2069e1c6bfa6fb43508120eb064d74b2ab0e79fd55984945829f509a1d3c5757

Analysis

max time kernel
149s
max time network
125s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 02:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

52b749ae7f9df7445fba964770964150_NeikiAnalytics.exe
Size

3.6MB
MD5

52b749ae7f9df7445fba964770964150
SHA1

bfa81367c72e0d37c640f3dc809002c3425d0cb5
SHA256

2069e1c6bfa6fb43508120eb064d74b2ab0e79fd55984945829f509a1d3c5757
SHA512

f22510e13b5809bd6f9c3d9828681c242ead3a1381a418654728073ca8783db1f277f18da2250c4ba552dbda207fe96a3fb6b94c7363b9db201bc949f606a04c
SSDEEP

49152:Vu/dUpCw4SIjcP0idTfTXE5JJ7g97/mHEY/D+Vam0IAo:Vg4midTSJMRY/Nv1o

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\wininit.exe"	wininit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\wininit.exe"	icsys.ico.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	wininit.exe

UAC bypass 3 TTPs 15 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	52b749ae7f9df7445fba964770964150_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	icsys.ico.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	icsys.ico.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	icsys.ico.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	52b749ae7f9df7445fba964770964150_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	52b749ae7f9df7445fba964770964150_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe

Executes dropped EXE 5 IoCs

pid	Process
2800	icsys.ico.exe
2676	wininit.exe
2552	52b749ae7f9df7445fba964770964150_neikianalytics.exe
2656	spoolsv.exe
2360	svchost.exe

Loads dropped DLL 5 IoCs

pid	Process
1288	52b749ae7f9df7445fba964770964150_NeikiAnalytics.exe
2800	icsys.ico.exe
1288	52b749ae7f9df7445fba964770964150_NeikiAnalytics.exe
2676	wininit.exe
2656	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Wininit = "c:\\windows\\wininit.exe"	icsys.ico.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Svchost = "c:\\windows\\svchost.exe"	icsys.ico.exe

Checks whether UAC is enabled 1 TTPs 10 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	52b749ae7f9df7445fba964770964150_NeikiAnalytics.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	icsys.ico.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	icsys.ico.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	52b749ae7f9df7445fba964770964150_NeikiAnalytics.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\wininit.exe	icsys.ico.exe
File opened for modification	\??\c:\windows\wininit.exe	wininit.exe
File created	\??\c:\windows\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Wininit	52b749ae7f9df7445fba964770964150_NeikiAnalytics.exe
File opened for modification	C:\Windows\Wininit	icsys.ico.exe
File created	\??\c:\windows\wininit.exe	icsys.ico.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2800	icsys.ico.exe
2656	spoolsv.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe
2676	wininit.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2676	wininit.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 2800	1288	52b749ae7f9df7445fba964770964150_NeikiAnalytics.exe	28
PID 1288 wrote to memory of 2800	1288	52b749ae7f9df7445fba964770964150_NeikiAnalytics.exe	28
PID 1288 wrote to memory of 2800	1288	52b749ae7f9df7445fba964770964150_NeikiAnalytics.exe	28
PID 1288 wrote to memory of 2800	1288	52b749ae7f9df7445fba964770964150_NeikiAnalytics.exe	28
PID 2800 wrote to memory of 2676	2800	icsys.ico.exe	29
PID 2800 wrote to memory of 2676	2800	icsys.ico.exe	29
PID 2800 wrote to memory of 2676	2800	icsys.ico.exe	29
PID 2800 wrote to memory of 2676	2800	icsys.ico.exe	29
PID 1288 wrote to memory of 2552	1288	52b749ae7f9df7445fba964770964150_NeikiAnalytics.exe	30
PID 1288 wrote to memory of 2552	1288	52b749ae7f9df7445fba964770964150_NeikiAnalytics.exe	30
PID 1288 wrote to memory of 2552	1288	52b749ae7f9df7445fba964770964150_NeikiAnalytics.exe	30
PID 1288 wrote to memory of 2552	1288	52b749ae7f9df7445fba964770964150_NeikiAnalytics.exe	30
PID 2676 wrote to memory of 2656	2676	wininit.exe	31
PID 2676 wrote to memory of 2656	2676	wininit.exe	31
PID 2676 wrote to memory of 2656	2676	wininit.exe	31
PID 2676 wrote to memory of 2656	2676	wininit.exe	31
PID 2656 wrote to memory of 2360	2656	spoolsv.exe	32
PID 2656 wrote to memory of 2360	2656	spoolsv.exe	32
PID 2656 wrote to memory of 2360	2656	spoolsv.exe	32
PID 2656 wrote to memory of 2360	2656	spoolsv.exe	32

System policy modification 1 TTPs 15 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	icsys.ico.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	icsys.ico.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	icsys.ico.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	52b749ae7f9df7445fba964770964150_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	52b749ae7f9df7445fba964770964150_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	52b749ae7f9df7445fba964770964150_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	spoolsv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe

C:\Users\Admin\AppData\Local\Temp\52b749ae7f9df7445fba964770964150_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\52b749ae7f9df7445fba964770964150_NeikiAnalytics.exe"
1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1288
- C:\Users\Admin\AppData\Roaming\icsys.ico.exe
  C:\Users\Admin\AppData\Roaming\icsys.ico.exe
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2800
- - C:\windows\wininit.exe
    "C:\windows\wininit.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Modifies visiblity of hidden/system files in Explorer
    - UAC bypass
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2676
  - - C:\Users\Admin\appdata\roaming\spoolsv.exe
      "C:\Users\Admin\appdata\roaming\spoolsv.exe" /SE
      4⤵
      UAC bypass
      Executes dropped EXE
      Loads dropped DLL
      Checks whether UAC is enabled
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2656
    - - C:\windows\svchost.exe
        
        "C:\windows\svchost.exe"
        5⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        System policy modification
        
        PID:2360
- \??\c:\users\admin\appdata\local\temp\52b749ae7f9df7445fba964770964150_neikianalytics.exe
  c:\users\admin\appdata\local\temp\52b749ae7f9df7445fba964770964150_neikianalytics.exe
  2⤵
  - Executes dropped EXE
  PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\52b749ae7f9df7445fba964770964150_neikianalytics.exe

Filesize
740KB

MD5
de214e21fa8152cb1982c6c854831f37

SHA1
2476d91c49f566a391346f969e6fbbf8d0b8c511

SHA256
47c33dc6fb7854fb4bcdbd5fba6b063fa39916d4a4a78f05f7c43ccac9f68b80

SHA512
2f0232b8f0395a864c38ec85f4c759d0987adf36cfef26476739b0e7325e65f2fc97d90c1f5d0fec339d075dfc5770f03e24ef6dcd6c37a15a11adfc7149f4e6

Download Submit
C:\Windows\Wininit

Filesize
17B

MD5
dc88c4aa03f5180bbece1abdfec93e70

SHA1
59662d61697f32a522dc6cfeb67202803b311788

SHA256
764df4d37a31be29b4d87041c66c520cf72260d05b22c92df5f61e1eb67ef728

SHA512
f3b434bfa1767976744b80abe90c4d9614aecbacca889571ba90e8c848808bed73d37b21eb56afa51234481c36ba74348bb791f43655be4f0ee9bca8df89ae49

Download Submit
\Users\Admin\AppData\Roaming\icsys.ico.exe

Filesize
2.9MB

MD5
9fa3f988fc0466524bf75d61ba96d41e

SHA1
afb71a0fd36ab613909baa6dedbdace501fefee2

SHA256
20d9cf9b68fb091558cf8c13e09cfff2de96a767f19e30e67a2066b09cddc2a1

SHA512
a3b5be2924589adf40efc0f54c0732710f4a7169d84c77b16af88573cfcf9239676c667afd428b3bc8b80504305a79f95d19e0b6ace8f22603696ad1e51af26c

Download Submit
memory/1288-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1288-41-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/2360-50-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/2360-48-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/2656-45-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/2676-26-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2676-60-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/2676-72-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/2676-49-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/2676-70-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/2676-51-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2676-52-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/2676-54-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/2676-56-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/2676-58-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/2676-47-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/2676-62-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/2676-64-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/2676-66-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download
memory/2800-13-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2800-21-0x0000000000400000-0x0000000000768000-memory.dmp

Filesize
3.4MB

Download