Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 15:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0f7f8f1048960ecd16351e8d75ae3750_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
0f7f8f1048960ecd16351e8d75ae3750_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
0f7f8f1048960ecd16351e8d75ae3750_NeikiAnalytics.exe
-
Size
206KB
-
MD5
0f7f8f1048960ecd16351e8d75ae3750
-
SHA1
8a3f6de879d603888e0fc20ab29b03a668068155
-
SHA256
65eae3efb9deb63c50ea7c2bfc1eaf9a90f9bd7b36d8b68b42ea75eacbfa5966
-
SHA512
8c7021d5ba45632339b222a3b030e9538d406daf0721b5e1c195fb4af9340ea5bd7d38c67da5e63b69c9fadbe2bf49df77b4d599283be1844da1aac10c8f754b
-
SSDEEP
3072:zvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unXJ:zvEN2U+T6i5LirrllHy4HUcMQY6WJ
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
Modifies Installed Components in the registry 2 TTPs 8 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe -
Executes dropped EXE 4 IoCs
pid Process 1300 explorer.exe 2580 spoolsv.exe 2756 svchost.exe 1772 spoolsv.exe -
Loads dropped DLL 8 IoCs
pid Process 2204 0f7f8f1048960ecd16351e8d75ae3750_NeikiAnalytics.exe 2204 0f7f8f1048960ecd16351e8d75ae3750_NeikiAnalytics.exe 1300 explorer.exe 1300 explorer.exe 2580 spoolsv.exe 2580 spoolsv.exe 2756 svchost.exe 2756 svchost.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe 0f7f8f1048960ecd16351e8d75ae3750_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2204 0f7f8f1048960ecd16351e8d75ae3750_NeikiAnalytics.exe 1300 explorer.exe 1300 explorer.exe 1300 explorer.exe 2756 svchost.exe 2756 svchost.exe 1300 explorer.exe 2756 svchost.exe 1300 explorer.exe 2756 svchost.exe 1300 explorer.exe 2756 svchost.exe 1300 explorer.exe 2756 svchost.exe 1300 explorer.exe 2756 svchost.exe 1300 explorer.exe 2756 svchost.exe 1300 explorer.exe 2756 svchost.exe 1300 explorer.exe 2756 svchost.exe 1300 explorer.exe 2756 svchost.exe 1300 explorer.exe 2756 svchost.exe 1300 explorer.exe 2756 svchost.exe 1300 explorer.exe 2756 svchost.exe 1300 explorer.exe 2756 svchost.exe 1300 explorer.exe 2756 svchost.exe 1300 explorer.exe 2756 svchost.exe 1300 explorer.exe 2756 svchost.exe 1300 explorer.exe 2756 svchost.exe 1300 explorer.exe 2756 svchost.exe 1300 explorer.exe 2756 svchost.exe 1300 explorer.exe 2756 svchost.exe 1300 explorer.exe 2756 svchost.exe 1300 explorer.exe 2756 svchost.exe 1300 explorer.exe 2756 svchost.exe 1300 explorer.exe 2756 svchost.exe 1300 explorer.exe 2756 svchost.exe 1300 explorer.exe 2756 svchost.exe 1300 explorer.exe 2756 svchost.exe 1300 explorer.exe 2756 svchost.exe 1300 explorer.exe 2756 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1300 explorer.exe 2756 svchost.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2204 0f7f8f1048960ecd16351e8d75ae3750_NeikiAnalytics.exe 2204 0f7f8f1048960ecd16351e8d75ae3750_NeikiAnalytics.exe 1300 explorer.exe 1300 explorer.exe 2580 spoolsv.exe 2580 spoolsv.exe 2756 svchost.exe 2756 svchost.exe 1772 spoolsv.exe 1772 spoolsv.exe 1300 explorer.exe 1300 explorer.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2204 wrote to memory of 1300 2204 0f7f8f1048960ecd16351e8d75ae3750_NeikiAnalytics.exe 28 PID 2204 wrote to memory of 1300 2204 0f7f8f1048960ecd16351e8d75ae3750_NeikiAnalytics.exe 28 PID 2204 wrote to memory of 1300 2204 0f7f8f1048960ecd16351e8d75ae3750_NeikiAnalytics.exe 28 PID 2204 wrote to memory of 1300 2204 0f7f8f1048960ecd16351e8d75ae3750_NeikiAnalytics.exe 28 PID 1300 wrote to memory of 2580 1300 explorer.exe 29 PID 1300 wrote to memory of 2580 1300 explorer.exe 29 PID 1300 wrote to memory of 2580 1300 explorer.exe 29 PID 1300 wrote to memory of 2580 1300 explorer.exe 29 PID 2580 wrote to memory of 2756 2580 spoolsv.exe 30 PID 2580 wrote to memory of 2756 2580 spoolsv.exe 30 PID 2580 wrote to memory of 2756 2580 spoolsv.exe 30 PID 2580 wrote to memory of 2756 2580 spoolsv.exe 30 PID 2756 wrote to memory of 1772 2756 svchost.exe 31 PID 2756 wrote to memory of 1772 2756 svchost.exe 31 PID 2756 wrote to memory of 1772 2756 svchost.exe 31 PID 2756 wrote to memory of 1772 2756 svchost.exe 31 PID 2756 wrote to memory of 1984 2756 svchost.exe 32 PID 2756 wrote to memory of 1984 2756 svchost.exe 32 PID 2756 wrote to memory of 1984 2756 svchost.exe 32 PID 2756 wrote to memory of 1984 2756 svchost.exe 32 PID 2756 wrote to memory of 332 2756 svchost.exe 36 PID 2756 wrote to memory of 332 2756 svchost.exe 36 PID 2756 wrote to memory of 332 2756 svchost.exe 36 PID 2756 wrote to memory of 332 2756 svchost.exe 36 PID 2756 wrote to memory of 2432 2756 svchost.exe 38 PID 2756 wrote to memory of 2432 2756 svchost.exe 38 PID 2756 wrote to memory of 2432 2756 svchost.exe 38 PID 2756 wrote to memory of 2432 2756 svchost.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f7f8f1048960ecd16351e8d75ae3750_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0f7f8f1048960ecd16351e8d75ae3750_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1772
-
-
C:\Windows\SysWOW64\at.exeat 15:28 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:1984
-
-
C:\Windows\SysWOW64\at.exeat 15:29 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:332
-
-
C:\Windows\SysWOW64\at.exeat 15:30 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:2432
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
206KB
MD51f9f4edab27b2d368f0c0e22eafe33cb
SHA126878721b312c4fbe4c3a329f1a97fa7d7d668e4
SHA2561eec42fdae5886d866cb6460c43947e8f55e842018960f7ac76fce6480b9a7ad
SHA512d0f2960aaaf12a8d5df2813acd139f1b7e3223b198328f9563829853d15ac229ee9ea73530fba7eff4d4abc224c666434b9f59646a1dd7c87735f61593fbd8ef
-
Filesize
206KB
MD5019a641ff268ae2e9f1d9638cd0ef49d
SHA1730273453b06a9cd9fb8c450db0d50f661d90e07
SHA256c4853d475724f9f0cb8c395064e03aa373a6dc61a9eb5bc3f6ec8f6d70c16690
SHA5124d462495ef4f29a2a1afc38d7815262d1c9e266d5cb237ad63901377b1b4b7bd06cab72b62a098eec70f4245e3ee16311f9e4e2690d68d53139f7f09573d1dd3
-
Filesize
206KB
MD551f976543673375b28dfbc6347c5bd9f
SHA17d122c4de53b611477883cb94ce561e8ee180bdd
SHA2563cd52bd853f98089d58d3ea1f08525a85daf4794551edb23d7b513c80d66a126
SHA5121da8336997cca12183c129ee43d3cc93d74b8c15412a28f1f4efe23de92e095bae0900d51ac2fd3675d8a1327c249fad8d538b62b4b75eeeeac2c760d4faaa3a
-
Filesize
206KB
MD5b1851b4dc46bd2514fa38f0e31704354
SHA1154bc24f298a9dc802b15ee225402bb61341447b
SHA25618c030dde303df0ab47088c51868c057104fbf16f7ac5c9dc6ecafcae8f8eac0
SHA5125f6b44a69871fe09e6a94a9231865b9e31b3c03e0b6c63f8b5c7fd2a6ff92c48aa67ea7d62397cf16e763c25c55aa034647396b2711941e328aba8b69bbc4e39