Analysis
- max time kernel
150s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
26/05/2024, 17:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1703168cfefc2fa901dc749d2638a100_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
1703168cfefc2fa901dc749d2638a100_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 1703168cfefc2fa901dc749d2638a100_NeikiAnalytics.exe
- Size 206KB
- Sample240526-vqaafadf5w
- SHA256 527710f46af7fbe920d0ad6aa7eaa334cccdec81b7144f7e9584ef6e7ff50ff9
- MD5 1703168cfefc2fa901dc749d2638a100
- SHA1 77e774ce6bb7f0ecc143d211e8c89f79b7fbccd5
- SHA512 12e7e7b6d6c0b9cdeb57acb2be293f54841ca7b632d4fc96e3ce2989fc1398317712753fff9ba1ff3cccfd17e61bd6fbf2548ddf3b4c7679e6cabe2bf0c5cc9b
- SSDEEP 3072:zvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6un5V:zvEN2U+T6i5LirrllHy4HUcMQY6O
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Modifies Installed Components in the registry 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe - Executes dropped EXE 4 IoCs
pid Process 3888 explorer.exe 3556 spoolsv.exe 2384 svchost.exe 3252 spoolsv.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe 1703168cfefc2fa901dc749d2638a100_NeikiAnalytics.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2068 1703168cfefc2fa901dc749d2638a100_NeikiAnalytics.exe 2068 1703168cfefc2fa901dc749d2638a100_NeikiAnalytics.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 3888 explorer.exe 2384 svchost.exe 2384 svchost.exe 2384 svchost.exe 2384 svchost.exe 3888 explorer.exe 3888 explorer.exe 2384 svchost.exe 2384 svchost.exe 3888 explorer.exe 3888 explorer.exe 2384 svchost.exe 2384 svchost.exe 3888 explorer.exe 3888 explorer.exe 2384 svchost.exe 2384 svchost.exe 3888 explorer.exe 3888 explorer.exe 2384 svchost.exe 2384 svchost.exe 3888 explorer.exe 3888 explorer.exe 2384 svchost.exe 2384 svchost.exe 3888 explorer.exe 3888 explorer.exe 2384 svchost.exe 2384 svchost.exe 3888 explorer.exe 3888 explorer.exe 2384 svchost.exe 2384 svchost.exe 3888 explorer.exe 3888 explorer.exe 2384 svchost.exe 2384 svchost.exe 3888 explorer.exe 3888 explorer.exe 2384 svchost.exe 2384 svchost.exe 3888 explorer.exe 3888 explorer.exe 2384 svchost.exe 2384 svchost.exe 3888 explorer.exe 3888 explorer.exe 2384 svchost.exe 2384 svchost.exe 3888 explorer.exe 3888 explorer.exe 2384 svchost.exe 2384 svchost.exe 3888 explorer.exe 3888 explorer.exe 2384 svchost.exe 2384 svchost.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 3888 explorer.exe 2384 svchost.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2068 1703168cfefc2fa901dc749d2638a100_NeikiAnalytics.exe 2068 1703168cfefc2fa901dc749d2638a100_NeikiAnalytics.exe 3888 explorer.exe 3888 explorer.exe 3556 spoolsv.exe 3556 spoolsv.exe 2384 svchost.exe 2384 svchost.exe 3252 spoolsv.exe 3252 spoolsv.exe 3888 explorer.exe 3888 explorer.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2068 wrote to memory of 3888 2068 1703168cfefc2fa901dc749d2638a100_NeikiAnalytics.exe 84 PID 2068 wrote to memory of 3888 2068 1703168cfefc2fa901dc749d2638a100_NeikiAnalytics.exe 84 PID 2068 wrote to memory of 3888 2068 1703168cfefc2fa901dc749d2638a100_NeikiAnalytics.exe 84 PID 3888 wrote to memory of 3556 3888 explorer.exe 85 PID 3888 wrote to memory of 3556 3888 explorer.exe 85 PID 3888 wrote to memory of 3556 3888 explorer.exe 85 PID 3556 wrote to memory of 2384 3556 spoolsv.exe 86 PID 3556 wrote to memory of 2384 3556 spoolsv.exe 86 PID 3556 wrote to memory of 2384 3556 spoolsv.exe 86 PID 2384 wrote to memory of 3252 2384 svchost.exe 88 PID 2384 wrote to memory of 3252 2384 svchost.exe 88 PID 2384 wrote to memory of 3252 2384 svchost.exe 88 PID 2384 wrote to memory of 2796 2384 svchost.exe 89 PID 2384 wrote to memory of 2796 2384 svchost.exe 89 PID 2384 wrote to memory of 2796 2384 svchost.exe 89 PID 2384 wrote to memory of 3476 2384 svchost.exe 102 PID 2384 wrote to memory of 3476 2384 svchost.exe 102 PID 2384 wrote to memory of 3476 2384 svchost.exe 102 PID 2384 wrote to memory of 4400 2384 svchost.exe 104 PID 2384 wrote to memory of 4400 2384 svchost.exe 104 PID 2384 wrote to memory of 4400 2384 svchost.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\1703168cfefc2fa901dc749d2638a100_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1703168cfefc2fa901dc749d2638a100_NeikiAnalytics.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3888 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3556 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3252
-
-
C:\Windows\SysWOW64\at.exeat 17:13 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:2796
-
-
C:\Windows\SysWOW64\at.exeat 17:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:3476
-
-
C:\Windows\SysWOW64\at.exeat 17:15 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:4400
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\mrsys.exe
- Size 207KB
- SHA256 394ec478a8ccde1495b4beace3f97282390ab1ad97cfa80fa074ebbd430ff6d6
- MD5 a82dd34bc53c31244ff2c84d096ca685
- SHA1 1531a080f36b0e884d70c863d3b40271e653d1f0
- SHA512 acdebd653b7f768cbbbc95a49b7812794a7a2875fa77ed51ed22e9b0ffb4a863a393932ab1feec4e9f33fc9c5fcef84f97fbdb5f872ed365e2e0dd4c282d7bbb
- SSDEEP 3072:zvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6un5Q:zvEN2U+T6i5LirrllHy4HUcMQY6F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\explorer.exe
- Size 206KB
- SHA256 3c7c15bdc0e83bcb5d5167bcaf864df97ca984c0421345e0ef119c512b88e3ba
- MD5 c42a6adc777b3488c0ef12b9162940c9
- SHA1 2f2a505a5f12921eff3f54ce0ea4bfb081cea7d7
- SHA512 44de013ab89fd3d12ff917228db3513e0cc50c870eeef875da491cda5e52851e9dc06c1701b3dfd71c0e2ef8e3714edd314e97a6ebbf0db0945ba157b14ed86c
- SSDEEP 3072:zvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6un5T:zvEN2U+T6i5LirrllHy4HUcMQY6u
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\spoolsv.exe
- Size 206KB
- SHA256 f92095cf7e52cc405715612c08d3762c6c7ee417105f0a39c2f4771491fa8d3a
- MD5 7bf728615941f652566b557aac19e260
- SHA1 42e37bdb9a75f8638e3fe7621abe2eb94a25dc5c
- SHA512 200305539912f2e0763829f4c2fcaa1290774a1c4c05ad06b0077ffed87b01a54da90169f027bea2252d87aa7b32cf91b9cf19f40f25a085d9181b06ecbcb7b4
- SSDEEP 3072:zvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6un5z:zvEN2U+T6i5LirrllHy4HUcMQY6G
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\svchost.exe
- Size 206KB
- SHA256 dd9bb950675c871d65d4186b04f9c10c6b20a95e4f076532ec3cb594c902049f
- MD5 c798aa19882b81a29a8a645762940b1c
- SHA1 a15d340f612fd1c546198965082fc74ad654d9ea
- SHA512 6a77433cbcffea90b5ba6ce41571ee5f989829ca223f24d3db7c8541283b12dc3fbf4e844227c5f7281b813f6b46676b227dacc85d7dbf66d361ea69fd69c790
- SSDEEP 3072:zvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6un5h:zvEN2U+T6i5LirrllHy4HUcMQY6w
- MD5 SHA1 SHA512 SSDEEP