46ed292893e8302219600f1b5c8f83d6a6fe9d78f7245d7281eb13e994bb122f

Analysis

max time kernel
62s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 07:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46ed292893e8302219600f1b5c8f83d6a6fe9d78f7245d7281eb13e994bb122f_NeikiAnalytics.exe
Size

1.5MB
MD5

6c5edd49b86932f574100bf07ccaee20
SHA1

d0f95c2f34e0eb722c5dd21dc7378f91e4f360a9
SHA256

46ed292893e8302219600f1b5c8f83d6a6fe9d78f7245d7281eb13e994bb122f
SHA512

31f9d1bc36da1a6c6be563667ad1f7020f9ac04433d53128beca1db0758f73a483d35b86ecc600e225e707fcdf46a5586c67361f8378ed55630bbc01900aa2a7
SSDEEP

49152:+WUMv5De9/yG9/ooooERQr0tb6H8RlOuQhRe4hvR:+WUMqyGB0Z6H8Rl4y0

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	46ed292893e8302219600f1b5c8f83d6a6fe9d78f7245d7281eb13e994bb122f_NeikiAnalytics.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F	46ed292893e8302219600f1b5c8f83d6a6fe9d78f7245d7281eb13e994bb122f_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\7CCD586D-2ABC-42FF-A23B-3731F4F183D9 = "4DEC930631D6A523D3820D3CE1249367"	46ed292893e8302219600f1b5c8f83d6a6fe9d78f7245d7281eb13e994bb122f_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\5E1D6A55-0134-486E-A166-38C2E4919BB1 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA1QEjAc/rEUmt/LBYo5AIGgQAAAACAAAAAAAQZgAAAAEAACAAAAClqg/HnknQZbaMmCzekuAL8Xpr/Zc8EykT46/J5DSJRwAAAAAOgAAAAAIAACAAAACYhxjeqc/SmjqgqPZjK/pVi1nOLE1jPqFjUCcIBuWa/jAAAAA/4RLNh5YtSvb+X7fHbDZx0NZGpSL1shVnUURX9Bh0aSkJNA4NXRlj4MARK2EWBQhAAAAA+llJWYFXlPevCpNu3BMmxtkSxgGxHRAGp5E9lxk5Ul1M7+77dBrD2Qzs9IwFl1jItHnXE7hGKzQLoxNHVO4R6A=="	46ed292893e8302219600f1b5c8f83d6a6fe9d78f7245d7281eb13e994bb122f_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\56C7A9DA-4B11-406A-8B1A-EFF157C294D6 = "e4be2649-296b-4d23-93a8-a0e472a585e5"	46ed292893e8302219600f1b5c8f83d6a6fe9d78f7245d7281eb13e994bb122f_NeikiAnalytics.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3664	46ed292893e8302219600f1b5c8f83d6a6fe9d78f7245d7281eb13e994bb122f_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\46ed292893e8302219600f1b5c8f83d6a6fe9d78f7245d7281eb13e994bb122f_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\46ed292893e8302219600f1b5c8f83d6a6fe9d78f7245d7281eb13e994bb122f_NeikiAnalytics.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:3664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads