Analysis

  • max time kernel
    150s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    03-06-2024 03:39

General

  • Target

    9a36e51f014ff30dd4276b7142e29c00_NeikiAnalytics.exe

  • Size

    206KB

  • MD5

    9a36e51f014ff30dd4276b7142e29c00

  • SHA1

    3f14f74efc64640705894317c721a4660075f1f3

  • SHA256

    8e839452e84c83d2dc3cbdec7d6ecd828797e6195ddf887c033742fc5b1a9032

  • SHA512

    e78da95e819c7bd45fe74e33722ecbe565167996c6b13c867a4e8084a13434c593dc4fb952c4831f5393f5e51fa21b346ffc888fa232a968d5eb653f28f63bac

  • SSDEEP

    3072:zvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unZ0:zvEN2U+T6i5LirrllHy4HUcMQY6H

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 8 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9a36e51f014ff30dd4276b7142e29c00_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\9a36e51f014ff30dd4276b7142e29c00_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2840
    • \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1684
      • \??\c:\windows\system\spoolsv.exe
        c:\windows\system\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2664
        • \??\c:\windows\system\svchost.exe
          c:\windows\system\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2756
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2716
          • C:\Windows\SysWOW64\at.exe
            at 03:41 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
              PID:2600
            • C:\Windows\SysWOW64\at.exe
              at 03:42 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              5⤵
                PID:1712
              • C:\Windows\SysWOW64\at.exe
                at 03:43 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                5⤵
                  PID:1244

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\mrsys.exe

          Filesize

          206KB

          MD5

          e2c4d3df1e94db7baf6bc57e9596655b

          SHA1

          edd80c0ef4a945d74776eb7ffe02a9f795541aa9

          SHA256

          72b350580fb9a3eebad845be90492663af22bfd8d8fc0f97baf5c1dfb8c529e5

          SHA512

          dc71e0cc5ed7cc0756c98d08a6695149960c7007f209fba5cafa4789bafaf63bc59f1d9381e6a343d92ecfbc3af3a3d050468830f4a0194220cb548fb1697fb0

        • C:\Windows\system\svchost.exe

          Filesize

          206KB

          MD5

          7b42bac95c3355dc6b190071b8cfe00a

          SHA1

          20e903f5f230c07b9878ef43caf7d0ce7495b8ee

          SHA256

          03ecdcb5e6ed0bb1a2fb81472ac2440d79abba99cdd736eccbd49b062bf922a8

          SHA512

          7759dbdb73d4eefa1d367d0d2116e3ddfc5a97cfce4a9a958ca28fb6df281856356f14737e518c56e7acf3dddc61ee7215a402c5c43c6fd3f2d079f18e1ad5ae

        • \Windows\system\explorer.exe

          Filesize

          206KB

          MD5

          d6a8fa4ee2cc327b6fa63c25742e1d8e

          SHA1

          6c6925f825be727153599f6eec0fbe17af009861

          SHA256

          2dffc771c3396052a74066c8ab912de7b591aeb6c09039caad6de7ddd610535f

          SHA512

          4c9c45627f3974c26d1b2f2bb6a5a5ecc55233da435186ce591c6305ef8937df829ebd8e26bb1cc426149f1c4a72da1c18d69e3460b7b131245fa9703ed9b299

        • \Windows\system\spoolsv.exe

          Filesize

          206KB

          MD5

          f72c4e76933789801befcbcc0447e5f8

          SHA1

          3cc720ae5936bc4bbd4422605c0614cf58b1dc12

          SHA256

          f126b1edd44a7a93ed6d1bb88c2e5c6171e5a7884e60546a8a467b76a8322b3e

          SHA512

          dce42b0700e4a2a900938dcd824e5763d4b047bfe72fbe5d33c4c3d1d01973c123bf1ef124ea847bf4ef1ecc15168f541c48bacdc86cb95feee87ec2f3994d99