Analysis
- max time kernel
150s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 22:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0c28f1ff45bfbd770034767421f9a6a0_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
0c28f1ff45bfbd770034767421f9a6a0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 0c28f1ff45bfbd770034767421f9a6a0_NeikiAnalytics.exe
- Size 206KB
- Sample240603-2jfxzacd75
- SHA256 1038cdd81fc52a362769362465f9532d610cc32e36ba9ff836e26525cca62534
- MD5 0c28f1ff45bfbd770034767421f9a6a0
- SHA1 a318b8bd9fa78305122ab2ea7eced8683ffd9c49
- SHA512 0fc3c2da5c0f1771454aec67cc5d8f371c52fe82e79810dfe3c03b0283fea3a363e3e49893cda34df97025196fdd06818f7c64c35b672b8e46c6bb98caa42f8c
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unLg:5vEN2U+T6i5LirrllHy4HUcMQY6Kg
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe - Modifies Installed Components in the registry 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe - Executes dropped EXE 4 IoCs
pid Process 3796 explorer.exe 4252 spoolsv.exe 2404 svchost.exe 1444 spoolsv.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe 0c28f1ff45bfbd770034767421f9a6a0_NeikiAnalytics.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4872 0c28f1ff45bfbd770034767421f9a6a0_NeikiAnalytics.exe 4872 0c28f1ff45bfbd770034767421f9a6a0_NeikiAnalytics.exe 3796 explorer.exe 3796 explorer.exe 3796 explorer.exe 3796 explorer.exe 3796 explorer.exe 3796 explorer.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 2404 svchost.exe 3796 explorer.exe 3796 explorer.exe 2404 svchost.exe 2404 svchost.exe 3796 explorer.exe 3796 explorer.exe 2404 svchost.exe 2404 svchost.exe 3796 explorer.exe 3796 explorer.exe 2404 svchost.exe 2404 svchost.exe 3796 explorer.exe 3796 explorer.exe 2404 svchost.exe 2404 svchost.exe 3796 explorer.exe 3796 explorer.exe 2404 svchost.exe 2404 svchost.exe 3796 explorer.exe 3796 explorer.exe 3796 explorer.exe 2404 svchost.exe 3796 explorer.exe 2404 svchost.exe 3796 explorer.exe 2404 svchost.exe 3796 explorer.exe 2404 svchost.exe 3796 explorer.exe 2404 svchost.exe 3796 explorer.exe 2404 svchost.exe 3796 explorer.exe 2404 svchost.exe 3796 explorer.exe 2404 svchost.exe 2404 svchost.exe 3796 explorer.exe 3796 explorer.exe 2404 svchost.exe 2404 svchost.exe 3796 explorer.exe 3796 explorer.exe 2404 svchost.exe 2404 svchost.exe 3796 explorer.exe 2404 svchost.exe 3796 explorer.exe 3796 explorer.exe 2404 svchost.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 3796 explorer.exe 2404 svchost.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4872 0c28f1ff45bfbd770034767421f9a6a0_NeikiAnalytics.exe 4872 0c28f1ff45bfbd770034767421f9a6a0_NeikiAnalytics.exe 3796 explorer.exe 3796 explorer.exe 4252 spoolsv.exe 4252 spoolsv.exe 2404 svchost.exe 2404 svchost.exe 1444 spoolsv.exe 1444 spoolsv.exe 3796 explorer.exe 3796 explorer.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 4872 wrote to memory of 3796 4872 0c28f1ff45bfbd770034767421f9a6a0_NeikiAnalytics.exe 83 PID 4872 wrote to memory of 3796 4872 0c28f1ff45bfbd770034767421f9a6a0_NeikiAnalytics.exe 83 PID 4872 wrote to memory of 3796 4872 0c28f1ff45bfbd770034767421f9a6a0_NeikiAnalytics.exe 83 PID 3796 wrote to memory of 4252 3796 explorer.exe 84 PID 3796 wrote to memory of 4252 3796 explorer.exe 84 PID 3796 wrote to memory of 4252 3796 explorer.exe 84 PID 4252 wrote to memory of 2404 4252 spoolsv.exe 85 PID 4252 wrote to memory of 2404 4252 spoolsv.exe 85 PID 4252 wrote to memory of 2404 4252 spoolsv.exe 85 PID 2404 wrote to memory of 1444 2404 svchost.exe 86 PID 2404 wrote to memory of 1444 2404 svchost.exe 86 PID 2404 wrote to memory of 1444 2404 svchost.exe 86 PID 2404 wrote to memory of 1204 2404 svchost.exe 87 PID 2404 wrote to memory of 1204 2404 svchost.exe 87 PID 2404 wrote to memory of 1204 2404 svchost.exe 87 PID 2404 wrote to memory of 1976 2404 svchost.exe 105 PID 2404 wrote to memory of 1976 2404 svchost.exe 105 PID 2404 wrote to memory of 1976 2404 svchost.exe 105 PID 2404 wrote to memory of 2092 2404 svchost.exe 114 PID 2404 wrote to memory of 2092 2404 svchost.exe 114 PID 2404 wrote to memory of 2092 2404 svchost.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c28f1ff45bfbd770034767421f9a6a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0c28f1ff45bfbd770034767421f9a6a0_NeikiAnalytics.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3796 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4252 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1444
-
-
C:\Windows\SysWOW64\at.exeat 22:38 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:1204
-
-
C:\Windows\SysWOW64\at.exeat 22:39 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:1976
-
-
C:\Windows\SysWOW64\at.exeat 22:40 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:2092
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\mrsys.exe
- Size 206KB
- SHA256 d9044f1e6bd79161c37c7e75c903d2e93f655b2341055cbd0d52ab79e96735eb
- MD5 73e91da297b4c46d9eabb60e93c6eca7
- SHA1 d06526c4f353ec5f2f4765635554e9b69def204e
- SHA512 d9f7129da4da66308cb5644f34590a0f507e074731ae69032aeb68404302524cf7218e18d144ccad23e94dffad4521fccb6c3189f3f827ef939a31dd1cfe98d3
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unLd:5vEN2U+T6i5LirrllHy4HUcMQY6Kd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\explorer.exe
- Size 207KB
- SHA256 a0d0ff91121c7c071b819cdd13c23fe2a140112e08abbca7aa9c610ad6201879
- MD5 a2b97858f06a2121fddb2e07b3a2d759
- SHA1 38f6a59d132b77d47f8853013b2151fb5b2da047
- SHA512 1b8ee4535bb8961ecbe2dda4975b46880faa612fd48309ed6fb635be4be8e25d50d02988ff6c1db58e599616a80c1b01209d63e18d9144a0fa5362384f3cb0d3
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unLc:5vEN2U+T6i5LirrllHy4HUcMQY6Kc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\spoolsv.exe
- Size 206KB
- SHA256 7f8a534920ecc84bd20d1aad5a2bdd2b206ad4fe851bc5d8f2360517ac41c5cd
- MD5 e63800b39d57bc7cb163c502584294b5
- SHA1 5a8da28ea15c5d04d0698fa09a076be25f50a42d
- SHA512 4b68f2d49783f8930227bcc059fcdb9162c374aa6c5d9cb8d340aad36dd49273bf930c8b54e611883f975c9181b2d5f9f4934a6cf3163d47e75c221611d5b4e9
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unLm:5vEN2U+T6i5LirrllHy4HUcMQY6Km
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\svchost.exe
- Size 207KB
- SHA256 6325069bc5423dfe792b7739d9edb51a663ff90bb01a925a27b1aba2751b2f3b
- MD5 6e98fd1f7a237e689e97bc1621cdf1c5
- SHA1 a255ab01f97a646df15bfbcd2457d359f6623797
- SHA512 b9ae2dba529d069453c730c1137057c6631a840f4882c309d34b472e5f6b163ec617198e503f52f21c9cf5e29aad2e5217aa884925ac1e26ec31e244dd72fa07
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unLY:5vEN2U+T6i5LirrllHy4HUcMQY6KY
- MD5 SHA1 SHA512 SSDEEP