Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
01/06/2024, 02:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
89eb2618a5fbf066e53f8d1e05f7ed10_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
89eb2618a5fbf066e53f8d1e05f7ed10_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 89eb2618a5fbf066e53f8d1e05f7ed10_NeikiAnalytics.exe
- Size 206KB
- Sample240601-cwr4bsef5v
- SHA256 26493f5da950d88171037dc80abe475b1d116858f7cd5abb7d5776c54ab0e47f
- MD5 89eb2618a5fbf066e53f8d1e05f7ed10
- SHA1 825f69580fca9f5553e11b81c7d62f0eecaea47e
- SHA512 164abcf2d630d63d6149615c5f9e37ee38d3263d3bde7da153ed4b67e8d8265d1c7f636d9677943e0010671cd9c75eb356efb787f5e9781f6257081c299be035
- SSDEEP 3072:zvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6un4K:zvEN2U+T6i5LirrllHy4HUcMQY65K
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Modifies Installed Components in the registry 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe - Executes dropped EXE 4 IoCs
pid Process 1448 explorer.exe 768 spoolsv.exe 4564 svchost.exe 3716 spoolsv.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe 89eb2618a5fbf066e53f8d1e05f7ed10_NeikiAnalytics.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2348 89eb2618a5fbf066e53f8d1e05f7ed10_NeikiAnalytics.exe 2348 89eb2618a5fbf066e53f8d1e05f7ed10_NeikiAnalytics.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 1448 explorer.exe 4564 svchost.exe 4564 svchost.exe 4564 svchost.exe 4564 svchost.exe 1448 explorer.exe 1448 explorer.exe 4564 svchost.exe 4564 svchost.exe 1448 explorer.exe 1448 explorer.exe 4564 svchost.exe 4564 svchost.exe 1448 explorer.exe 1448 explorer.exe 4564 svchost.exe 4564 svchost.exe 1448 explorer.exe 1448 explorer.exe 4564 svchost.exe 4564 svchost.exe 1448 explorer.exe 1448 explorer.exe 4564 svchost.exe 4564 svchost.exe 1448 explorer.exe 1448 explorer.exe 4564 svchost.exe 4564 svchost.exe 1448 explorer.exe 1448 explorer.exe 4564 svchost.exe 4564 svchost.exe 1448 explorer.exe 1448 explorer.exe 4564 svchost.exe 4564 svchost.exe 1448 explorer.exe 1448 explorer.exe 4564 svchost.exe 4564 svchost.exe 1448 explorer.exe 1448 explorer.exe 4564 svchost.exe 4564 svchost.exe 1448 explorer.exe 1448 explorer.exe 4564 svchost.exe 4564 svchost.exe 1448 explorer.exe 1448 explorer.exe 4564 svchost.exe 4564 svchost.exe 1448 explorer.exe 1448 explorer.exe 4564 svchost.exe 4564 svchost.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1448 explorer.exe 4564 svchost.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2348 89eb2618a5fbf066e53f8d1e05f7ed10_NeikiAnalytics.exe 2348 89eb2618a5fbf066e53f8d1e05f7ed10_NeikiAnalytics.exe 1448 explorer.exe 1448 explorer.exe 768 spoolsv.exe 768 spoolsv.exe 4564 svchost.exe 4564 svchost.exe 3716 spoolsv.exe 3716 spoolsv.exe 1448 explorer.exe 1448 explorer.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2348 wrote to memory of 1448 2348 89eb2618a5fbf066e53f8d1e05f7ed10_NeikiAnalytics.exe 82 PID 2348 wrote to memory of 1448 2348 89eb2618a5fbf066e53f8d1e05f7ed10_NeikiAnalytics.exe 82 PID 2348 wrote to memory of 1448 2348 89eb2618a5fbf066e53f8d1e05f7ed10_NeikiAnalytics.exe 82 PID 1448 wrote to memory of 768 1448 explorer.exe 83 PID 1448 wrote to memory of 768 1448 explorer.exe 83 PID 1448 wrote to memory of 768 1448 explorer.exe 83 PID 768 wrote to memory of 4564 768 spoolsv.exe 84 PID 768 wrote to memory of 4564 768 spoolsv.exe 84 PID 768 wrote to memory of 4564 768 spoolsv.exe 84 PID 4564 wrote to memory of 3716 4564 svchost.exe 85 PID 4564 wrote to memory of 3716 4564 svchost.exe 85 PID 4564 wrote to memory of 3716 4564 svchost.exe 85 PID 4564 wrote to memory of 4664 4564 svchost.exe 86 PID 4564 wrote to memory of 4664 4564 svchost.exe 86 PID 4564 wrote to memory of 4664 4564 svchost.exe 86 PID 4564 wrote to memory of 1784 4564 svchost.exe 103 PID 4564 wrote to memory of 1784 4564 svchost.exe 103 PID 4564 wrote to memory of 1784 4564 svchost.exe 103 PID 4564 wrote to memory of 4812 4564 svchost.exe 112 PID 4564 wrote to memory of 4812 4564 svchost.exe 112 PID 4564 wrote to memory of 4812 4564 svchost.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\89eb2618a5fbf066e53f8d1e05f7ed10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\89eb2618a5fbf066e53f8d1e05f7ed10_NeikiAnalytics.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3716
-
-
C:\Windows\SysWOW64\at.exeat 02:27 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:4664
-
-
C:\Windows\SysWOW64\at.exeat 02:28 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:1784
-
-
C:\Windows\SysWOW64\at.exeat 02:29 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:4812
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\mrsys.exe
- Size 207KB
- SHA256 8b77169e59e1bf8f89a72bc7027d6d2b58a3f283cf5ff5bd04d84a1db057a79a
- MD5 a5dff7f6b4cfa2b9003abf44b66c9226
- SHA1 358e7bd4c0345168b517729107c6af24e570667e
- SHA512 7072598d4114191a3a454f7a45e44fe58dfc04930a4d164bb52d59d14b406793615aed268619aca59de9d7370d4df78ee3a4d0503d18579724cf62270818a4cc
- SSDEEP 3072:zvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6un4Y:zvEN2U+T6i5LirrllHy4HUcMQY65Y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\explorer.exe
- Size 207KB
- SHA256 018357fe718a9cbdd9930f0cde426a3c40dd3f3a8b560b379ca3fcb27b11be34
- MD5 e665b57d83001124252be1f56f3c5bd3
- SHA1 663819ca75e154bd8b3923c1931bd38caf77a881
- SHA512 b5dd4970d337b28c9f3a8dcc29def7a07312b81850162e07abc278740354827cdaf474cf36d03ede8207050b9c724c4ce182b55070fe8e77e742c0f0d0c6f0d6
- SSDEEP 3072:zvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6un47:zvEN2U+T6i5LirrllHy4HUcMQY657
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\spoolsv.exe
- Size 206KB
- SHA256 642ec23077b3b113584c12cd373a7d4e16cd053fbc7f34ee2233127b85d4f91f
- MD5 b10e905c25113c69ecee8867ea182055
- SHA1 6eb6dad41d0835bd1f6aac1963bb26fd92a775bd
- SHA512 ae1a184c045481a514ccfa37fec053723f27d4f67dd27f5d33d55cb8ea3552357ff5a0ff661511302204027afd3a9682c8cbad31507091de6ab4c33b449d0ed1
- SSDEEP 3072:zvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6un4O:zvEN2U+T6i5LirrllHy4HUcMQY65O
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\svchost.exe
- Size 206KB
- SHA256 3b9f7934f0ba8fd68ee15bc58d38a65364b14a3bd9be135d90f86c221e1cbc75
- MD5 c6980bd8f14b416eef16f5c5dac829aa
- SHA1 d4ad529a134172c374118148d756eec1dece06ab
- SHA512 7ccb2f07e43089d07fc5ab2272ff9faf3e886f36b4cf8427d98b89703d510d6d1dec16ca6918985cd4d9c5601a9b42973c1f4c57f9389615a75d4c71c7e948e1
- SSDEEP 3072:zvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6un4I:zvEN2U+T6i5LirrllHy4HUcMQY65I
- MD5 SHA1 SHA512 SSDEEP