Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
18-06-2024 13:59
Static task
static1
Behavioral task
behavioral1
Sample
4e1328f16286aaff5d2ee3d7073f0930_NeikiAnalytics.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
4e1328f16286aaff5d2ee3d7073f0930_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
General
-
Target
4e1328f16286aaff5d2ee3d7073f0930_NeikiAnalytics.dll
-
Size
1.8MB
-
MD5
4e1328f16286aaff5d2ee3d7073f0930
-
SHA1
8f658f6f4b606180669e2a016c1afc84878c616e
-
SHA256
6299a681f17cef494d732f1bec2050ef18c5d3d2cf38df2081fff8ae422381a9
-
SHA512
0992c374855d3e4747434985766b8a015d9d70a82b4d762741995d3842f4f98be92e653022ba873be7d8c64d6a6461f4799e755c210752f2ab23b46638dc42f1
-
SSDEEP
24576:icjYURxCm5eoDdEQ5ZIqLG6NK7RswS/QC1XG9dp:5YURxR5eYV5G6NK7RswS/QC1G
Malware Config
Signatures
-
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Modifies registry class 25 IoCs
Processes:
regsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3ED6E93A-5D39-4BAE-9466-824FADC9D8CE}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E03ED2E4-F7CC-46E1-8ECB-96415B9F4BF0}\ProgID\ = "ADOInfoProvider.MSSQLInfoProvider" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E03ED2E4-F7CC-46E1-8ECB-96415B9F4BF0}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E03ED2E4-F7CC-46E1-8ECB-96415B9F4BF0}\TypeLib\ = "{3ED6E93A-5D39-4BAE-9466-824FADC9D8CE}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3ED6E93A-5D39-4BAE-9466-824FADC9D8CE}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3ED6E93A-5D39-4BAE-9466-824FADC9D8CE}\1.0\ = "ADOInfoProvider Library" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3ED6E93A-5D39-4BAE-9466-824FADC9D8CE}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3ED6E93A-5D39-4BAE-9466-824FADC9D8CE}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E03ED2E4-F7CC-46E1-8ECB-96415B9F4BF0}\ = "MSSQLInfoProvider" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3ED6E93A-5D39-4BAE-9466-824FADC9D8CE}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E03ED2E4-F7CC-46E1-8ECB-96415B9F4BF0}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ADOInfoProvider.MSSQLInfoProvider\Clsid\ = "{E03ED2E4-F7CC-46E1-8ECB-96415B9F4BF0}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3ED6E93A-5D39-4BAE-9466-824FADC9D8CE} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3ED6E93A-5D39-4BAE-9466-824FADC9D8CE}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ADOInfoProvider.MSSQLInfoProvider\ = "MSSQLInfoProvider" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E03ED2E4-F7CC-46E1-8ECB-96415B9F4BF0}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3ED6E93A-5D39-4BAE-9466-824FADC9D8CE}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E03ED2E4-F7CC-46E1-8ECB-96415B9F4BF0} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E03ED2E4-F7CC-46E1-8ECB-96415B9F4BF0}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4e1328f16286aaff5d2ee3d7073f0930_NeikiAnalytics.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ADOInfoProvider.MSSQLInfoProvider\Clsid regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E03ED2E4-F7CC-46E1-8ECB-96415B9F4BF0}\Version\ = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ADOInfoProvider.MSSQLInfoProvider regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3ED6E93A-5D39-4BAE-9466-824FADC9D8CE}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4e1328f16286aaff5d2ee3d7073f0930_NeikiAnalytics.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E03ED2E4-F7CC-46E1-8ECB-96415B9F4BF0}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E03ED2E4-F7CC-46E1-8ECB-96415B9F4BF0}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe