09043bdd83555e08e88565f8219ee4606a6dabed471332a67cd48e3da51fa893

Analysis

max time kernel
150s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 17:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

016d2e8dbf0e62b3948f3d1d1931dc40_NEIKI.exe
Size

122KB
MD5

016d2e8dbf0e62b3948f3d1d1931dc40
SHA1

1cba136b50975790e6bc8790c8760a1f0c49a3d0
SHA256

09043bdd83555e08e88565f8219ee4606a6dabed471332a67cd48e3da51fa893
SHA512

b9fa22eef2df0b07ddc5156da357809528e929c5a3e47e90b342318084c9c57802a34b7b616603c5bee361baa997f54b6d20254891253dcf8b7868929e1b3cf2
SSDEEP

1536:nFyzF9MFVCujlsQoeQZZ86ukpj0nGGF9v+4DRIG:FyzQVCujl71QZZ4kp4F9XtIG

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
1976	explorer.exe
1912	spoolsv.exe
1372	svchost.exe
1192	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\System\tjud.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	016d2e8dbf0e62b3948f3d1d1931dc40_NEIKI.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4620	016d2e8dbf0e62b3948f3d1d1931dc40_NEIKI.exe
4620	016d2e8dbf0e62b3948f3d1d1931dc40_NEIKI.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1976	explorer.exe
1372	svchost.exe
1372	svchost.exe
1372	svchost.exe
1372	svchost.exe
1976	explorer.exe
1976	explorer.exe
1372	svchost.exe
1372	svchost.exe
1976	explorer.exe
1976	explorer.exe
1372	svchost.exe
1372	svchost.exe
1976	explorer.exe
1976	explorer.exe
1372	svchost.exe
1372	svchost.exe
1976	explorer.exe
1976	explorer.exe
1372	svchost.exe
1372	svchost.exe
1976	explorer.exe
1976	explorer.exe
1372	svchost.exe
1372	svchost.exe
1976	explorer.exe
1976	explorer.exe
1372	svchost.exe
1372	svchost.exe
1976	explorer.exe
1976	explorer.exe
1372	svchost.exe
1372	svchost.exe
1976	explorer.exe
1976	explorer.exe
1372	svchost.exe
1372	svchost.exe
1976	explorer.exe
1976	explorer.exe
1372	svchost.exe
1372	svchost.exe
1976	explorer.exe
1976	explorer.exe
1372	svchost.exe
1372	svchost.exe
1976	explorer.exe
1976	explorer.exe
1372	svchost.exe
1372	svchost.exe
1976	explorer.exe
1976	explorer.exe
1372	svchost.exe
1372	svchost.exe
1976	explorer.exe
1976	explorer.exe
1372	svchost.exe
1372	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1976	explorer.exe
1372	svchost.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
4620	016d2e8dbf0e62b3948f3d1d1931dc40_NEIKI.exe
4620	016d2e8dbf0e62b3948f3d1d1931dc40_NEIKI.exe
1976	explorer.exe
1976	explorer.exe
1912	spoolsv.exe
1912	spoolsv.exe
1372	svchost.exe
1372	svchost.exe
1192	spoolsv.exe
1192	spoolsv.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 1976	4620	016d2e8dbf0e62b3948f3d1d1931dc40_NEIKI.exe	80
PID 4620 wrote to memory of 1976	4620	016d2e8dbf0e62b3948f3d1d1931dc40_NEIKI.exe	80
PID 4620 wrote to memory of 1976	4620	016d2e8dbf0e62b3948f3d1d1931dc40_NEIKI.exe	80
PID 1976 wrote to memory of 1912	1976	explorer.exe	81
PID 1976 wrote to memory of 1912	1976	explorer.exe	81
PID 1976 wrote to memory of 1912	1976	explorer.exe	81
PID 1912 wrote to memory of 1372	1912	spoolsv.exe	82
PID 1912 wrote to memory of 1372	1912	spoolsv.exe	82
PID 1912 wrote to memory of 1372	1912	spoolsv.exe	82
PID 1372 wrote to memory of 1192	1372	svchost.exe	84
PID 1372 wrote to memory of 1192	1372	svchost.exe	84
PID 1372 wrote to memory of 1192	1372	svchost.exe	84

C:\Users\Admin\AppData\Local\Temp\016d2e8dbf0e62b3948f3d1d1931dc40_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\016d2e8dbf0e62b3948f3d1d1931dc40_NEIKI.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4620
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1976
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1912
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1372
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
122KB

MD5
7732d62e3ff4aa0946e6cbac1cfbb728

SHA1
4d16a678eb07e2a7666739d4ab3cfc1b3b59f266

SHA256
48796aa7f4ff218ad77a4280f7546fc090b57851a3c7fa5ebd4689d92ea04c2a

SHA512
79b22f9d6d8f79e058bafa0d893d688cf6ac912f4339f0efe16e4d19fbd8a9b13d07c92c6d8a104615f6349d483da091d7dc46ebd94de174bbbdd1857d4ee303

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
122KB

MD5
ec59e282b71a43e6d957f63a474587a0

SHA1
4969f9506f0bbc1a503a424ce776927cdb402a82

SHA256
080f03c19bc1723537f1b290866d44ac797106729dfa64be60e7eac639527cf4

SHA512
23c29e0b609e2ab25d5bc00acf3c58d29cbab4cd9f2509a04938811e94422e67ccc8838235a9f1deaea4a18acdda5d5830186b16be0edb20c0da17459d94c575

Download Submit
C:\Windows\System\svchost.exe

Filesize
122KB

MD5
7336cf86ae207a0bdef304fcef2cdb2b

SHA1
3129831a79b0ba92fa138b4b6213278971a99403

SHA256
1fd55de46b8abf4ccd3af7067a1fc22d34b49c211b626b39b8c4742638197f52

SHA512
6b1c227f5540d26c899ae1e20004651636619a85bdf850be4d8628d71e5fa001072c9044faf84fbc9dba3287b583ad14389553a30dc310ff67b1d5db26c68276

Download Submit
\??\c:\windows\system\explorer.exe

Filesize
122KB

MD5
9f23cce244bc2e4dd3c441598eff2eee

SHA1
f23dbea7fc3c62a8484fab06ce988e0d9718cebb

SHA256
bec11ac6e475c6b24cf4e5cf8c82a9586c7e1851c0b158f0e55a3119845905e6

SHA512
68bfab1a0c5ea59075018e1b51569d6c679f83e9e3651910727342c5f25534baa8926510ec934f2a646d0c04ae07a98ea5fa17a7c161f95eef7fedb1d2b15332

Download Submit