Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 15:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0f7f8f1048960ecd16351e8d75ae3750_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
0f7f8f1048960ecd16351e8d75ae3750_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
0f7f8f1048960ecd16351e8d75ae3750_NeikiAnalytics.exe
-
Size
206KB
-
MD5
0f7f8f1048960ecd16351e8d75ae3750
-
SHA1
8a3f6de879d603888e0fc20ab29b03a668068155
-
SHA256
65eae3efb9deb63c50ea7c2bfc1eaf9a90f9bd7b36d8b68b42ea75eacbfa5966
-
SHA512
8c7021d5ba45632339b222a3b030e9538d406daf0721b5e1c195fb4af9340ea5bd7d38c67da5e63b69c9fadbe2bf49df77b4d599283be1844da1aac10c8f754b
-
SSDEEP
3072:zvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unXJ:zvEN2U+T6i5LirrllHy4HUcMQY6WJ
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
Modifies Installed Components in the registry 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe -
Executes dropped EXE 4 IoCs
pid Process 2280 explorer.exe 4600 spoolsv.exe 4208 svchost.exe 5112 spoolsv.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe 0f7f8f1048960ecd16351e8d75ae3750_NeikiAnalytics.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1140 0f7f8f1048960ecd16351e8d75ae3750_NeikiAnalytics.exe 1140 0f7f8f1048960ecd16351e8d75ae3750_NeikiAnalytics.exe 2280 explorer.exe 2280 explorer.exe 2280 explorer.exe 2280 explorer.exe 2280 explorer.exe 2280 explorer.exe 4208 svchost.exe 4208 svchost.exe 4208 svchost.exe 4208 svchost.exe 2280 explorer.exe 2280 explorer.exe 4208 svchost.exe 4208 svchost.exe 2280 explorer.exe 2280 explorer.exe 4208 svchost.exe 4208 svchost.exe 2280 explorer.exe 2280 explorer.exe 4208 svchost.exe 4208 svchost.exe 2280 explorer.exe 2280 explorer.exe 4208 svchost.exe 4208 svchost.exe 2280 explorer.exe 2280 explorer.exe 4208 svchost.exe 4208 svchost.exe 2280 explorer.exe 2280 explorer.exe 4208 svchost.exe 4208 svchost.exe 2280 explorer.exe 2280 explorer.exe 4208 svchost.exe 4208 svchost.exe 2280 explorer.exe 2280 explorer.exe 4208 svchost.exe 4208 svchost.exe 2280 explorer.exe 2280 explorer.exe 4208 svchost.exe 4208 svchost.exe 2280 explorer.exe 2280 explorer.exe 4208 svchost.exe 4208 svchost.exe 2280 explorer.exe 2280 explorer.exe 4208 svchost.exe 4208 svchost.exe 2280 explorer.exe 2280 explorer.exe 4208 svchost.exe 4208 svchost.exe 2280 explorer.exe 2280 explorer.exe 4208 svchost.exe 4208 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2280 explorer.exe 4208 svchost.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 1140 0f7f8f1048960ecd16351e8d75ae3750_NeikiAnalytics.exe 1140 0f7f8f1048960ecd16351e8d75ae3750_NeikiAnalytics.exe 2280 explorer.exe 2280 explorer.exe 4600 spoolsv.exe 4600 spoolsv.exe 4208 svchost.exe 4208 svchost.exe 5112 spoolsv.exe 5112 spoolsv.exe 2280 explorer.exe 2280 explorer.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1140 wrote to memory of 2280 1140 0f7f8f1048960ecd16351e8d75ae3750_NeikiAnalytics.exe 83 PID 1140 wrote to memory of 2280 1140 0f7f8f1048960ecd16351e8d75ae3750_NeikiAnalytics.exe 83 PID 1140 wrote to memory of 2280 1140 0f7f8f1048960ecd16351e8d75ae3750_NeikiAnalytics.exe 83 PID 2280 wrote to memory of 4600 2280 explorer.exe 85 PID 2280 wrote to memory of 4600 2280 explorer.exe 85 PID 2280 wrote to memory of 4600 2280 explorer.exe 85 PID 4600 wrote to memory of 4208 4600 spoolsv.exe 86 PID 4600 wrote to memory of 4208 4600 spoolsv.exe 86 PID 4600 wrote to memory of 4208 4600 spoolsv.exe 86 PID 4208 wrote to memory of 5112 4208 svchost.exe 87 PID 4208 wrote to memory of 5112 4208 svchost.exe 87 PID 4208 wrote to memory of 5112 4208 svchost.exe 87 PID 4208 wrote to memory of 3512 4208 svchost.exe 88 PID 4208 wrote to memory of 3512 4208 svchost.exe 88 PID 4208 wrote to memory of 3512 4208 svchost.exe 88 PID 4208 wrote to memory of 4064 4208 svchost.exe 97 PID 4208 wrote to memory of 4064 4208 svchost.exe 97 PID 4208 wrote to memory of 4064 4208 svchost.exe 97 PID 4208 wrote to memory of 1796 4208 svchost.exe 100 PID 4208 wrote to memory of 1796 4208 svchost.exe 100 PID 4208 wrote to memory of 1796 4208 svchost.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f7f8f1048960ecd16351e8d75ae3750_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0f7f8f1048960ecd16351e8d75ae3750_NeikiAnalytics.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1140 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4600 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4208 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5112
-
-
C:\Windows\SysWOW64\at.exeat 15:28 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:3512
-
-
C:\Windows\SysWOW64\at.exeat 15:29 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:4064
-
-
C:\Windows\SysWOW64\at.exeat 15:30 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:1796
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
206KB
MD50358107c5e5df474baaa999d3308954d
SHA1b3617258bfb59bd1217fb091d2f4a279e4742183
SHA2564d4a3b88843d5853010abf8d291deea79b8f6db29b8b98520c3509e58fd9f31d
SHA512c7f87b07cfe728902085e1519b7c7feb4dbd49abdd997ac6faa2c1b13d9272fcc31dcce18b6a6e97e9d69be5f51e24a218a4c514457ed77522939a5040daac59
-
Filesize
206KB
MD5a8a4047a7036dc8498f198f2d82791d1
SHA1a689e68922566c0efab95399e833829820ecb02b
SHA2569ba3ddc5ccc0655867cbd0346b3f19d41b5bde8bd7e95295a2bdbe656d53b7a3
SHA512e4b869efc2f54bf41307b0dcfef3b06c19643c71df00ca8b04d6fdfe4e1f31809600390abf3561e51dd9ff1497e925b33afb6e47505e122cac4b127e435f1b94
-
Filesize
206KB
MD5b21d0c2dd79bddf29a7910db39f3dc1b
SHA14204858a56ba45e3051f79aaa734a3d9760d81ed
SHA2565cf701c3658f3dcb925210771b8f937b1adf9341fe2c9e7418bbe4b8fdbe2b50
SHA5129edca68cdaef8f60548244e031dc5ed593d637d5aa405c019c9102cbd87cde709097c0cbda16917005aae87a9d24122a5e188182075eacd09c308e3932b960a1
-
Filesize
207KB
MD5b76d94e7560b9f7b5d3030926b37ef83
SHA1910bc6a5a15420207bf67eac925726ef302828d3
SHA2563f1c48af0dc5f4c74d2cbe530dfe828ee89e776e5c04e706955b1889c934c8cd
SHA512b7bf077c1ccc6b4af44c2bb32fc9d140dffdd871000c9d7a161e58ccd27df20cab2ceaee010679a693f4f2cf2d4405e867f41bea0c7a5e1f3746686272d136c8