Analysis
- max time kernel
150s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 22:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0d33021177166513f50715fcda6a7da0_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
0d33021177166513f50715fcda6a7da0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 0d33021177166513f50715fcda6a7da0_NeikiAnalytics.exe
- Size 200KB
- Sample240603-2p86psbh4x
- SHA256 2c2f26c6095f448dff8efebba4d4ee31c12c6c8d0fc63f9de1bb6a09f53aaf99
- MD5 0d33021177166513f50715fcda6a7da0
- SHA1 b459d5005d1ce67fec015a13eba1233403966651
- SHA512 486a3b114b10732a7e10e6c9419631f98ff5e26bce0c8ec0ed7f6ff4d54b183246e926dcee231720c2fd39e32152ad7cbb6c8b03cb6507590f90c4fa179eb225
- SSDEEP 3072:7vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6uBL9iG:7vEN2U+T6i5LirrllHy4HUcMQY6C9iG
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Modifies Installed Components in the registry 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe - Executes dropped EXE 4 IoCs
pid Process 624 explorer.exe 4616 spoolsv.exe 1816 svchost.exe 844 spoolsv.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe 0d33021177166513f50715fcda6a7da0_NeikiAnalytics.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3128 0d33021177166513f50715fcda6a7da0_NeikiAnalytics.exe 3128 0d33021177166513f50715fcda6a7da0_NeikiAnalytics.exe 624 explorer.exe 624 explorer.exe 624 explorer.exe 624 explorer.exe 624 explorer.exe 624 explorer.exe 624 explorer.exe 624 explorer.exe 1816 svchost.exe 1816 svchost.exe 1816 svchost.exe 1816 svchost.exe 624 explorer.exe 624 explorer.exe 1816 svchost.exe 1816 svchost.exe 624 explorer.exe 624 explorer.exe 1816 svchost.exe 1816 svchost.exe 624 explorer.exe 624 explorer.exe 1816 svchost.exe 1816 svchost.exe 624 explorer.exe 624 explorer.exe 1816 svchost.exe 1816 svchost.exe 624 explorer.exe 624 explorer.exe 1816 svchost.exe 1816 svchost.exe 624 explorer.exe 624 explorer.exe 1816 svchost.exe 1816 svchost.exe 624 explorer.exe 624 explorer.exe 1816 svchost.exe 1816 svchost.exe 624 explorer.exe 624 explorer.exe 1816 svchost.exe 1816 svchost.exe 624 explorer.exe 624 explorer.exe 1816 svchost.exe 1816 svchost.exe 624 explorer.exe 624 explorer.exe 1816 svchost.exe 1816 svchost.exe 624 explorer.exe 1816 svchost.exe 624 explorer.exe 1816 svchost.exe 624 explorer.exe 1816 svchost.exe 1816 svchost.exe 624 explorer.exe 1816 svchost.exe 1816 svchost.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 624 explorer.exe 1816 svchost.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3128 0d33021177166513f50715fcda6a7da0_NeikiAnalytics.exe 3128 0d33021177166513f50715fcda6a7da0_NeikiAnalytics.exe 624 explorer.exe 624 explorer.exe 4616 spoolsv.exe 4616 spoolsv.exe 1816 svchost.exe 1816 svchost.exe 844 spoolsv.exe 844 spoolsv.exe 624 explorer.exe 624 explorer.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 3128 wrote to memory of 624 3128 0d33021177166513f50715fcda6a7da0_NeikiAnalytics.exe 82 PID 3128 wrote to memory of 624 3128 0d33021177166513f50715fcda6a7da0_NeikiAnalytics.exe 82 PID 3128 wrote to memory of 624 3128 0d33021177166513f50715fcda6a7da0_NeikiAnalytics.exe 82 PID 624 wrote to memory of 4616 624 explorer.exe 83 PID 624 wrote to memory of 4616 624 explorer.exe 83 PID 624 wrote to memory of 4616 624 explorer.exe 83 PID 4616 wrote to memory of 1816 4616 spoolsv.exe 85 PID 4616 wrote to memory of 1816 4616 spoolsv.exe 85 PID 4616 wrote to memory of 1816 4616 spoolsv.exe 85 PID 1816 wrote to memory of 844 1816 svchost.exe 86 PID 1816 wrote to memory of 844 1816 svchost.exe 86 PID 1816 wrote to memory of 844 1816 svchost.exe 86 PID 1816 wrote to memory of 1316 1816 svchost.exe 87 PID 1816 wrote to memory of 1316 1816 svchost.exe 87 PID 1816 wrote to memory of 1316 1816 svchost.exe 87 PID 1816 wrote to memory of 1992 1816 svchost.exe 99 PID 1816 wrote to memory of 1992 1816 svchost.exe 99 PID 1816 wrote to memory of 1992 1816 svchost.exe 99 PID 1816 wrote to memory of 4808 1816 svchost.exe 101 PID 1816 wrote to memory of 4808 1816 svchost.exe 101 PID 1816 wrote to memory of 4808 1816 svchost.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d33021177166513f50715fcda6a7da0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0d33021177166513f50715fcda6a7da0_NeikiAnalytics.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3128 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:844
-
-
C:\Windows\SysWOW64\at.exeat 22:48 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:1316
-
-
C:\Windows\SysWOW64\at.exeat 22:49 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:1992
-
-
C:\Windows\SysWOW64\at.exeat 22:50 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:4808
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\mrsys.exe
- Size 216KB
- SHA256 24de0dd89852741c707afe97b20074f4641eaab2f268f44c57f37bebfaafc0cd
- MD5 f3269e5fe2d7d538916f9baeb85c2811
- SHA1 cedbd83770cc7184c0a56ed610fa00d265950e06
- SHA512 2db3bf543aed68e4f3e991f46502f209286625624586aa8be3d8275707d5ed5106b7e4aa383c94ee7501df3011995dc01924659726a4585e02d3abff615e91f7
- SSDEEP 3072:7vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6uBL9iB:7vEN2U+T6i5LirrllHy4HUcMQY6C9iB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\explorer.exe
- Size 216KB
- SHA256 c4dd3eea78255c2b7e4e08665a0a705370be6eb14f38111dd29bc10221c30c6f
- MD5 8c7f7255e737c8c0efaa7224906f5638
- SHA1 f618225e5c627a6ec99aa038f410b5a5450ea53b
- SHA512 8f005352c3328b73ff8bb0fbc9cc5735bfb1537b05a12d05a173cf1d76cff89c33420c4b4b58b5a50364564586e35ce78e98cd2bf095b208f03ccf9a387d6881
- SSDEEP 3072:7vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6uBL9ii:7vEN2U+T6i5LirrllHy4HUcMQY6C9ii
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\spoolsv.exe
- Size 216KB
- SHA256 8996c96aba5c9373d08164b113eb1dfb1dab1955fc5fe58fce5e524cf2fe95b6
- MD5 98c4e2afaa6952340d8ef313fe5d9c3b
- SHA1 af8161ccf77f80145bdf79a3b4c6820f8dc43bb0
- SHA512 e188b76ed94eba616db14c608b6a7236f3536e6074ad6a4b216faf009a82080649f17f2ff97386b64de9bed78349bc8b5bd0eef0222947d83523a576dc30971e
- SSDEEP 3072:7vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6uBL9ie:7vEN2U+T6i5LirrllHy4HUcMQY6C9ie
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\svchost.exe
- Size 216KB
- SHA256 aed6b8e93d20831c52187c191cf35da67137e7c58d33eafba721575c499a6621
- MD5 f02d4788ea1ef467db71ab07b53aa9e1
- SHA1 466d692792c6d1d41c4cb6123301cfa984af0daa
- SHA512 d85a191ed2ff609093867697c1e1c25a9d97588166cf77b7a3b7290a3f5461260f47614faf65cb170da47dae9c55a7766e950cad607923a28233a8f04fa56f98
- SSDEEP 3072:7vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6uBL9iz:7vEN2U+T6i5LirrllHy4HUcMQY6C9iz
- MD5 SHA1 SHA512 SSDEEP