094a18c7dd2aaf2d
SHA512 5acac46068b331216978500f67a7fa5257bc5b05133fab6d88280b670ae4885ef2d5d1f531169b66bf1952e082f56b1ad2bc3901479b740f96c53ea405adda18
SSDEEP 24576:GCbRquA/m2z+L5WqJdrHCYRFiV+XenmE3Pnzc344:GCbRquA/m2yL5zbfFiV+XenmE3/z
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1832-0-0x0000000000400000-0x0000000000481000-memory.dmp

Download

memory/1832-67-0x0000000000400000-0x0000000000481000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads