f6397e60575b7cbf356aefe51a043c7e711d577cbfa30e9f47ac890ae29af46f

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 19:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d90f7a8f324b5066c91e22253ee5b650_NeikiAnalytics.exe
Size

211KB
MD5

d90f7a8f324b5066c91e22253ee5b650
SHA1

21fd4bdf7c9e43cd7843456c5d5ed0c7ec69fa12
SHA256

f6397e60575b7cbf356aefe51a043c7e711d577cbfa30e9f47ac890ae29af46f
SHA512

e9ef2d384a0b6b605e40f77f015f2afbe12a6218a0b985abf6b4a126354711ebdf742ceedb771f0b611e91faea6df022b99f5b6bfebd64062b25c4d535298118
SSDEEP

3072:JD6Xtx68yygRBE52mxkEOHLRMpZ4deth8PEAjAfIbAYGPhz6sPJBInxZqOy:Jh8cBzHLRMpZ4d1Zy

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\userinit.exe"	userinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\userinit.exe"	swchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	userinit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	swchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\mrsys.exe MR"	swchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	swchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	userinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\mrsys.exe MR"	userinit.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	swchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\mrsys.exe MR"	swchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	swchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	swchost.exe

Executes dropped EXE 4 IoCs

pid	Process
4188	userinit.exe
1496	spoolsw.exe
3456	swchost.exe
1848	spoolsw.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\userinit = "c:\\windows\\userinit.exe RO"	userinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Swchost = "c:\\windows\\swchost.exe RO"	userinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\userinit = "c:\\windows\\userinit.exe RO"	swchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Swchost = "c:\\windows\\swchost.exe RO"	swchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\system\udsys.exe	userinit.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\spoolsw.exe	userinit.exe
File opened for modification	\??\c:\windows\swchost.exe	spoolsw.exe
File opened for modification	\??\c:\windows\userinit.exe	userinit.exe
File opened for modification	\??\c:\windows\swchost.exe	swchost.exe
File opened for modification	\??\c:\windows\userinit.exe	d90f7a8f324b5066c91e22253ee5b650_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1540	d90f7a8f324b5066c91e22253ee5b650_NeikiAnalytics.exe
1540	d90f7a8f324b5066c91e22253ee5b650_NeikiAnalytics.exe
4188	userinit.exe
4188	userinit.exe
4188	userinit.exe
4188	userinit.exe
4188	userinit.exe
4188	userinit.exe
3456	swchost.exe
3456	swchost.exe
3456	swchost.exe
3456	swchost.exe
4188	userinit.exe
4188	userinit.exe
3456	swchost.exe
3456	swchost.exe
4188	userinit.exe
4188	userinit.exe
3456	swchost.exe
3456	swchost.exe
4188	userinit.exe
4188	userinit.exe
3456	swchost.exe
3456	swchost.exe
4188	userinit.exe
4188	userinit.exe
3456	swchost.exe
3456	swchost.exe
4188	userinit.exe
4188	userinit.exe
3456	swchost.exe
3456	swchost.exe
4188	userinit.exe
4188	userinit.exe
3456	swchost.exe
3456	swchost.exe
4188	userinit.exe
4188	userinit.exe
3456	swchost.exe
3456	swchost.exe
4188	userinit.exe
4188	userinit.exe
3456	swchost.exe
3456	swchost.exe
4188	userinit.exe
4188	userinit.exe
3456	swchost.exe
3456	swchost.exe
4188	userinit.exe
4188	userinit.exe
3456	swchost.exe
3456	swchost.exe
4188	userinit.exe
4188	userinit.exe
3456	swchost.exe
3456	swchost.exe
4188	userinit.exe
4188	userinit.exe
3456	swchost.exe
3456	swchost.exe
4188	userinit.exe
4188	userinit.exe
3456	swchost.exe
3456	swchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4188	userinit.exe
3456	swchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1540	d90f7a8f324b5066c91e22253ee5b650_NeikiAnalytics.exe
1540	d90f7a8f324b5066c91e22253ee5b650_NeikiAnalytics.exe
4188	userinit.exe
4188	userinit.exe
1496	spoolsw.exe
1496	spoolsw.exe
3456	swchost.exe
3456	swchost.exe
1848	spoolsw.exe
1848	spoolsw.exe
4188	userinit.exe
4188	userinit.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 4188	1540	d90f7a8f324b5066c91e22253ee5b650_NeikiAnalytics.exe	83
PID 1540 wrote to memory of 4188	1540	d90f7a8f324b5066c91e22253ee5b650_NeikiAnalytics.exe	83
PID 1540 wrote to memory of 4188	1540	d90f7a8f324b5066c91e22253ee5b650_NeikiAnalytics.exe	83
PID 4188 wrote to memory of 1496	4188	userinit.exe	84
PID 4188 wrote to memory of 1496	4188	userinit.exe	84
PID 4188 wrote to memory of 1496	4188	userinit.exe	84
PID 1496 wrote to memory of 3456	1496	spoolsw.exe	85
PID 1496 wrote to memory of 3456	1496	spoolsw.exe	85
PID 1496 wrote to memory of 3456	1496	spoolsw.exe	85
PID 3456 wrote to memory of 1848	3456	swchost.exe	86
PID 3456 wrote to memory of 1848	3456	swchost.exe	86
PID 3456 wrote to memory of 1848	3456	swchost.exe	86

C:\Users\Admin\AppData\Local\Temp\d90f7a8f324b5066c91e22253ee5b650_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\d90f7a8f324b5066c91e22253ee5b650_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1540
- \??\c:\windows\userinit.exe
  c:\windows\userinit.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4188
- - \??\c:\windows\spoolsw.exe
    c:\windows\spoolsw.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1496
  - - \??\c:\windows\swchost.exe
      c:\windows\swchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3456
    - - \??\c:\windows\spoolsw.exe
        
        c:\windows\spoolsw.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\mrsys.exe

Filesize
211KB

MD5
47ad335158ea604089e6a09d32fdbba6

SHA1
fb038c19b718e42585f26df25a49ab0b1d66d28e

SHA256
cc314b9e8302937a767409f15e209bf4a2c5f5945bed6b65e82d6759c74ffc7b

SHA512
3a4ee30dc7d5191aa7dadc2bbba5926f6a0f5beaf9b43ccb3804c0b74261d4c2eb7c1d5be23aaa97d0d11e2411950655bdd0fa906328a31c594fbd68409f81f9

Download Submit
C:\Windows\spoolsw.exe

Filesize
211KB

MD5
3596e0171b7c1d93ba35d921ae0bd51c

SHA1
c60b918369683542103c7325b39275144d060313

SHA256
5966313ac03b78f9f66d66151b361b17cba1a0a3bcb5bfdf92d4c1a4fe7991b2

SHA512
9d251550c2c86c67de20707883aae19c0430398aa6ad965600105d200381d933ea13b7273b78e10d4153b4d659cda0bd41ab7a7aa9872a2f6e1206133b5bdb08

Download Submit
C:\Windows\swchost.exe

Filesize
211KB

MD5
c9a9ca0f465869c9940e1e34ee3a57dd

SHA1
4a6a5735d711466145d8c19761cd72b0ff936aa4

SHA256
d12876c8d25ee8f936c40bd57b64d58fcf30acc1b4d195724a7eaf03b169c067

SHA512
d80f618360038cb18c27e345360a43cb1c3a3ca3df618e79c4acbbab6566eb280b25ad9edf518638ccfc0b1d41376750daeb68d4cd1f075c0f95228f4b59eaef

Download Submit
C:\Windows\userinit.exe

Filesize
211KB

MD5
c3ccc3652837061bc69d5dd9eb31bc19

SHA1
33a8a88d2dfaa9157b81fbeccbb27b7930e5c315

SHA256
adc8a379d48a1a2b294d1d1d7bd4a25bab0cd5496bf16e01da331371a5cbe552

SHA512
5b1cc7714caf1c14cda964aaf536fad17f78acd9f51177874d2cfcb8204b536cad6bc64f2f16f9a9cb13a2d2c8c5f3ccb54655b6c856be4bc38a871c74a2875e

Download Submit