9e194fe5426c1e9b662a6c1cb336adf7f34c2039feb05d88ccd9f053409f611c

Analysis

max time kernel
150s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 11:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a18a1f5d93290a5c5a8f53acb9dec360_NeikiAnalytics.exe
Size 122KB
Sample240603-nera9ace7s
SHA256 9e194fe5426c1e9b662a6c1cb336adf7f34c2039feb05d88ccd9f053409f611c
MD5 a18a1f5d93290a5c5a8f53acb9dec360
SHA1 8c3dcf3002e5f1d86f6d9d50006b5db71596c743
SHA512 4b75deab5bccb66ccb4fa784b2272d9f07c6e0adcaa998859f6befe0ebbd11fe294b8c3e4f2c0211782a98e383ea5fd95721c75c36eccbdd3fb91c0a1a43ef0d
SSDEEP 1536:niyzlrXCu2lsuAoeQZZ86ukpj0nGGF9v+4Dvp:iyZCu2lhA1QZZ4kp4F9Xzp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
3704	explorer.exe
2652	spoolsv.exe
2216	svchost.exe
2312	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	a18a1f5d93290a5c5a8f53acb9dec360_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\System\tjud.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2832	a18a1f5d93290a5c5a8f53acb9dec360_NeikiAnalytics.exe
2832	a18a1f5d93290a5c5a8f53acb9dec360_NeikiAnalytics.exe
3704	explorer.exe
3704	explorer.exe
3704	explorer.exe
3704	explorer.exe
3704	explorer.exe
3704	explorer.exe
2216	svchost.exe
2216	svchost.exe
2216	svchost.exe
2216	svchost.exe
3704	explorer.exe
3704	explorer.exe
2216	svchost.exe
2216	svchost.exe
3704	explorer.exe
3704	explorer.exe
2216	svchost.exe
2216	svchost.exe
3704	explorer.exe
3704	explorer.exe
2216	svchost.exe
2216	svchost.exe
3704	explorer.exe
3704	explorer.exe
2216	svchost.exe
2216	svchost.exe
3704	explorer.exe
3704	explorer.exe
2216	svchost.exe
2216	svchost.exe
3704	explorer.exe
3704	explorer.exe
2216	svchost.exe
2216	svchost.exe
3704	explorer.exe
3704	explorer.exe
2216	svchost.exe
2216	svchost.exe
3704	explorer.exe
3704	explorer.exe
2216	svchost.exe
2216	svchost.exe
3704	explorer.exe
3704	explorer.exe
2216	svchost.exe
2216	svchost.exe
3704	explorer.exe
3704	explorer.exe
2216	svchost.exe
2216	svchost.exe
3704	explorer.exe
3704	explorer.exe
2216	svchost.exe
2216	svchost.exe
3704	explorer.exe
3704	explorer.exe
2216	svchost.exe
2216	svchost.exe
3704	explorer.exe
3704	explorer.exe
2216	svchost.exe
2216	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3704	explorer.exe
2216	svchost.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2832	a18a1f5d93290a5c5a8f53acb9dec360_NeikiAnalytics.exe
2832	a18a1f5d93290a5c5a8f53acb9dec360_NeikiAnalytics.exe
3704	explorer.exe
3704	explorer.exe
2652	spoolsv.exe
2652	spoolsv.exe
2216	svchost.exe
2216	svchost.exe
2312	spoolsv.exe
2312	spoolsv.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 3704	2832	a18a1f5d93290a5c5a8f53acb9dec360_NeikiAnalytics.exe	90
PID 2832 wrote to memory of 3704	2832	a18a1f5d93290a5c5a8f53acb9dec360_NeikiAnalytics.exe	90
PID 2832 wrote to memory of 3704	2832	a18a1f5d93290a5c5a8f53acb9dec360_NeikiAnalytics.exe	90
PID 3704 wrote to memory of 2652	3704	explorer.exe	91
PID 3704 wrote to memory of 2652	3704	explorer.exe	91
PID 3704 wrote to memory of 2652	3704	explorer.exe	91
PID 2652 wrote to memory of 2216	2652	spoolsv.exe	92
PID 2652 wrote to memory of 2216	2652	spoolsv.exe	92
PID 2652 wrote to memory of 2216	2652	spoolsv.exe	92
PID 2216 wrote to memory of 2312	2216	svchost.exe	93
PID 2216 wrote to memory of 2312	2216	svchost.exe	93
PID 2216 wrote to memory of 2312	2216	svchost.exe	93

C:\Users\Admin\AppData\Local\Temp\a18a1f5d93290a5c5a8f53acb9dec360_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a18a1f5d93290a5c5a8f53acb9dec360_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2832
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3704
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2652
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2216
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4168,i,1697479186275492802,18058102846092193784,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:8
1⤵
PID:1260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mrsys.exe

Path C:\Users\Admin\AppData\Roaming\mrsys.exe
Size 122KB
SHA256 6a7d2db2e8d2688febbd29236260d9e9538c04c77579a33d6939ebb9631ea09b
MD5 997d669c7384cc4513774ab7b7dc616e
SHA1 1398606cf99b83d0eb687631f1e0c4ff22e79a04
SHA512 afb9500fe457bdb66ad72c20862556dfb7ee281048b86ea13a41abae6cd723e81e71316f00e332d13c12db55ff5f01f83c805288a75ad36e52bf060baaa8c0e8
SSDEEP 1536:niyzlrXCu2lsuAoeQZZ86ukpj0nGGF9v+4Dv5:iyZCu2lhA1QZZ4kp4F9Xz5
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 122KB
SHA256 3a4fef96d93e35556334e17be86c23763a27ad46a1b47a6b72d4a50bdb686c84
MD5 cc7ef733f077164905614d6dd77662cc
SHA1 a83ba34a5b64ca3d83ee1947f9fad85e159176e9
SHA512 58f7d319cc250428ccee64725c9748ddc1379c3a99ce37a62011ad6c3aee3ad97388bfb9ef05966ff2fa03afa9101471d949d4b92ffde6883447fe762db36156
SSDEEP 1536:niyzlrXCu2lsuAoeQZZ86ukpj0nGGF9v+4DvT:iyZCu2lhA1QZZ4kp4F9XzT
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Windows\System\svchost.exe
Size 122KB
SHA256 c7c2a377e71fd2c3953fbd282f3434f422a771d9e548591fcc2d4c0da8a101fb
MD5 e7ebae52a8e650ade891b7fa4f8e73d1
SHA1 80463ec7cd290f6609b4927e313691acef954b73
SHA512 ef9a6ab8f26bd3623f215c155610d2ed92532190cb6efda8697c481cd72f1cbaf4506504aef4c9236b0c37598367f7fae02fd2d8fb9daf7d58b6e04310cb1c75
SSDEEP 1536:niyzlrXCu2lsuAoeQZZ86ukpj0nGGF9v+4DvL:iyZCu2lhA1QZZ4kp4F9XzL
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path \??\c:\windows\system\explorer.exe
Size 122KB
SHA256 a25326f6630a1dac9380a73502fb1422d10614c31145b062ae8564cae3130e37
MD5 e80c98b8be4afb781c2d08963248cb98
SHA1 c3b78d2efbd3d0cbcef72b9803351a9acda243bc
SHA512 3a8ec8d3c759d0ab3a24f9c4d96677c8ea2b3d85fedc2e583c66ac45f17d40c8792356e278144b6db0f85d0e0b0ef45ddb77b63f8a34d06f9b8bd92247118dec
SSDEEP 3072:iyZCu2lhA1QZZ4kp4F9XzmGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGL:i+2AmZ2F9P
MD5 SHA1 SHA512 SSDEEP

Submit Download