f3ed6c8ece275a335b81ae35864e962ff372bba31ff6849d9047791efb8e6fac

Analysis

max time kernel
152s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 02:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8ae2e769d37366b32601b2ff5de6f1c0_NeikiAnalytics.exe
Size 314KB
Sample240601-df3essfe4y
SHA256 f3ed6c8ece275a335b81ae35864e962ff372bba31ff6849d9047791efb8e6fac
MD5 8ae2e769d37366b32601b2ff5de6f1c0
SHA1 5b1f211dd56551fdc9f6c76e3ced3fe3047cb0dd
SHA512 7ab4d7d19b73b166827830e79f7df3cdf492e9516874f08e0c0b098695c2addd0ced36a260f9bbb88cb0ec77c346421c31b584b743d99dbee6e7399affe5dba6
SSDEEP 3072:7sgCullUQN7gsBh1LLQikygCullUQN7gsBh1L1/:7LleK771Q/RleK771V
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Executes dropped EXE 4 IoCs

pid	Process
2728	explorer.exe
2416	spoolsv.exe
1284	svchost.exe
3872	spoolsv.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/784-0-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/files/0x000900000002323f-7.dat	upx
behavioral2/files/0x0009000000023242-13.dat	upx
behavioral2/files/0x0009000000023243-23.dat	upx
behavioral2/memory/1284-26-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/3872-33-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/files/0x0009000000023246-36.dat	upx
behavioral2/memory/2416-37-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/784-38-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/2728-39-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/1284-40-0x0000000000400000-0x0000000000422000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	8ae2e769d37366b32601b2ff5de6f1c0_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\System\tjud.exe	explorer.exe
File opened for modification	C:\Windows\System\tjcm.cmn	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
784	8ae2e769d37366b32601b2ff5de6f1c0_NeikiAnalytics.exe
784	8ae2e769d37366b32601b2ff5de6f1c0_NeikiAnalytics.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
1284	svchost.exe
1284	svchost.exe
1284	svchost.exe
1284	svchost.exe
2728	explorer.exe
2728	explorer.exe
1284	svchost.exe
1284	svchost.exe
2728	explorer.exe
2728	explorer.exe
1284	svchost.exe
1284	svchost.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
1284	svchost.exe
2728	explorer.exe
1284	svchost.exe
2728	explorer.exe
1284	svchost.exe
2728	explorer.exe
1284	svchost.exe
2728	explorer.exe
1284	svchost.exe
2728	explorer.exe
1284	svchost.exe
2728	explorer.exe
1284	svchost.exe
2728	explorer.exe
1284	svchost.exe
2728	explorer.exe
1284	svchost.exe
2728	explorer.exe
1284	svchost.exe
2728	explorer.exe
1284	svchost.exe
2728	explorer.exe
1284	svchost.exe
1284	svchost.exe
2728	explorer.exe
2728	explorer.exe
1284	svchost.exe
2728	explorer.exe
1284	svchost.exe
2728	explorer.exe
1284	svchost.exe
2728	explorer.exe
1284	svchost.exe
2728	explorer.exe
1284	svchost.exe
2728	explorer.exe
1284	svchost.exe
2728	explorer.exe
1284	svchost.exe
2728	explorer.exe
1284	svchost.exe
2728	explorer.exe
1284	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1284	svchost.exe
2728	explorer.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
784	8ae2e769d37366b32601b2ff5de6f1c0_NeikiAnalytics.exe
784	8ae2e769d37366b32601b2ff5de6f1c0_NeikiAnalytics.exe
2728	explorer.exe
2728	explorer.exe
2416	spoolsv.exe
2416	spoolsv.exe
1284	svchost.exe
1284	svchost.exe
3872	spoolsv.exe
3872	spoolsv.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 2728	784	8ae2e769d37366b32601b2ff5de6f1c0_NeikiAnalytics.exe	90
PID 784 wrote to memory of 2728	784	8ae2e769d37366b32601b2ff5de6f1c0_NeikiAnalytics.exe	90
PID 784 wrote to memory of 2728	784	8ae2e769d37366b32601b2ff5de6f1c0_NeikiAnalytics.exe	90
PID 2728 wrote to memory of 2416	2728	explorer.exe	91
PID 2728 wrote to memory of 2416	2728	explorer.exe	91
PID 2728 wrote to memory of 2416	2728	explorer.exe	91
PID 2416 wrote to memory of 1284	2416	spoolsv.exe	92
PID 2416 wrote to memory of 1284	2416	spoolsv.exe	92
PID 2416 wrote to memory of 1284	2416	spoolsv.exe	92
PID 1284 wrote to memory of 3872	1284	svchost.exe	93
PID 1284 wrote to memory of 3872	1284	svchost.exe	93
PID 1284 wrote to memory of 3872	1284	svchost.exe	93

C:\Users\Admin\AppData\Local\Temp\8ae2e769d37366b32601b2ff5de6f1c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8ae2e769d37366b32601b2ff5de6f1c0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:784
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2728
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2416
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1284
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3808 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
1⤵
PID:4676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mrsys.exe

Path C:\Users\Admin\AppData\Roaming\mrsys.exe
Size 315KB
SHA256 324bbfa730b1a08a0934f56db2246efe0ab1ef56d0cdb8d7b080187a3ac23e99
MD5 05910affd82f8b63ad3884f262d6f252
SHA1 234604569814d7d392e845b8c1e0aa90e7857309
SHA512 3327070ec25d45b81ebfcb37f82ce7db8c26c26cb5ebef1cb16960ccebbea811ee86e481ad358a7988045089a4a213f11c4d4eb74a9fecf487944d16f4fa149c
SSDEEP 3072:7sgCullUQN7gsBh1LLQikygCullUQN7gsBh1L1g:7LleK771Q/RleK771W
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 314KB
SHA256 5f5ed0e1906b922115d389fca2c343b404cfa46038bba389d85d0b1c600be8d1
MD5 96e43acd854b57069a08d6bc45478c39
SHA1 b35295a077b4f4c4d40ff182498d9019958b12bc
SHA512 219e908f1170a8a6a503584834e7573d62d419036d521f8ff18dbb607527c9c0576fc3f7ba453c88c759522314a772f2eba53d4d352fb29d894483e8c0f19eb7
SSDEEP 3072:7sgCullUQN7gsBh1LLQikygCullUQN7gsBh1L1H444444444444444444444444K:7LleK771Q/RleK771A
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 314KB
SHA256 d66d40825e9b5a00bc23eb2f20a9801ec31410edae4af3a22ec2732620db9368
MD5 e7d9250a175a5ab34f43c0e7f8cea85e
SHA1 163eefb82262b52bf54fee7fa5c3d294dae452be
SHA512 0cc59c1bb4fe6c0736d4ab6832e0a507f4e6a3c4d353f92db28f86487b5c0f5a733c9abe4dc74fc9fdf59ec0f497bb7d21a5ad123bc871a3a792a22fa546ca93
SSDEEP 6144:7LleK771Q/RleK771gmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm9:7L4C71Qp4C71gmmmmmmmmmmmmmmmmmma
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Windows\System\svchost.exe
Size 315KB
SHA256 253a704e7149fecf6d7f467bda170493fd1df03fd997931e81ae95c0721b858f
MD5 fb6d3d69bfb518ec0319339e89e3ebea
SHA1 fc09d58f18dc10638fda968ceaecf6eb89448803
SHA512 b311584c5754972931f932ca1ef01553e3a35ec5a95b17b05e5cac245b74e1cc575f667ad931c9fc4b6c14f0f6f73c7a18a435bc3ac3d693a03bee94d6c23eaa
SSDEEP 3072:7sgCullUQN7gsBh1LLQikygCullUQN7gsBh1L1R:7LleK771Q/RleK771b
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/784-0-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/784-38-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/1284-26-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/1284-40-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/2416-37-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/2728-39-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/3872-33-0x0000000000400000-0x0000000000422000-memory.dmp

Download