Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 16:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a77e262d8c49045fae718f101fb61530_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
a77e262d8c49045fae718f101fb61530_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target a77e262d8c49045fae718f101fb61530_NeikiAnalytics.exe
- Size 206KB
- Sample240603-vc6fqaea75
- SHA256 fa15ed62a64d14bce3049d64cdc3e6c3481c4a9611440652c231869c26b12c37
- MD5 a77e262d8c49045fae718f101fb61530
- SHA1 56cc1ec5df70ae780465c7e1c105443c83cd3e01
- SHA512 871c732339187888e5abd48c8ef4689d590dbd796120589add81639f6b803b23f74904a4036c4f8f8416e152793f772f1c5c97175a5c1b3a01dd175a056c12dc
- SSDEEP 6144:5vEN2U+T6i5LirrllHy4HUcMQY6KhZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZT:RENN+T5xYrllrU7QY6KhZZZZZZZZZZZZ
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Modifies Installed Components in the registry 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe - Executes dropped EXE 4 IoCs
pid Process 4048 explorer.exe 1292 spoolsv.exe 3328 svchost.exe 4720 spoolsv.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe a77e262d8c49045fae718f101fb61530_NeikiAnalytics.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3876 a77e262d8c49045fae718f101fb61530_NeikiAnalytics.exe 3876 a77e262d8c49045fae718f101fb61530_NeikiAnalytics.exe 4048 explorer.exe 4048 explorer.exe 4048 explorer.exe 4048 explorer.exe 4048 explorer.exe 4048 explorer.exe 3328 svchost.exe 3328 svchost.exe 3328 svchost.exe 3328 svchost.exe 4048 explorer.exe 3328 svchost.exe 4048 explorer.exe 3328 svchost.exe 4048 explorer.exe 3328 svchost.exe 4048 explorer.exe 3328 svchost.exe 4048 explorer.exe 3328 svchost.exe 4048 explorer.exe 3328 svchost.exe 3328 svchost.exe 4048 explorer.exe 3328 svchost.exe 4048 explorer.exe 3328 svchost.exe 4048 explorer.exe 4048 explorer.exe 3328 svchost.exe 3328 svchost.exe 4048 explorer.exe 4048 explorer.exe 3328 svchost.exe 4048 explorer.exe 3328 svchost.exe 4048 explorer.exe 3328 svchost.exe 4048 explorer.exe 3328 svchost.exe 4048 explorer.exe 3328 svchost.exe 4048 explorer.exe 3328 svchost.exe 3328 svchost.exe 4048 explorer.exe 4048 explorer.exe 3328 svchost.exe 4048 explorer.exe 3328 svchost.exe 4048 explorer.exe 3328 svchost.exe 4048 explorer.exe 3328 svchost.exe 4048 explorer.exe 3328 svchost.exe 4048 explorer.exe 3328 svchost.exe 4048 explorer.exe 3328 svchost.exe 4048 explorer.exe 3328 svchost.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 3328 svchost.exe 4048 explorer.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3876 a77e262d8c49045fae718f101fb61530_NeikiAnalytics.exe 3876 a77e262d8c49045fae718f101fb61530_NeikiAnalytics.exe 4048 explorer.exe 4048 explorer.exe 1292 spoolsv.exe 1292 spoolsv.exe 3328 svchost.exe 3328 svchost.exe 4720 spoolsv.exe 4720 spoolsv.exe 4048 explorer.exe 4048 explorer.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 3876 wrote to memory of 4048 3876 a77e262d8c49045fae718f101fb61530_NeikiAnalytics.exe 82 PID 3876 wrote to memory of 4048 3876 a77e262d8c49045fae718f101fb61530_NeikiAnalytics.exe 82 PID 3876 wrote to memory of 4048 3876 a77e262d8c49045fae718f101fb61530_NeikiAnalytics.exe 82 PID 4048 wrote to memory of 1292 4048 explorer.exe 83 PID 4048 wrote to memory of 1292 4048 explorer.exe 83 PID 4048 wrote to memory of 1292 4048 explorer.exe 83 PID 1292 wrote to memory of 3328 1292 spoolsv.exe 84 PID 1292 wrote to memory of 3328 1292 spoolsv.exe 84 PID 1292 wrote to memory of 3328 1292 spoolsv.exe 84 PID 3328 wrote to memory of 4720 3328 svchost.exe 85 PID 3328 wrote to memory of 4720 3328 svchost.exe 85 PID 3328 wrote to memory of 4720 3328 svchost.exe 85 PID 3328 wrote to memory of 3568 3328 svchost.exe 86 PID 3328 wrote to memory of 3568 3328 svchost.exe 86 PID 3328 wrote to memory of 3568 3328 svchost.exe 86 PID 3328 wrote to memory of 3576 3328 svchost.exe 96 PID 3328 wrote to memory of 3576 3328 svchost.exe 96 PID 3328 wrote to memory of 3576 3328 svchost.exe 96 PID 3328 wrote to memory of 4204 3328 svchost.exe 98 PID 3328 wrote to memory of 4204 3328 svchost.exe 98 PID 3328 wrote to memory of 4204 3328 svchost.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\a77e262d8c49045fae718f101fb61530_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a77e262d8c49045fae718f101fb61530_NeikiAnalytics.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3876 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4048 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3328 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4720
-
-
C:\Windows\SysWOW64\at.exeat 16:53 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:3568
-
-
C:\Windows\SysWOW64\at.exeat 16:54 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:3576
-
-
C:\Windows\SysWOW64\at.exeat 16:55 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:4204
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\mrsys.exe
- Size 206KB
- SHA256 b65449b4f07fe992eab96351de407bc8c03647219fbf3c5a5fbcd9ab66ba7bf1
- MD5 88b9f968b104e15f97379c8f7852e45a
- SHA1 34acd8c8ecae2a05c064d4be08aee161dd146bef
- SHA512 9b105745d6f445e5c908f03b4fcfab54c97abeef14a5ea2a9fa94b97f709c1aed8f57e2d11cbcf58afc9d16de634ef3f1c499a872f22362c771df61a8648635d
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unLt:5vEN2U+T6i5LirrllHy4HUcMQY6Kt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\explorer.exe
- Size 206KB
- SHA256 c9dcd6b28068ac89b1750c1f323ad26e20fe0abdd0919622d4bf30cc65171019
- MD5 d2b9068d1afc7ee598da18d94daf1f1b
- SHA1 2f0a4116c137bc850c4c4be14a4058724ecae9f7
- SHA512 69cb37c3e87d7f0cb17321ebcaa5626bc465a44b16774ce0b8e117b30c8e771822ccf92a8c557cfe31362e2b9ce2c45d3545b9d2fbc43346546753db15404aab
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unLH:5vEN2U+T6i5LirrllHy4HUcMQY6KH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\spoolsv.exe
- Size 206KB
- SHA256 16256372582d3a2aff2da72c7ff9cb7423b8610549f09ec6896561ed4ea82948
- MD5 088587546ff85a063a5d6e17a6cc2ebb
- SHA1 ddc5f7f488a49926583a6c2c19e9f886b51051bd
- SHA512 052a7074c3eb41b53821864801565e91f1042f9c11dd1f20751ac7951c7d2b1462035227a0ce29eba7a5978b3b830830b5edd096ba883023589cd914686bdf49
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unLG:5vEN2U+T6i5LirrllHy4HUcMQY6KG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\svchost.exe
- Size 207KB
- SHA256 268f0db7fd0e398f10478aa66f68cd1508d2603099c5d773432f6b77c431a36f
- MD5 15f27f85f9748bdbcc754772c835e47b
- SHA1 c731a04f13ad34ac3b3f18793685b90cec64b964
- SHA512 51ebe76ee08dcc5f05b59a0fdb65c8d25beecd896ddddfc6e722d6a9f710f6864590f3891ad16678d48815c87538a560d9c97ae67bcea1ce67e7a90a94e733cc
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unL1:5vEN2U+T6i5LirrllHy4HUcMQY6K1
- MD5 SHA1 SHA512 SSDEEP