Analysis
- max time kernel
150s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
01/06/2024, 02:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8a9c1f06ef61bc056a8650b0a03f1140_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
8a9c1f06ef61bc056a8650b0a03f1140_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target 8a9c1f06ef61bc056a8650b0a03f1140_NeikiAnalytics.exe
- Size 211KB
- Sample240601-da4qnsfc61
- SHA256 f3aac4809003e6da70c19e6180d66e638ddf5e13f351744e5d674efbd853ac0e
- MD5 8a9c1f06ef61bc056a8650b0a03f1140
- SHA1 e706a1843d630d35de7cce23491d0e8fc396f950
- SHA512 9bc319e4a77d6f30b1c761cbeee5511f4f1cb4231ef102d824c41c828efc07e10bae28dda46998810c20a36480355563fc836c2caea6f7913af2f2cf30fbf4fa
- SSDEEP 3072:JD6Xtx68yygRBE52mxkEOHLRMpZ4deth8PEAjAfIbAYGPhz6sPJBInxZqOI:Jh8cBzHLRMpZ4d1ZI
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\userinit.exe" userinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\userinit.exe" swchost.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" swchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" userinit.exe - Modifies Installed Components in the registry 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\mrsys.exe MR" swchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} swchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} userinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\mrsys.exe MR" userinit.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} swchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\mrsys.exe MR" swchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} swchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} swchost.exe - Executes dropped EXE 4 IoCs
pid Process 712 userinit.exe 1040 spoolsw.exe 1748 swchost.exe 2020 spoolsw.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\userinit = "c:\\windows\\userinit.exe RO" userinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Swchost = "c:\\windows\\swchost.exe RO" userinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\userinit = "c:\\windows\\userinit.exe RO" swchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Swchost = "c:\\windows\\swchost.exe RO" swchost.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\system\udsys.exe userinit.exe - Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification \??\c:\windows\swchost.exe swchost.exe File opened for modification \??\c:\windows\userinit.exe 8a9c1f06ef61bc056a8650b0a03f1140_NeikiAnalytics.exe File opened for modification \??\c:\windows\spoolsw.exe userinit.exe File opened for modification \??\c:\windows\swchost.exe spoolsw.exe File opened for modification \??\c:\windows\userinit.exe userinit.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 664 8a9c1f06ef61bc056a8650b0a03f1140_NeikiAnalytics.exe 664 8a9c1f06ef61bc056a8650b0a03f1140_NeikiAnalytics.exe 712 userinit.exe 712 userinit.exe 712 userinit.exe 712 userinit.exe 712 userinit.exe 712 userinit.exe 1748 swchost.exe 1748 swchost.exe 1748 swchost.exe 1748 swchost.exe 712 userinit.exe 712 userinit.exe 1748 swchost.exe 1748 swchost.exe 712 userinit.exe 712 userinit.exe 1748 swchost.exe 1748 swchost.exe 712 userinit.exe 712 userinit.exe 1748 swchost.exe 1748 swchost.exe 712 userinit.exe 712 userinit.exe 1748 swchost.exe 1748 swchost.exe 712 userinit.exe 712 userinit.exe 1748 swchost.exe 1748 swchost.exe 712 userinit.exe 712 userinit.exe 1748 swchost.exe 1748 swchost.exe 712 userinit.exe 712 userinit.exe 1748 swchost.exe 1748 swchost.exe 712 userinit.exe 712 userinit.exe 1748 swchost.exe 1748 swchost.exe 712 userinit.exe 712 userinit.exe 1748 swchost.exe 1748 swchost.exe 712 userinit.exe 712 userinit.exe 1748 swchost.exe 1748 swchost.exe 712 userinit.exe 712 userinit.exe 1748 swchost.exe 1748 swchost.exe 712 userinit.exe 712 userinit.exe 1748 swchost.exe 1748 swchost.exe 712 userinit.exe 712 userinit.exe 1748 swchost.exe 1748 swchost.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 712 userinit.exe 1748 swchost.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 664 8a9c1f06ef61bc056a8650b0a03f1140_NeikiAnalytics.exe 664 8a9c1f06ef61bc056a8650b0a03f1140_NeikiAnalytics.exe 712 userinit.exe 712 userinit.exe 1040 spoolsw.exe 1040 spoolsw.exe 1748 swchost.exe 1748 swchost.exe 2020 spoolsw.exe 2020 spoolsw.exe 712 userinit.exe 712 userinit.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 664 wrote to memory of 712 664 8a9c1f06ef61bc056a8650b0a03f1140_NeikiAnalytics.exe 83 PID 664 wrote to memory of 712 664 8a9c1f06ef61bc056a8650b0a03f1140_NeikiAnalytics.exe 83 PID 664 wrote to memory of 712 664 8a9c1f06ef61bc056a8650b0a03f1140_NeikiAnalytics.exe 83 PID 712 wrote to memory of 1040 712 userinit.exe 84 PID 712 wrote to memory of 1040 712 userinit.exe 84 PID 712 wrote to memory of 1040 712 userinit.exe 84 PID 1040 wrote to memory of 1748 1040 spoolsw.exe 86 PID 1040 wrote to memory of 1748 1040 spoolsw.exe 86 PID 1040 wrote to memory of 1748 1040 spoolsw.exe 86 PID 1748 wrote to memory of 2020 1748 swchost.exe 87 PID 1748 wrote to memory of 2020 1748 swchost.exe 87 PID 1748 wrote to memory of 2020 1748 swchost.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a9c1f06ef61bc056a8650b0a03f1140_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8a9c1f06ef61bc056a8650b0a03f1140_NeikiAnalytics.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:664 -
\??\c:\windows\userinit.exec:\windows\userinit.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:712 -
\??\c:\windows\spoolsw.exec:\windows\spoolsw.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\windows\swchost.exec:\windows\swchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\windows\spoolsw.exec:\windows\spoolsw.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2020
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\mrsys.exe
- Size 211KB
- SHA256 0e72131a9052f8a9af4b85105fdd8dfc9fa97bd922247acec6fd1d7914b4ee73
- MD5 c16de8007a747c59800d6220166d645a
- SHA1 a51dc83fd800a106156b4872ceb7e2a16a2c5974
- SHA512 fd1eaf9548efd7296e528df0cb60e2c8d474aa8be71d31479b33f225a6ffba2a148fa0be43d66bd96ca1ba1d5b0825becef8d361375873692dde200d49685603
- SSDEEP 3072:JD6Xtx68yygRBE52mxkEOHLRMpZ4deth8PEAjAfIbAYGPhz6sPJBInxZqOX:Jh8cBzHLRMpZ4d1ZX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\spoolsw.exe
- Size 211KB
- SHA256 13119353c6a149da5382dd73d0a0e15614c4b649087adcaeb2695c5e861c9536
- MD5 124d6c3bcaf1e7f35a717d8a510abab0
- SHA1 43511238ef7bc700caae5f5b7dd8d09e53e05403
- SHA512 e66b5dd7b02e227a55ad385ef9399065bbacb431b5523b50c12922030c390a6bc715cd8ece3c45940ca3654cf1f19efc4024d016521d528b571119942cfc95f0
- SSDEEP 3072:JD6Xtx68yygRBE52mxkEOHLRMpZ4deth8PEAjAfIbAYGPhz6sPJBInxZqOI:Jh8cBzHLRMpZ4d1ZI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\swchost.exe
- Size 211KB
- SHA256 311ddb60279c08a91600809a702dedb296d8b635a295354ff1099b3eaef431ee
- MD5 d58dbfdf546a7c6de9b88328c893870f
- SHA1 481081aad9ae07a2c3b3ac9550d9c5eec89c24c0
- SHA512 8701fe68fe0dd2c154feb21b1b784e5ea01316e58352041802d300d6a36d4db3f7088f26f4d3474c3b5d2985eb2e269e3ee5fa531c304da2e514568aa678471c
- SSDEEP 3072:JD6Xtx68yygRBE52mxkEOHLRMpZ4deth8PEAjAfIbAYGPhz6sPJBInxZqOn:Jh8cBzHLRMpZ4d1Zn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\userinit.exe
- Size 211KB
- SHA256 011a986d41c8577a22111cf386c4d3526f423e1d6e194b8fc2a4994783fdcec5
- MD5 057415d5f53e0a41aec3090e70246482
- SHA1 af53a51e7cc7764dae92f104d5131b49a397e60f
- SHA512 6a3d183f5d365f906c03f90f2ccd3d4a08e322b4d386c16c2a00bd73ca4fb2aa0098203a7a6ed747e87ee273781e5a14177a7098d0a0ad386299854fd06c6259
- SSDEEP 3072:JD6Xtx68yygRBE52mxkEOHLRMpZ4deth8PEAjAfIbAYGPhz6sPJBInxZqOU:Jh8cBzHLRMpZ4d1ZU
- MD5 SHA1 SHA512 SSDEEP