Analysis
-
max time kernel
92s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
13-06-2024 02:42
Static task
static1
Behavioral task
behavioral1
Sample
57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe
-
Size
1.5MB
-
MD5
57f68279ca6180f35866c1a81d66f450
-
SHA1
11fb5322e832d1323ec50af422b60fc88e6abf2f
-
SHA256
93377ae35e5bff6cff064a7a262a98b28cf8ff2e87aaf87e3db2dd418df2c30f
-
SHA512
5a8b8dcc721b91c0d534b9394448f1d018294e122fe65a7bb096c87f5f1843fd4fc552befebc92ce71fee11fe990bb0fd6fe8ad1bdb4c5e55d02666cd8e59c73
-
SSDEEP
6144:yJuXtXxog5E+FWPNfrf6yGEssQxNpbM2eWdbjMMqcXmr8MMtjyhX9+FL:u8XNE+FuNfrSyGEssQJU03MMq/r8MMP
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exedescription ioc process File opened (read-only) \??\G: 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened (read-only) \??\J: 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened (read-only) \??\N: 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened (read-only) \??\E: 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened (read-only) \??\I: 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened (read-only) \??\K: 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened (read-only) \??\L: 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened (read-only) \??\M: 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened (read-only) \??\O: 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened (read-only) \??\H: 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\Desktop\Wallpaper = "C:\\windows\\WallPapers.jpg" 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe -
Drops file in Program Files directory 21 IoCs
Processes:
57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exedescription ioc process File opened for modification C:\Program Files\7-Zip\7z.cab 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File created C:\Program Files\7-Zip\7zFM.exe 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\RCX3FBC.tmp 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\RCX3F9C.tmp 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\RCX3FBD.tmp 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\RCX3F6A.tmp 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\7z.exe 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\RCX3F9B.tmp 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\7zFM.cab 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File created C:\Program Files\readme.1xt 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File created C:\Program Files\7-Zip\7z.cab 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\RCX3F7B.tmp 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX3FFD.tmp 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX400D.tmp 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File created C:\Program Files\7-Zip\7z.exe 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File created C:\Program Files\7-Zip\7zFM.cab 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe -
Drops file in Windows directory 2 IoCs
Processes:
57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exedescription ioc process File created C:\windows\readme.1xt 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe File created C:\windows\WallPapers.jpg 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4448 1832 WerFault.exe 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe -
Processes:
57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Internet Explorer\Desktop\General\WallpaperSource = "C:\\windows\\WallPapers.jpg" 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Internet Explorer\Desktop\General 57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\57f68279ca6180f35866c1a81d66f450_NeikiAnalytics.exe"1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 7202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1832 -ip 18321⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\7-Zip\7z.cabFilesize
544KB
MD59a1dd1d96481d61934dcc2d568971d06
SHA1f136ef9bf8bd2fc753292fb5b7cf173a22675fb3
SHA2568cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525
SHA5127ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa
-
C:\Program Files\7-Zip\7z.exeFilesize
219KB
MD5caceb914dc6aaf9fe746b1c0464bd21a
SHA1d1121c44667bc286b91b3d547c0f8e5d21e8cab2
SHA256a6d79ba95ab72ac86edce041983113ca851bc0d8e9d2c70e42f9d877f09f179e
SHA512d721b4fd7d7db7e14a7b39e55271da7a8fc9207ee6c1ae93290ce9ee0d1d5eeddfc06c4124c5428fdd697596001266083e8dfc005ea87871b71f4a4ed5351112
-
C:\Program Files\7-Zip\7zFM.cabFilesize
930KB
MD530ac0b832d75598fb3ec37b6f2a8c86a
SHA16f47dbfd6ff36df7ba581a4cef024da527dc3046
SHA2561ea0839c8dc95ad2c060af7d042c40c0daed58ce8e4524c0fba12fd73e4afb74
SHA512505870601a4389b7ed2c8fecf85835adfd2944cbc10801f74bc4e08f5a0d6ecc9a52052fc37e216304cd1655129021862294a698ed36b3b43d428698f7263057
-
C:\Program Files\7-Zip\7zFM.exeFilesize
1.5MB
MD557f68279ca6180f35866c1a81d66f450
SHA111fb5322e832d1323ec50af422b60fc88e6abf2f
SHA25693377ae35e5bff6cff064a7a262a98b28cf8ff2e87aaf87e3db2dd418df2c30f
SHA5125a8b8dcc721b91c0d534b9394448f1d018294e122fe65a7bb096c87f5f1843fd4fc552befebc92ce71fee11fe990bb0fd6fe8ad1bdb4c5e55d02666cd8e59c73
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cabFilesize
2.1MB
MD5b8d69fa2755c3ab1f12f8866a8e2a4f7
SHA18e3cdfb20e158c2906323ba0094a18c7dd2aaf2d
SHA2567e0976036431640ae1d9f1c0b52bcea5dd37ef86cd3f5304dc8a96459d9483cd
SHA5125acac46068b331216978500f67a7fa5257bc5b05133fab6d88280b670ae4885ef2d5d1f531169b66bf1952e082f56b1ad2bc3901479b740f96c53ea405adda18
-
memory/1832-0-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/1832-67-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB