Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 02:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
98aa3cc799da7a2b0c1b73baafcd4b40_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
98aa3cc799da7a2b0c1b73baafcd4b40_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target 98aa3cc799da7a2b0c1b73baafcd4b40_NeikiAnalytics.exe
- Size 211KB
- Sample240603-c8b8msge5v
- SHA256 b423759d8127ae557411eed029449ae68af102f087150e28c9ab8c2a46ebfb1f
- MD5 98aa3cc799da7a2b0c1b73baafcd4b40
- SHA1 09ab705d55e96440fad426c34709bc75284953cd
- SHA512 ca34a3e7ad8232c564387825699b6df9fa7312c45ac43a9277097a6d7f1bb714f3202c7c3319208d2120911f3f6ed3bcdb174382b61a98e5fa11796771c9f0a7
- SSDEEP 3072:bDpM9Nvih5c9DE1pvAPXIHLfMgw7ySBL8PEAjAfIbAYGPJz6sPJBINFZ1Fqnh:b1iNKQxENHLfMgw7y9Zri
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\userinit.exe" userinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\userinit.exe" swchost.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" swchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" userinit.exe - Modifies Installed Components in the registry 2 TTPs 8 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} swchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} userinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\mrsys.exe MR" userinit.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} swchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\mrsys.exe MR" swchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} swchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} swchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\mrsys.exe MR" swchost.exe - Executes dropped EXE 4 IoCs
pid Process 4396 userinit.exe 3512 spoolsw.exe 1032 swchost.exe 1324 spoolsw.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\userinit = "c:\\windows\\userinit.exe RO" userinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Swchost = "c:\\windows\\swchost.exe RO" userinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\userinit = "c:\\windows\\userinit.exe RO" swchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Swchost = "c:\\windows\\swchost.exe RO" swchost.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\udsys.exe userinit.exe - Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification \??\c:\windows\spoolsw.exe userinit.exe File opened for modification \??\c:\windows\swchost.exe spoolsw.exe File opened for modification \??\c:\windows\userinit.exe userinit.exe File opened for modification \??\c:\windows\swchost.exe swchost.exe File opened for modification \??\c:\windows\userinit.exe 98aa3cc799da7a2b0c1b73baafcd4b40_NeikiAnalytics.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4868 98aa3cc799da7a2b0c1b73baafcd4b40_NeikiAnalytics.exe 4868 98aa3cc799da7a2b0c1b73baafcd4b40_NeikiAnalytics.exe 4396 userinit.exe 4396 userinit.exe 4396 userinit.exe 4396 userinit.exe 4396 userinit.exe 4396 userinit.exe 1032 swchost.exe 1032 swchost.exe 1032 swchost.exe 1032 swchost.exe 4396 userinit.exe 4396 userinit.exe 1032 swchost.exe 1032 swchost.exe 4396 userinit.exe 4396 userinit.exe 1032 swchost.exe 1032 swchost.exe 4396 userinit.exe 4396 userinit.exe 1032 swchost.exe 1032 swchost.exe 4396 userinit.exe 4396 userinit.exe 1032 swchost.exe 1032 swchost.exe 4396 userinit.exe 4396 userinit.exe 1032 swchost.exe 1032 swchost.exe 4396 userinit.exe 4396 userinit.exe 1032 swchost.exe 1032 swchost.exe 4396 userinit.exe 4396 userinit.exe 1032 swchost.exe 1032 swchost.exe 4396 userinit.exe 4396 userinit.exe 1032 swchost.exe 1032 swchost.exe 4396 userinit.exe 4396 userinit.exe 1032 swchost.exe 1032 swchost.exe 4396 userinit.exe 4396 userinit.exe 1032 swchost.exe 1032 swchost.exe 4396 userinit.exe 4396 userinit.exe 1032 swchost.exe 1032 swchost.exe 4396 userinit.exe 4396 userinit.exe 1032 swchost.exe 1032 swchost.exe 4396 userinit.exe 4396 userinit.exe 1032 swchost.exe 1032 swchost.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4396 userinit.exe 1032 swchost.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4868 98aa3cc799da7a2b0c1b73baafcd4b40_NeikiAnalytics.exe 4868 98aa3cc799da7a2b0c1b73baafcd4b40_NeikiAnalytics.exe 4396 userinit.exe 4396 userinit.exe 3512 spoolsw.exe 3512 spoolsw.exe 1032 swchost.exe 1032 swchost.exe 1324 spoolsw.exe 1324 spoolsw.exe 4396 userinit.exe 4396 userinit.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4868 wrote to memory of 4396 4868 98aa3cc799da7a2b0c1b73baafcd4b40_NeikiAnalytics.exe 84 PID 4868 wrote to memory of 4396 4868 98aa3cc799da7a2b0c1b73baafcd4b40_NeikiAnalytics.exe 84 PID 4868 wrote to memory of 4396 4868 98aa3cc799da7a2b0c1b73baafcd4b40_NeikiAnalytics.exe 84 PID 4396 wrote to memory of 3512 4396 userinit.exe 85 PID 4396 wrote to memory of 3512 4396 userinit.exe 85 PID 4396 wrote to memory of 3512 4396 userinit.exe 85 PID 3512 wrote to memory of 1032 3512 spoolsw.exe 86 PID 3512 wrote to memory of 1032 3512 spoolsw.exe 86 PID 3512 wrote to memory of 1032 3512 spoolsw.exe 86 PID 1032 wrote to memory of 1324 1032 swchost.exe 87 PID 1032 wrote to memory of 1324 1032 swchost.exe 87 PID 1032 wrote to memory of 1324 1032 swchost.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\98aa3cc799da7a2b0c1b73baafcd4b40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\98aa3cc799da7a2b0c1b73baafcd4b40_NeikiAnalytics.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4868 -
\??\c:\windows\userinit.exec:\windows\userinit.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\windows\spoolsw.exec:\windows\spoolsw.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3512 -
\??\c:\windows\swchost.exec:\windows\swchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\windows\spoolsw.exec:\windows\spoolsw.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1324
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\mrsys.exe
- Size 211KB
- SHA256 01e2d636ba0304555ea801fc580e4a5382623cd75ed92b00907bf11e2cd8e245
- MD5 fe40c1001e61a38413f3ca40cff80917
- SHA1 a7c14151c5aa9de4940d1b3b33f9048b54c5e750
- SHA512 5e4e0077567d95e3dc08c1bc5fb663c9681298d4b8ab560ec30968064d853e5cb9522d20670b19675ec954470eb4a7de9433e89e8b53773f802255b0d980224c
- SSDEEP 3072:bDpM9Nvih5c9DE1pvAPXIHLfMgw7ySBL8PEAjAfIbAYGPJz6sPJBINFZ1Fqnl:b1iNKQxENHLfMgw7y9Zra
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\spoolsw.exe
- Size 211KB
- SHA256 be8970d0b4e5ab099e1c1a444f73c3442fa487b6719a2c39687ad395335396ff
- MD5 ea51d790ca541017a9924f0d7580b63c
- SHA1 a14ce2fec7e7d6d37751c58e2d23b10567081181
- SHA512 0f60b4eb8e04f00c38e2d28ba4fc25116280a54468cc2afe339126160ab3839efe1ed7165216e1ad08084095a1f63e14c2a752052e8b3a9c628e1397ced2a861
- SSDEEP 3072:bDpM9Nvih5c9DE1pvAPXIHLfMgw7ySBL8PEAjAfIbAYGPJz6sPJBINFZ1Fqn4:b1iNKQxENHLfMgw7y9ZrR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\swchost.exe
- Size 211KB
- SHA256 525636e7620c59081845bbd36be7b913da6c172914f30d0cfeb89e6c22d6a791
- MD5 7c107af9b438c3dbb5d2423f14454187
- SHA1 84552ffd10f51e0a0b32fd1c87995a21f8ec7769
- SHA512 65913178659c6d05761e26cefab040e60a1fca912ea0e0b99a475e9cfed918cbc5b48811a72ba89e9ee82e4779a6d1dd82f7d7955af7c2bcb7f2cab3ce36002f
- SSDEEP 3072:bDpM9Nvih5c9DE1pvAPXIHLfMgw7ySBL8PEAjAfIbAYGPJz6sPJBINFZ1FqnE:b1iNKQxENHLfMgw7y9ZrX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\userinit.exe
- Size 211KB
- SHA256 ed152be8d6437c98412b59643fbc8e700748e4bc3b262bb10d46a7f1be254038
- MD5 4bbb254ddddf563f631c2749f8cd2df3
- SHA1 aefcd9b98c25197934bcf26d014279a71ef91cae
- SHA512 fead2d448b40f257b5c26d2f16659a8d243af1eb6d21950e7f928736ff44a26e3609d5f8b03a65dfbdf7d0b45ba58bff1f24ae6a1d33f02aea3ef73503b4517d
- SSDEEP 3072:bDpM9Nvih5c9DE1pvAPXIHLfMgw7ySBL8PEAjAfIbAYGPJz6sPJBINFZ1Fqni:b1iNKQxENHLfMgw7y9ZrR
- MD5 SHA1 SHA512 SSDEEP