Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 10:45
Behavioral task
behavioral1
Sample
a097fe52bb82e6fdf906a8b0fb3f3080_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
a097fe52bb82e6fdf906a8b0fb3f3080_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target a097fe52bb82e6fdf906a8b0fb3f3080_NeikiAnalytics.exe
- Size 315KB
- Sample240603-mtvfsada87
- SHA256 3753e867225346a32e12b052fe1300a2bdbe3fb9e1f693f2eca340bce5cb2b0b
- MD5 a097fe52bb82e6fdf906a8b0fb3f3080
- SHA1 af85160aaaedc83995d3977bcc497506d247051d
- SHA512 acc26bbfa93794e7c360d5722be6fe1e9075faf7b06514e6ef5f82f0ac19ffa27c96f2e1a38fca8326d1f19aa74ad46a7eb7726175f3bcef426ee3b76412221a
- SSDEEP 3072:7sgCullUQN7gsBh1LLQikygCullUQN7gsBh1L1P:7LleK771Q/RleK7715
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Modifies Installed Components in the registry 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe - Executes dropped EXE 4 IoCs
pid Process 4708 explorer.exe 2092 spoolsv.exe 4192 svchost.exe 4760 spoolsv.exe -
resource yara_rule behavioral2/memory/3600-0-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/files/0x0008000000023298-7.dat upx behavioral2/memory/4708-9-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/files/0x0008000000023425-14.dat upx behavioral2/files/0x0008000000023426-24.dat upx behavioral2/memory/4760-33-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/2092-36-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/3600-37-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/files/0x0008000000023427-38.dat upx behavioral2/memory/4708-39-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/4192-40-0x0000000000400000-0x0000000000422000-memory.dmp upx - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe - Drops file in Windows directory 7 IoCs
description ioc Process File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe File opened for modification C:\Windows\System\tjud.exe explorer.exe File opened for modification C:\Windows\System\tjcm.cmn explorer.exe File opened for modification \??\c:\windows\system\explorer.exe a097fe52bb82e6fdf906a8b0fb3f3080_NeikiAnalytics.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3600 a097fe52bb82e6fdf906a8b0fb3f3080_NeikiAnalytics.exe 3600 a097fe52bb82e6fdf906a8b0fb3f3080_NeikiAnalytics.exe 4708 explorer.exe 4708 explorer.exe 4708 explorer.exe 4708 explorer.exe 4708 explorer.exe 4708 explorer.exe 4192 svchost.exe 4192 svchost.exe 4192 svchost.exe 4192 svchost.exe 4708 explorer.exe 4708 explorer.exe 4192 svchost.exe 4192 svchost.exe 4708 explorer.exe 4708 explorer.exe 4192 svchost.exe 4192 svchost.exe 4708 explorer.exe 4708 explorer.exe 4192 svchost.exe 4192 svchost.exe 4708 explorer.exe 4708 explorer.exe 4192 svchost.exe 4192 svchost.exe 4708 explorer.exe 4708 explorer.exe 4192 svchost.exe 4192 svchost.exe 4708 explorer.exe 4708 explorer.exe 4192 svchost.exe 4192 svchost.exe 4708 explorer.exe 4708 explorer.exe 4192 svchost.exe 4192 svchost.exe 4708 explorer.exe 4708 explorer.exe 4192 svchost.exe 4192 svchost.exe 4708 explorer.exe 4708 explorer.exe 4192 svchost.exe 4192 svchost.exe 4708 explorer.exe 4708 explorer.exe 4192 svchost.exe 4192 svchost.exe 4708 explorer.exe 4708 explorer.exe 4192 svchost.exe 4192 svchost.exe 4708 explorer.exe 4708 explorer.exe 4192 svchost.exe 4192 svchost.exe 4708 explorer.exe 4708 explorer.exe 4192 svchost.exe 4192 svchost.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4708 explorer.exe 4192 svchost.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 3600 a097fe52bb82e6fdf906a8b0fb3f3080_NeikiAnalytics.exe 3600 a097fe52bb82e6fdf906a8b0fb3f3080_NeikiAnalytics.exe 4708 explorer.exe 4708 explorer.exe 2092 spoolsv.exe 2092 spoolsv.exe 4192 svchost.exe 4192 svchost.exe 4760 spoolsv.exe 4760 spoolsv.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3600 wrote to memory of 4708 3600 a097fe52bb82e6fdf906a8b0fb3f3080_NeikiAnalytics.exe 82 PID 3600 wrote to memory of 4708 3600 a097fe52bb82e6fdf906a8b0fb3f3080_NeikiAnalytics.exe 82 PID 3600 wrote to memory of 4708 3600 a097fe52bb82e6fdf906a8b0fb3f3080_NeikiAnalytics.exe 82 PID 4708 wrote to memory of 2092 4708 explorer.exe 83 PID 4708 wrote to memory of 2092 4708 explorer.exe 83 PID 4708 wrote to memory of 2092 4708 explorer.exe 83 PID 2092 wrote to memory of 4192 2092 spoolsv.exe 84 PID 2092 wrote to memory of 4192 2092 spoolsv.exe 84 PID 2092 wrote to memory of 4192 2092 spoolsv.exe 84 PID 4192 wrote to memory of 4760 4192 svchost.exe 85 PID 4192 wrote to memory of 4760 4192 svchost.exe 85 PID 4192 wrote to memory of 4760 4192 svchost.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\a097fe52bb82e6fdf906a8b0fb3f3080_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a097fe52bb82e6fdf906a8b0fb3f3080_NeikiAnalytics.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3600 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4708 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4192 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4760
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\mrsys.exe
- Size 315KB
- SHA256 eab74cd2decb0004f6af7ccb68a5de53af33198ed0fd74d87f0e61f86240479f
- MD5 1cf82aed378b3430044f6f35cc4188ee
- SHA1 c491158c901ca52518e62af7dfde2f74d49d7b08
- SHA512 228c9602723996e0f5c2c9f60ef14390017a9af9ee9f297e887f5b7b3fdb85251429f807fa34cb2e464f85c4b34bdf0e26973712da8bb435122420be543b5f66
- SSDEEP 3072:7sgCullUQN7gsBh1LLQikygCullUQN7gsBh1L1u:7LleK771Q/RleK7714
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\explorer.exe
- Size 314KB
- SHA256 9fa7e4618b7652474159b3a385ab6397fd840a145034d463b262ad8804b7a5e9
- MD5 cdba7fc1e0a5b655382035945ae4b1f6
- SHA1 b5256656bd39b3778e58aa26f65ad0f5d97973be
- SHA512 eb098858e1fba31e5299e5a18d68ee399301e1270f1c23f0133bd0cf688006b87e979726ad1523bb0194ebcf81813c3e5e5500619bb2a4fcf1bb3f0adb965a67
- SSDEEP 3072:7sgCullUQN7gsBh1LLQikygCullUQN7gsBh1L16:7LleK771Q/RleK771Q
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\spoolsv.exe
- Size 314KB
- SHA256 da96bd94690ae3cc1447bd55faa01e445e3b4a4a79491618526d3531241f4d82
- MD5 7ba0e75f8becab89c033cbd19b72b21c
- SHA1 08b07583a1cfe2415e33fc09e737073e46b54581
- SHA512 6b71a5f1ab81c24e7b4441e22e2dd17a780417a16330e98af8d45fc54242ea2988ab8240a4a43d239d2913fe4b94f8a0a012051cee78c98c0436a1b7888f1fb3
- SSDEEP 3072:7sgCullUQN7gsBh1LLQikygCullUQN7gsBh1L1R:7LleK771Q/RleK771f
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\svchost.exe
- Size 315KB
- SHA256 79918403c2c70fcc63c3bb5da6741a3eb2bffa9762c86c13af022a10cad97615
- MD5 4ca95f8c40fca102f640aeb05fce8a7e
- SHA1 c6fc4dbd68a5a8f6cad07ad645769838655cdc1e
- SHA512 38417a8f059a6c9fa731d948df2c2513fb0078ceaf5db3f0a9a1298b00ffe50574c97acd23bf952e821afee79119a97889c145369673183c312d7d8c844e3e22
- SSDEEP 3072:7sgCullUQN7gsBh1LLQikygCullUQN7gsBh1L1H:7LleK771Q/RleK771R
- MD5 SHA1 SHA512 SSDEEP