85b355bba357260497b10ac81f179e95b585cd3052e55b22d7c285795dc076f9

Analysis

max time kernel
142s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 12:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

85b355bba357260497b10ac81f179e95b585cd3052e55b22d7c285795dc076f9_NeikiAnalytics.exe
Size

225KB
MD5

b199afb49a99e3868fb4b47452ee0750
SHA1

463b06a4dd57664f0ab70e91c04745fa0d8eb8d7
SHA256

85b355bba357260497b10ac81f179e95b585cd3052e55b22d7c285795dc076f9
SHA512

102df7fe68aa4902c132c0a2d675dc012a87c8aa55126cd577755bda595c99b0035e6b899e45bda5aec4010f6efb83474017447c3c7c9cd4fabd4457d00be2ff
SSDEEP

6144:CA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:CATuTAnKGwUAW3ycQqgf

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
3776	1940	WerFault.exe	winver.exe
1684	1828	WerFault.exe	85b355bba357260497b10ac81f179e95b585cd3052e55b22d7c285795dc076f9_NeikiAnalytics.exe

Modifies data under HKEY_USERS 1 IoCs

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client"	svchost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

Explorer.EXE

description	pid	process
Token: SeShutdownPrivilege	3412	Explorer.EXE
Token: SeCreatePagefilePrivilege	3412	Explorer.EXE
Token: SeShutdownPrivilege	3412	Explorer.EXE
Token: SeCreatePagefilePrivilege	3412	Explorer.EXE
Token: SeShutdownPrivilege	3412	Explorer.EXE
Token: SeCreatePagefilePrivilege	3412	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

winver.exe85b355bba357260497b10ac81f179e95b585cd3052e55b22d7c285795dc076f9_NeikiAnalytics.exe

pid process

1940 winver.exe
1828 85b355bba357260497b10ac81f179e95b585cd3052e55b22d7c285795dc076f9_NeikiAnalytics.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

3412 Explorer.EXE

pid	process
1940	winver.exe
1828	85b355bba357260497b10ac81f179e95b585cd3052e55b22d7c285795dc076f9_NeikiAnalytics.exe

pid	process
3412	Explorer.EXE

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

85b355bba357260497b10ac81f179e95b585cd3052e55b22d7c285795dc076f9_NeikiAnalytics.exewinver.exe

description	pid	process	target process
PID 1828 wrote to memory of 1940	1828	85b355bba357260497b10ac81f179e95b585cd3052e55b22d7c285795dc076f9_NeikiAnalytics.exe	winver.exe
PID 1828 wrote to memory of 1940	1828	85b355bba357260497b10ac81f179e95b585cd3052e55b22d7c285795dc076f9_NeikiAnalytics.exe	winver.exe
PID 1828 wrote to memory of 1940	1828	85b355bba357260497b10ac81f179e95b585cd3052e55b22d7c285795dc076f9_NeikiAnalytics.exe	winver.exe
PID 1828 wrote to memory of 1940	1828	85b355bba357260497b10ac81f179e95b585cd3052e55b22d7c285795dc076f9_NeikiAnalytics.exe	winver.exe
PID 1940 wrote to memory of 3412	1940	winver.exe	Explorer.EXE
PID 1828 wrote to memory of 3412	1828	85b355bba357260497b10ac81f179e95b585cd3052e55b22d7c285795dc076f9_NeikiAnalytics.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3412

C:\Users\Admin\AppData\Local\Temp\85b355bba357260497b10ac81f179e95b585cd3052e55b22d7c285795dc076f9_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\85b355bba357260497b10ac81f179e95b585cd3052e55b22d7c285795dc076f9_NeikiAnalytics.exe"
2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1828

C:\Windows\SysWOW64\winver.exe
winver
3⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 300
4⤵
- Program crash
PID:3776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1828 -s 808
3⤵
- Program crash
PID:1684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1300,i,17325488789339133686,9539570259395798500,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:8
1⤵
PID:2496

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
- Modifies data under HKEY_USERS
PID:2084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1940 -ip 1940
1⤵
PID:3188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1828 -ip 1828
1⤵
PID:5052

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1828-1-0x00000000046F0000-0x0000000004D48000-memory.dmp

Filesize
6.3MB

Download
memory/1828-2-0x0000000003DD0000-0x0000000003DD1000-memory.dmp

Filesize
4KB

Download
memory/1828-6-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1828-13-0x00000000046F0000-0x0000000004D48000-memory.dmp

Filesize
6.3MB

Download
memory/3412-4-0x0000000001240000-0x0000000001246000-memory.dmp

Filesize
24KB

Download
memory/3412-5-0x0000000001240000-0x0000000001246000-memory.dmp

Filesize
24KB

Download
memory/3412-10-0x0000000001250000-0x0000000001256000-memory.dmp

Filesize
24KB

Download