4f2800a2203fd748bed3bcc1286a2476e0ce7fe6957d148b8490bcc818ac7ecb

Analysis

max time kernel
150s
max time network
130s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 07:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

936f370ea30246c1cb165a2f0d7fa0e0_NeikiAnalytics.exe
Size

3.7MB
MD5

936f370ea30246c1cb165a2f0d7fa0e0
SHA1

c574b5c7a2a62cf46c9c858baba96b5c80bfd116
SHA256

4f2800a2203fd748bed3bcc1286a2476e0ce7fe6957d148b8490bcc818ac7ecb
SHA512

b8338ed098fe15b8dbf4d465de636d3f490a1a469bcd50e136611f1393156c815bb328ccc4a39d36c151b9c9bf5db8f05daf7d21927e61b7c2605b10baea3dd1
SSDEEP

6144:F76vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvl:F2

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	936f370ea30246c1cb165a2f0d7fa0e0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	msng.exe

Executes dropped EXE 1 IoCs

pid	Process
2988	msng.exe

Loads dropped DLL 2 IoCs

pid	Process
2444	936f370ea30246c1cb165a2f0d7fa0e0_NeikiAnalytics.exe
2444	936f370ea30246c1cb165a2f0d7fa0e0_NeikiAnalytics.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\msng = "C:\\Windows\\system32\\msng.exe"	936f370ea30246c1cb165a2f0d7fa0e0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\msng = "C:\\Windows\\system32\\msng.exe"	msng.exe

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	msng.exe
File opened (read-only)	\??\e:	msng.exe
File opened (read-only)	\??\a:	msng.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\rundII32.exe	msng.exe
File created	C:\Windows\SysWOW64\rundll32.exe	msng.exe
File created	C:\Windows\SysWOW64\msng.exe	936f370ea30246c1cb165a2f0d7fa0e0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\msng.exe	936f370ea30246c1cb165a2f0d7fa0e0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\rundII32.exe	936f370ea30246c1cb165a2f0d7fa0e0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\rundll32.exe	936f370ea30246c1cb165a2f0d7fa0e0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\rundII32.exe	msng.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000037343050f333f16a79ca6f6810f1ff91f405f051855279b68c2457b3b9e69e07000000000e80000000020000200000001d248d85fdc20e9826229b8ffe258b03218dc1fbb566e5521f97fc8120a088c920000000b21f01b9caaefa0cc8928e3deed727319f3937a343e9ac747dca7fd776ea604540000000ad02271805c10c876632ad92b2e8e001c8873a4882623b0eaac77b8ecc6ed72597766e4ab0ab1b932f66d6b9fc66d293f19cb854433533a0117902e4b7067448	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423390434"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{66A55971-1FEC-11EF-9B71-FAB46556C0ED} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000006c000825ddfb9be5765cf441fe92d50ba8a72341b1b601acdc930364d10249d1000000000e8000000002000020000000661882e7aa9869e6c64256a2cad288788a4e95a38adef9272ef3f27ad3dbee459000000056792462bae0219d7b5d070bb7e6563d566fbea8dd4735f88afef5a428a8271662d97b81f7d59a53f0904fafa13b3f63f6f62cac00789eec5ceb768fa43d356b8cc1027715fc25a39d768bdfee8c75aa1c8bd6ee027d3146a8c7e400517a81ea15cd1f009e836f535983ef8d2a920e8ca78ce53e98c8eefe2fb7c12a5b19acadef2947a13ef89869dc2c05e80b40b86240000000bd0c90e9aacd9861590e121653d1c61d9c16672e12dcefe2eebe703f67a30bbc12eee7d5da5bb2bb58df102165b5c8a255f6c127301a7b3f03a3590ffddefa72	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0b21840f9b3da01	iexplore.exe

Modifies registry class 37 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 5200310000000000a8587a81122041707044617461003c0008000400efbea8587a81a8587a812a000000eb0100000000020000000000000000000000000000004100700070004400610074006100000016000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 4c00310000000000a858d48210204c6f63616c00380008000400efbea8587a81a858d4822a000000fe0100000000020000000000000000000000000000004c006f00630061006c00000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4a00310000000000c158033f102054656d700000360008000400efbea8587a81c158033f2a000000ff010000000002000000000000000000000000000000540065006d007000000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4c00310000000000a858a986100041646d696e00380008000400efbea8587a81a858a9862a00000030000000000004000000000000000000000000000000410064006d0069006e00000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 7400310000000000a8587a811100557365727300600008000400efbeee3a851aa8587a812a000000e601000000000100000000000000000036000000000055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\NodeSlot = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 = a400310000000000c158033f10203933364633377e3100008c0008000400efbec158033fc158033f2a0000001a47010000000b000000000000000000000000000000390033003600660033003700300065006100330030003200340036006300310063006200310036003500610032006600300064003700660061003000650030005f004e00650069006b00690041006e0061006c0079007400690063007300000018000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe
2988	msng.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2988	msng.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2220	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2444	936f370ea30246c1cb165a2f0d7fa0e0_NeikiAnalytics.exe
2988	msng.exe
2220	iexplore.exe
2220	iexplore.exe
2580	IEXPLORE.EXE
2580	IEXPLORE.EXE
2580	IEXPLORE.EXE
2580	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2936	2444	936f370ea30246c1cb165a2f0d7fa0e0_NeikiAnalytics.exe	28
PID 2444 wrote to memory of 2936	2444	936f370ea30246c1cb165a2f0d7fa0e0_NeikiAnalytics.exe	28
PID 2444 wrote to memory of 2936	2444	936f370ea30246c1cb165a2f0d7fa0e0_NeikiAnalytics.exe	28
PID 2444 wrote to memory of 2936	2444	936f370ea30246c1cb165a2f0d7fa0e0_NeikiAnalytics.exe	28
PID 2444 wrote to memory of 2988	2444	936f370ea30246c1cb165a2f0d7fa0e0_NeikiAnalytics.exe	29
PID 2444 wrote to memory of 2988	2444	936f370ea30246c1cb165a2f0d7fa0e0_NeikiAnalytics.exe	29
PID 2444 wrote to memory of 2988	2444	936f370ea30246c1cb165a2f0d7fa0e0_NeikiAnalytics.exe	29
PID 2444 wrote to memory of 2988	2444	936f370ea30246c1cb165a2f0d7fa0e0_NeikiAnalytics.exe	29
PID 2988 wrote to memory of 1152	2988	msng.exe	31
PID 2988 wrote to memory of 1152	2988	msng.exe	31
PID 2988 wrote to memory of 1152	2988	msng.exe	31
PID 2988 wrote to memory of 1152	2988	msng.exe	31
PID 2696 wrote to memory of 2220	2696	explorer.exe	33
PID 2696 wrote to memory of 2220	2696	explorer.exe	33
PID 2696 wrote to memory of 2220	2696	explorer.exe	33
PID 2220 wrote to memory of 2580	2220	iexplore.exe	34
PID 2220 wrote to memory of 2580	2220	iexplore.exe	34
PID 2220 wrote to memory of 2580	2220	iexplore.exe	34
PID 2220 wrote to memory of 2580	2220	iexplore.exe	34

C:\Users\Admin\AppData\Local\Temp\936f370ea30246c1cb165a2f0d7fa0e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\936f370ea30246c1cb165a2f0d7fa0e0_NeikiAnalytics.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Local\Temp\936f370ea30246c1cb165a2f0d7fa0e0_NeikiAnalytics
  2⤵
  PID:2936
- C:\Windows\SysWOW64\msng.exe
  "C:\Windows\system32\msng.exe" fuckystart
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe http://www.OpenClose.ir
    3⤵
    PID:1152

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:3060

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.openclose.ir/
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e1857ce6ecd1ce0f391a7c53ba95514

SHA1
5541f85212ce07da88658d3b89db47c518e02008

SHA256
8272fdb72e0a82ce26954165e551c9ee01aa63364fb8251f59c2c14f60e967e5

SHA512
f0e1476ec10870c522df4ff255e10d751d3a539e6c063623aa7ac4fa7ddba5d5c3f564cd4902884350a7a44af740aa77aea08dff4c30b4296fcd76205775c7bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0524925c73cc38a376643b9fc4e46201

SHA1
892da3252d76432853f54f24fc2726ab19346037

SHA256
054bbd9b8de16588b38ac68bc262c2690a138791006a71e78690f1e41d541475

SHA512
9c6469b2e11e093530b20d7db1302308c9e0292a3864b3b21997e008f81ab4707c783641b225f394048c08943e7b72d3e495b2f2079a319412885fe10bfd32bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78e6eee68f954d200327d7f63a293d1f

SHA1
90ac9bf2cbb0aeab751df55fb8e0d43b3dfcf829

SHA256
184d0804d3d2574f45adec60cc6ae55c258beb3e7e15f16f3da63835f90ddaba

SHA512
88572274cbd8c8a30c5915cf3b6c773483ac71ae83f171b4a5f1cbd531403a5b0a6f98bfcda05020dd5c1881dc56dad529fd0e28a26a5a2efb4130e9211844b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00570372f850edde70d616c2b3f0d6f5

SHA1
0737fe1ca96c54daec3c97b17748e00a7eba40a3

SHA256
beb2e047a5ebad246dda48f09b5f68d9d39aeb2a87151f938a9a02645e9753c1

SHA512
4237bce3d37ec92bbb1d7a35e4c35d58be06dc6ba1fbbdce6958d1fd072a94ac8fe70848eceb7c5c01de6d22509b9e10c2efe4dc87d884c7b0d2b0c3dc6f8093

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91629e4ea724dfadf7c5abb3d3771241

SHA1
7338e3ea95a3eb92e9586dc94fa948479dbe86ef

SHA256
b8b5b813473cd1bddb621f1fde302612b2b361fbaa3ae229d32f230c4a4dfac9

SHA512
f2fa6606a11beac5dcf4b40212a0e041c90611db4cad8cbd94ee5fb9f49da69bbd2e7bc4798b420a7272bf01cd9d00c9ec7a946d69b3ef324be4703622c0cf52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1defec0e66624485c96fd7c707555228

SHA1
8824b0cd659b0ca3c584eb7228f7524d8f1eec5e

SHA256
8d4466226440b567f9c9c4854135f66fde18f5a60aa30a0b7ce0c5f7ecf4cac7

SHA512
6e413b8713f94a398f530e4ad8e9ca537fa2eb79d8e71e13bf36a52bf437015475dcc7bc6cb744f49442fc70b34840a0b21475b994cba38e353a96d0db9aea9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de093ee56e4c2022ce0419c39284a185

SHA1
51bdc49349bbcd09affac362d641592047a6a7cc

SHA256
dcd9d236f2a59c02b1e25741b2010d9f8f912839bbbdc83cc9b6390483ff8e56

SHA512
b8b3cca5a35c10839b10baa61443d4abb954bc1562302becfd678ae3da7ad7093b84a5f0e0bde2d3d8a694f77b176b918aed7781b0ca409b51e83a5c443ebd5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6854bd2bed66d1f0308ec7b2d4fe1215

SHA1
4ff908b7c0e14e782aec9f3e74b34aebb7406d7d

SHA256
9daf78fce52757433060320a173225ab9efe606be1e7c7af5b8aee1cb224702c

SHA512
6bb12825a5d42f0d0e074bc6e5f1749ec81bfa3ae6900f35288b42225824d5f9539296dbe0026362e6da40b1fef5a9f0a95cd2399d13f76a6f5b8ea8d684977a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eab2061a934c45ebc79b602cf4a63bf8

SHA1
feb0975b2e902570c0179659d04e9def4c41c57c

SHA256
92796e0dfafa611dbb404faee784cdfd49027ccbf63a53aaf423e0173db023bf

SHA512
30adff377458fbbdb3b406fcdd7e48953f3b78d02994a3b8ad312ae835545066778e13ce3d51204990900a447868dc27336a9d6f6e19ce6f1a722438f21eda52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e4f0a81a1711489cf8bd5237861123a

SHA1
3e58ee3cd050e7089ee86a34836d83fb71b10e0a

SHA256
a207ffe1fb2e2e801f472b0980d0148d4ca95638f9a27e501800049a48c1d349

SHA512
ff45840319f8e61ad8b920c5a0f42e2ed3305794b4d1e920118afc2e2c5353e32103fb5f2c1ac9f7cd95f97a331db3f33e838462e2230b24dc735ce233f7f9d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7212a63e0e8d4e6c92df91063dee438

SHA1
9292254539276947f00325e97ba7e2a49c2985e4

SHA256
8f99c8493333f099c215ca9e9ac31a9dc86653f245369a74ce15d4b945abf70f

SHA512
aee98e9a44c5b039e690ff3c9887c278ebcbf2577684b430268ae4a70a8c4099eb7375ada836493032654a7b6fdc8707cddeee3e1c0aeb9a8da11146ea7a516c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f6645b7d31ee83d42d606320bbbabe8

SHA1
97ce7980c729cb694c31a571335c62f636b63349

SHA256
46ae042efe76044c233b0ea2b03e7f4bc4d50ddc61bda1987a4f06b825074662

SHA512
0035296ebcebb3107f5636a3f4e3a86513c995f65fabda2628f033155559d07b12aa83dba1a41a80acab4c4c21d0eb15016ef85be3d779ac0c791c9c37ab86d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4cb64fdcef266ac77f7b8ce3314ddfaa

SHA1
c7e454509244f07473c5ee3247213899c4577ec0

SHA256
9cdbbfe4d3a4e8ad2b92442c98e65cba02281a1e18677e06083c09c5c82776b3

SHA512
642a5d5781def96f28efc12d8ffde5df7eb1a519d39a5f1925bf3626bc0c0dfb9555d5ae99905be70e6ecae1967866897dab9d399c972956c612f1d661449a4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2466e558b05a571c5947423e9cd9efac

SHA1
7f5ccefd27924824a2ad9a517f190b00a11c3f0f

SHA256
11503d13dbb0ee54cad343af7c4063233ae335eebf3371d8a8205df9b2aa7963

SHA512
e5592b86d79ad74bee9428db1034c19ed1d4919dbebf7e57425f5db884e9536a4d3e173b8e4b8bcd388a1d22b50f4986ba43b561628a53d5a69aa22e91195944

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3198d21e79293afd1ab7e03fd06328a7

SHA1
8bea3cda981795f1e90bfe29bb64aa91a5a03f7b

SHA256
260874c70e1adcd2ccaf98d945a3ef3f2bf7a8604b46ebc7ad2e9dae0028f181

SHA512
6771af4490a475f45fc2b3d5159746b00a9725eadcfb29f715b5e959625566a627256b942eb1e30071822dd643e67ddd67a81416450d5b85eb7f95220307148e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5C37.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5CCA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Windows\SysWOW64\rundII32.exe

Filesize
43KB

MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit
C:\~0002ftd.tmp

Filesize
83B

MD5
a3c8845418fe51afaa72bf0cd9dd5f46

SHA1
629dc72dd0a3a3de435e787c4b1a56cc80e28f26

SHA256
8fb05fec00bdf9d18215d004479d013d87c30259a4af64008e4367e740bf21f6

SHA512
351643a739368002c98bac6f7858169396726f4e995d8613e29af50cd85a45165c04de632b6090da2aaf39e27232fbbbc2bb9ab0590a88148b6b1797820a682e

Download Submit
\Windows\SysWOW64\msng.exe

Filesize
3.7MB

MD5
936f370ea30246c1cb165a2f0d7fa0e0

SHA1
c574b5c7a2a62cf46c9c858baba96b5c80bfd116

SHA256
4f2800a2203fd748bed3bcc1286a2476e0ce7fe6957d148b8490bcc818ac7ecb

SHA512
b8338ed098fe15b8dbf4d465de636d3f490a1a469bcd50e136611f1393156c815bb328ccc4a39d36c151b9c9bf5db8f05daf7d21927e61b7c2605b10baea3dd1

Download Submit
memory/2444-16-0x00000000045E0000-0x00000000049B8000-memory.dmp

Filesize
3.8MB

Download
memory/2444-0-0x0000000000400000-0x00000000007D8000-memory.dmp

Filesize
3.8MB

Download
memory/2444-6-0x0000000003B20000-0x00000000045DA000-memory.dmp

Filesize
10.7MB

Download
memory/2444-24-0x0000000000400000-0x00000000007D8000-memory.dmp

Filesize
3.8MB

Download
memory/2988-39-0x00000000003F0000-0x00000000003F2000-memory.dmp

Filesize
8KB

Download
memory/2988-17-0x0000000000400000-0x00000000007D8000-memory.dmp

Filesize
3.8MB

Download
memory/2988-130-0x0000000000400000-0x00000000007D8000-memory.dmp

Filesize
3.8MB

Download
memory/3060-27-0x0000000003A90000-0x0000000003AA0000-memory.dmp

Filesize
64KB

Download