f878df2cb509c6a85149d9e9df771fd64ea291f3023eaefcf32b2a6f34217d9c

Analysis

max time kernel
150s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 20:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f1062c07d8e435acd005c7bed9d98b80_NeikiAnalytics.exe
Size

206KB
MD5

f1062c07d8e435acd005c7bed9d98b80
SHA1

88df4b263a958307b5f6ba273f79c290f3b5d2e8
SHA256

f878df2cb509c6a85149d9e9df771fd64ea291f3023eaefcf32b2a6f34217d9c
SHA512

9fe787913fad05d0c327b5b02dd4b7f55893a98fbaca3ba390126906d942f73dd8ad3ef25e5a98f96b52696461a7cd06fc526e98704c95e21a536ea160c7a85f
SSDEEP

3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6un/RRRRRRRRRRRRRRRRRRRRRr:5vEN2U+T6i5LirrllHy4HUcMQY60

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2992	explorer.exe
2672	spoolsv.exe
4672	svchost.exe
3116	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	f1062c07d8e435acd005c7bed9d98b80_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
116	f1062c07d8e435acd005c7bed9d98b80_NeikiAnalytics.exe
116	f1062c07d8e435acd005c7bed9d98b80_NeikiAnalytics.exe
2992	explorer.exe
2992	explorer.exe
2992	explorer.exe
2992	explorer.exe
2992	explorer.exe
2992	explorer.exe
4672	svchost.exe
4672	svchost.exe
4672	svchost.exe
4672	svchost.exe
2992	explorer.exe
2992	explorer.exe
4672	svchost.exe
4672	svchost.exe
2992	explorer.exe
2992	explorer.exe
4672	svchost.exe
4672	svchost.exe
2992	explorer.exe
2992	explorer.exe
4672	svchost.exe
4672	svchost.exe
2992	explorer.exe
2992	explorer.exe
4672	svchost.exe
4672	svchost.exe
2992	explorer.exe
2992	explorer.exe
4672	svchost.exe
4672	svchost.exe
2992	explorer.exe
2992	explorer.exe
4672	svchost.exe
4672	svchost.exe
2992	explorer.exe
2992	explorer.exe
4672	svchost.exe
4672	svchost.exe
2992	explorer.exe
2992	explorer.exe
4672	svchost.exe
4672	svchost.exe
2992	explorer.exe
2992	explorer.exe
4672	svchost.exe
4672	svchost.exe
2992	explorer.exe
2992	explorer.exe
4672	svchost.exe
4672	svchost.exe
2992	explorer.exe
2992	explorer.exe
4672	svchost.exe
4672	svchost.exe
2992	explorer.exe
2992	explorer.exe
4672	svchost.exe
4672	svchost.exe
2992	explorer.exe
2992	explorer.exe
4672	svchost.exe
4672	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2992	explorer.exe
4672	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
116	f1062c07d8e435acd005c7bed9d98b80_NeikiAnalytics.exe
116	f1062c07d8e435acd005c7bed9d98b80_NeikiAnalytics.exe
2992	explorer.exe
2992	explorer.exe
2672	spoolsv.exe
2672	spoolsv.exe
4672	svchost.exe
4672	svchost.exe
3116	spoolsv.exe
3116	spoolsv.exe
2992	explorer.exe
2992	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 2992	116	f1062c07d8e435acd005c7bed9d98b80_NeikiAnalytics.exe	82
PID 116 wrote to memory of 2992	116	f1062c07d8e435acd005c7bed9d98b80_NeikiAnalytics.exe	82
PID 116 wrote to memory of 2992	116	f1062c07d8e435acd005c7bed9d98b80_NeikiAnalytics.exe	82
PID 2992 wrote to memory of 2672	2992	explorer.exe	84
PID 2992 wrote to memory of 2672	2992	explorer.exe	84
PID 2992 wrote to memory of 2672	2992	explorer.exe	84
PID 2672 wrote to memory of 4672	2672	spoolsv.exe	86
PID 2672 wrote to memory of 4672	2672	spoolsv.exe	86
PID 2672 wrote to memory of 4672	2672	spoolsv.exe	86
PID 4672 wrote to memory of 3116	4672	svchost.exe	87
PID 4672 wrote to memory of 3116	4672	svchost.exe	87
PID 4672 wrote to memory of 3116	4672	svchost.exe	87
PID 4672 wrote to memory of 3156	4672	svchost.exe	88
PID 4672 wrote to memory of 3156	4672	svchost.exe	88
PID 4672 wrote to memory of 3156	4672	svchost.exe	88
PID 4672 wrote to memory of 2304	4672	svchost.exe	97
PID 4672 wrote to memory of 2304	4672	svchost.exe	97
PID 4672 wrote to memory of 2304	4672	svchost.exe	97
PID 4672 wrote to memory of 1924	4672	svchost.exe	99
PID 4672 wrote to memory of 1924	4672	svchost.exe	99
PID 4672 wrote to memory of 1924	4672	svchost.exe	99

C:\Users\Admin\AppData\Local\Temp\f1062c07d8e435acd005c7bed9d98b80_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\f1062c07d8e435acd005c7bed9d98b80_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:116
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2992
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2672
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4672
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3116
    - - C:\Windows\SysWOW64\at.exe
        
        at 20:39 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:3156
    - - C:\Windows\SysWOW64\at.exe
        
        at 20:40 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2304
    - - C:\Windows\SysWOW64\at.exe
        
        at 20:41 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
206KB

MD5
6f55a248f128c0d2cfe23159edf2e84f

SHA1
288510e96c22d6f66a09eeacca4f93fe92576ce7

SHA256
2b9196a6ae9ae122bdee7de37e86bcff6b6984c706febc4f0dd3c47121170b9e

SHA512
ee7b071b43cf2db6eab2c4476f103a1e5a6ee5e93133bde26ba83ce03b9cb04a3e6a31d5d620a26f6fa8cf8cd477c59997d018099141c1b967c18c9b4d150763

Download Submit
C:\Windows\System\explorer.exe

Filesize
206KB

MD5
243caac92b8be1f87af19a50d209b8ab

SHA1
2d58a637334a523f0e8324492bca83aa11a7c1a9

SHA256
b8229d4864777f3b3f73d044631a44934eb2b5b79409e4ca2c23c1d4238a8c7c

SHA512
664232f3aefd341d2c71efc76d62dcce684fa775db4dae578691948939cb5906c363c1e0dec9c365952c1997ff8929b7d7d574adea1c2885d721068785256c02

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
206KB

MD5
a7d452cd60b127a795e0436706549f74

SHA1
50a675e1ed14afc2e8d6e2fd9239ed780e95ecaa

SHA256
72a8880cde84ca58d139d9deb1ab07703738395e0794cb0346bf401163bfe6b5

SHA512
182a58bcaae37e20908e7388661b02b5654ecce064cf059aa09a4a18d542b5ccb34d005d4d1912cacbb944a464bc098f0d11261c2017ec65fbbc427357c3abe6

Download Submit
C:\Windows\System\svchost.exe

Filesize
206KB

MD5
fe0a45e64e542d9e5f62e2130c7fee4a

SHA1
f02ca7de86827888731119d664f01725012ac251

SHA256
6c53f74a134fd6f1e94d0f8b4b63b3e7ced926c28aed99390696b78193d062fb

SHA512
a18e0724a2aa50724f877a6cb6afeabe30adb620c8aadc4a8bd6a51c7f65a86766ac577ee4659b5626ee3f5c255ee897a65c203265e01b1c6a9121c12624c234

Download Submit
memory/116-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/116-37-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2672-36-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2992-9-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3116-35-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download