Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
-
submitted
17-06-2024 10:17
General
-
Target
7a4d85a1bef0ca4cecfe376e0ee91090_NeikiAnalytics.exe
-
Size
388KB
-
MD5
7a4d85a1bef0ca4cecfe376e0ee91090
-
SHA1
0eaab4a4cf009d2d0d2d525bad4742356ca06317
-
SHA256
0cfff9ddd855236e2c89d1778e88bd87db965a29d0e4e6b75178add06fd4fdb0
-
SHA512
963509e2871858ba356a6b1e2af71b05c22019ffe4172a3ed8d70d54597bf10a67607d8083fef90e549521cf194d76af1112f7628b23943d0da0ebde0704e280
-
SSDEEP
6144:VPHkQ4ydZZb+Q7Qf4+4/X+8PvjAsYcHte9qYJkIb/VNIFNgQfo/Xse6+pA+Z0S:BrZZbJu4+Q+8RBe9qYacVNyN/l+pn5
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+cedmc.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/47E1DDA5B81473DC
http://tes543berda73i48fsdfsd.keratadze.at/47E1DDA5B81473DC
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/47E1DDA5B81473DC
http://xlowfznrg4wf7dli.ONION/47E1DDA5B81473DC
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (423) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Drops startup file 3 IoCs
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 34 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 54 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a4d85a1bef0ca4cecfe376e0ee91090_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7a4d85a1bef0ca4cecfe376e0ee91090_NeikiAnalytics.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7a4d85a1bef0ca4cecfe376e0ee91090_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7a4d85a1bef0ca4cecfe376e0ee91090_NeikiAnalytics.exe"2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\tcyogklqnrhx.exeC:\Windows\tcyogklqnrhx.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\tcyogklqnrhx.exeC:\Windows\tcyogklqnrhx.exe4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT5⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2456 CREDAT:275457 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Windows\TCYOGK~1.EXE5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\7A4D85~1.EXE3⤵
- Deletes itself
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5f6df4701e1b9bc30720540a1798d2ab0
SHA1cff77997a8e36a0d292d151b330a88cbd2774e95
SHA2567493300bee0032972fe7924d3bc6d64825395138d06f990e8f52670d16747f05
SHA512c1141efc68fe57fa4dc6ebacc56b83cbb0123db5c6b07667c514f5fd70b09ed76f66cbb24ac6c9d4bfdf27c99dffc3b55790d3a000cab5f9bf76c8e802c81c90
-
Filesize
63KB
MD57949db287dae97f3b52944e837a90688
SHA1cbb3001c175219ad95761a2b0ac126a4478b5ae4
SHA256b1c37ed84fe19d90a25e9dccc33d710fcb66a162b473943c22f6789b9779b639
SHA512b9518a38f7a26b8c6f75465b8c726006041a3b7ca6ccbcc7315d33455d9ee97f578bf2ec0e0b47cec54726ab4b774bb45c0e5c568658322e516803d06fdfa827
-
Filesize
1KB
MD51d1017663b59c59185034895e444df65
SHA18bcd61baecbcf8e6e9745f1b1bb337ef3a1fdf53
SHA2564d34ca2277fa2e45ec75232c105a5138ce449a3581e3c3fa45900447c7bdbd99
SHA512e90c842677d7ce6a91ca7ebafd1a306fd9ea6e66c17971b0a5f174a113eed2a11ad719cf4fe1b4f8aab1f77ab6d2a1c1833d601f513d5591b9136110b98a3efe
-
Filesize
11KB
MD5291476b4140fea72c58e2fd59f005bd9
SHA1191add9ab78c7f4cb25ac2e53bba8255e4aa47a4
SHA2568db47d8c4010126d0c023d265c5854a494b6fcc7096fffd12d65622089b99766
SHA5124a74f5c78c776d63e46c10284319f405199d071df06fd7360dfc08f68b14615785a5a0ecc4c3f1f5d46d9430f9ce1cd0ab5a97dc2ccaccd675579c74f26fac0c
-
Filesize
109KB
MD5da306e9806f74cecf5af1dd2a78477d9
SHA18d3c5fe616925a17bc14fa73165ebcdfb34c87ab
SHA256f753b9d31aaf1ec40bc7c5222b5127f88e5c9f5a08d18822dc51b0a96643f24d
SHA512669c9e05c0282171199e0b71cc0f9211fd0ee848eb03187e984a977f75c1728428dbf7051e56a918228de32f8157e168ff07981fb3f794537a5a7d58f47e34e3
-
Filesize
173KB
MD527d9e4e5f89a90ea0cf45170013bc33f
SHA1c735c3b89435bfc1355834c87e09c861088dc153
SHA256d70a3edf088a0d688511d04025aa7d33da9a644f1001a19beb6ab7966094a66e
SHA5123e481c63b92525edfdd86195520a4e9216cf8cb38f7a68525f51f734260f66ea2287a4bf32d8f15046c110af5229a6b312de67a6c272449075e01d9bbafdb9f6
-
Filesize
342B
MD5b436e640fe153b92e70311b478ae97c3
SHA17ad5daa86efa21a1afa60b6e5b62b605f3ee47e9
SHA2561675ef9c6d6a164cd173a942be133bc53a98b7cdea0b38e06e52c3141a2aec4e
SHA5123973d0efb37868da5a7d9ba9ea0540a1361381b112dd2df1e8773531e90e002fb6d72a8c0dbce891256e7ddd04507dab5c578554138dcb47dbbc2e8e06bc26a3
-
Filesize
342B
MD5bd0e9748552f3425c16d1010623e1607
SHA18238d8b707a2da3cf9b6b0562b2396b838224fdf
SHA25677d45006d3b02820438993ca4c027e1feb5f4865a85a1300d20def36f4d15643
SHA512929929d83fabdfe33b35812739a718ec2255fbc2095b92eba95991d92c897dcfb16623d7167c4826c2221e3dfd45bba6d246cd3158ed87a5da6b875223738201
-
Filesize
342B
MD5f9a60fe8c588da77620ac43fe1d61357
SHA1545645852ad4e783a97a9aed5d8cf73410a3f557
SHA256bd5ceb2b84b350995221f8d368e4e9e56b8dd7118355469e338ca2009532bff0
SHA5129af80de8071522a113b0ff138a3e413bf45effb32ddc95a825aab8d351332b9b1a535c198f504367ef47ad7c8d450edb115d0bdf1f13dbdf310d65734b192484
-
Filesize
342B
MD51e012d9b579be85463c2e7256f04cffe
SHA144d3a6a9b20e92a0f89eca56c926e71b30779f79
SHA256bd1b9d0faa9aa8e05bdbacbed29e8cd9b3a4d046ece140678471cc9cdccab235
SHA512cff4601d579afcf5c55cd9ee42f718b3f491d40887380fb7071d839c42c576fed7ec13b114e2fd90aff8504ec71283741454f62b53bda2565a0b831d8e69676e
-
Filesize
342B
MD5391899f706c376ba26d66abbc07ace65
SHA14ae08d99fa4f44e02f6780af4b718b0321abf53b
SHA25661f0828e1f4a44e4d315ea358f2d9038e8cc3ac7558992c8a8b64edd2047e7f8
SHA512bdba0c70859a3ebec804401855fd79facb0eef6e8d784bd6bbf12e8402372fda3f588eb92d8ed2f6bb136a0b6f99f850193c27f373593a4ae54950df3ee66c2d
-
Filesize
342B
MD5597e34d13bbbd11cad8a8d7ec483591d
SHA11299b3afdc30f58972ac2b3f9c5640d2aae920d8
SHA25641a6a5a919fe233e2c24978da4a320827d38d1177a1fab12f6aff2f915c5250c
SHA51226d9b7c1d7e996e91fbe96faa66c938f87d7c349c741d8d76778e0658980f215e998f409869042273b265846060f57e79f485f36f0c54a0bc02f1682cde312be
-
Filesize
342B
MD51197ebe01ac9b45e90bb998885a4e054
SHA1699016736ce1040fac6c5bbeead719475d94eba1
SHA2568ae90bd735d6ebaf5550e966267ce4bc8ea67defbf5bba1d9994095b6ba86f3d
SHA512b89c75457bb7420f10d93b9f77ce82f5b8a893637347da22f1fa30384ec4bf0ee27248833ba0909cf107c65ba374699a23f9256f0b80297f8f3805247fdbdc31
-
Filesize
342B
MD5be02bec07bdd54a939a9899d3e0e1d1f
SHA1d13e1593bd2c029913994c4c6b551857124daa0c
SHA25602aa693931f4677accef702bf92ae6cf09ec969617a8ee04952208bd3a00b96b
SHA5124d2c150b38058136f2577d44ce395d2fb20ef8388332f825dc88ca9bf1ad135c0bf1b66dd4262e42e5e3906a6e0ac81fd436503508683dd9fedd09b4f63ac2b3
-
Filesize
342B
MD5a5349aa3f2afc474e9732a61dc6c7200
SHA1fb1483ec2afb85561784ffa231408b5a47c09957
SHA25661c2a8270a1975bd758cd4adb4a96a760fac97c52dcae3f5fc5d7d5404f709da
SHA512498d2346230643cf8659b0bf211bd73f63378f9b849f49c7e7944bc7c8488726d515dafc31ffcc0c2f73732246691fc548e8e329584089e9ecf2af91420d10dc
-
Filesize
342B
MD5544a2258592167a587527a4a561d6587
SHA165ae14cd4d5f0d8361a5519ced2f8a588455c8e6
SHA256dc7c9c4d16814c8fe15f4d870facf030b6c3bf90d97676c97e66d50eea0b3d07
SHA5124b05c3acb489dcd55f616d5dd16dab7f2fa4f659cdc66e636e9a5a50b22355a1957640825be4a616737e34c4128fd1337bedc4e3f069a5b2801d327a655413b9
-
Filesize
67KB
MD52d3dcf90f6c99f47e7593ea250c9e749
SHA151be82be4a272669983313565b4940d4b1385237
SHA2568714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4
SHA5129c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5
-
Filesize
160KB
MD57186ad693b8ad9444401bd9bcd2217c2
SHA15c28ca10a650f6026b0df4737078fa4197f3bac1
SHA2569a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed
SHA512135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b
-
Filesize
388KB
MD57a4d85a1bef0ca4cecfe376e0ee91090
SHA10eaab4a4cf009d2d0d2d525bad4742356ca06317
SHA2560cfff9ddd855236e2c89d1778e88bd87db965a29d0e4e6b75178add06fd4fdb0
SHA512963509e2871858ba356a6b1e2af71b05c22019ffe4172a3ed8d70d54597bf10a67607d8083fef90e549521cf194d76af1112f7628b23943d0da0ebde0704e280
-
Filesize
8KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
8KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
4KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
1.2MB
