Analysis
- max time kernel
150s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
04/06/2024, 00:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
18a6b79158c3d0e9d80b183ff5a7f790_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
18a6b79158c3d0e9d80b183ff5a7f790_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 18a6b79158c3d0e9d80b183ff5a7f790_NeikiAnalytics.exe
- Size 206KB
- Sample240604-a3cwwafb6w
- SHA256 e7a786b037efc7d98cda61444c0b375098f549fd890c1170d28b9a39268a2471
- MD5 18a6b79158c3d0e9d80b183ff5a7f790
- SHA1 6d090300d9dcfe83400aa5920c8a7e147f4ba8d9
- SHA512 076a49a706d3f34fcc278f053a51f7e04c5b3072ee86d8873b861c4a24d0d6d7bab060649d4e2730e509036dc752c0a322fab0294d14b8d6e15c99e66c5ba4a6
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unLZ:5vEN2U+T6i5LirrllHy4HUcMQY6KZ
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Modifies Installed Components in the registry 2 TTPs 8 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe - Executes dropped EXE 4 IoCs
pid Process 1376 explorer.exe 1220 spoolsv.exe 2136 svchost.exe 4604 spoolsv.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe 18a6b79158c3d0e9d80b183ff5a7f790_NeikiAnalytics.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5100 18a6b79158c3d0e9d80b183ff5a7f790_NeikiAnalytics.exe 5100 18a6b79158c3d0e9d80b183ff5a7f790_NeikiAnalytics.exe 1376 explorer.exe 1376 explorer.exe 1376 explorer.exe 1376 explorer.exe 1376 explorer.exe 1376 explorer.exe 2136 svchost.exe 2136 svchost.exe 2136 svchost.exe 2136 svchost.exe 1376 explorer.exe 1376 explorer.exe 2136 svchost.exe 2136 svchost.exe 1376 explorer.exe 1376 explorer.exe 2136 svchost.exe 2136 svchost.exe 1376 explorer.exe 1376 explorer.exe 2136 svchost.exe 2136 svchost.exe 1376 explorer.exe 1376 explorer.exe 1376 explorer.exe 2136 svchost.exe 1376 explorer.exe 2136 svchost.exe 2136 svchost.exe 1376 explorer.exe 1376 explorer.exe 2136 svchost.exe 1376 explorer.exe 2136 svchost.exe 1376 explorer.exe 2136 svchost.exe 2136 svchost.exe 1376 explorer.exe 1376 explorer.exe 2136 svchost.exe 2136 svchost.exe 1376 explorer.exe 1376 explorer.exe 2136 svchost.exe 1376 explorer.exe 2136 svchost.exe 1376 explorer.exe 2136 svchost.exe 1376 explorer.exe 2136 svchost.exe 1376 explorer.exe 2136 svchost.exe 1376 explorer.exe 2136 svchost.exe 1376 explorer.exe 2136 svchost.exe 1376 explorer.exe 2136 svchost.exe 1376 explorer.exe 2136 svchost.exe 1376 explorer.exe 2136 svchost.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1376 explorer.exe 2136 svchost.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 5100 18a6b79158c3d0e9d80b183ff5a7f790_NeikiAnalytics.exe 5100 18a6b79158c3d0e9d80b183ff5a7f790_NeikiAnalytics.exe 1376 explorer.exe 1376 explorer.exe 1220 spoolsv.exe 1220 spoolsv.exe 2136 svchost.exe 2136 svchost.exe 4604 spoolsv.exe 4604 spoolsv.exe 1376 explorer.exe 1376 explorer.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 5100 wrote to memory of 1376 5100 18a6b79158c3d0e9d80b183ff5a7f790_NeikiAnalytics.exe 91 PID 5100 wrote to memory of 1376 5100 18a6b79158c3d0e9d80b183ff5a7f790_NeikiAnalytics.exe 91 PID 5100 wrote to memory of 1376 5100 18a6b79158c3d0e9d80b183ff5a7f790_NeikiAnalytics.exe 91 PID 1376 wrote to memory of 1220 1376 explorer.exe 92 PID 1376 wrote to memory of 1220 1376 explorer.exe 92 PID 1376 wrote to memory of 1220 1376 explorer.exe 92 PID 1220 wrote to memory of 2136 1220 spoolsv.exe 93 PID 1220 wrote to memory of 2136 1220 spoolsv.exe 93 PID 1220 wrote to memory of 2136 1220 spoolsv.exe 93 PID 2136 wrote to memory of 4604 2136 svchost.exe 94 PID 2136 wrote to memory of 4604 2136 svchost.exe 94 PID 2136 wrote to memory of 4604 2136 svchost.exe 94 PID 2136 wrote to memory of 4512 2136 svchost.exe 95 PID 2136 wrote to memory of 4512 2136 svchost.exe 95 PID 2136 wrote to memory of 4512 2136 svchost.exe 95 PID 2136 wrote to memory of 2140 2136 svchost.exe 116 PID 2136 wrote to memory of 2140 2136 svchost.exe 116 PID 2136 wrote to memory of 2140 2136 svchost.exe 116 PID 2136 wrote to memory of 2320 2136 svchost.exe 126 PID 2136 wrote to memory of 2320 2136 svchost.exe 126 PID 2136 wrote to memory of 2320 2136 svchost.exe 126
Processes
-
C:\Users\Admin\AppData\Local\Temp\18a6b79158c3d0e9d80b183ff5a7f790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\18a6b79158c3d0e9d80b183ff5a7f790_NeikiAnalytics.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1376 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4604
-
-
C:\Windows\SysWOW64\at.exeat 00:45 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:4512
-
-
C:\Windows\SysWOW64\at.exeat 00:46 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:2140
-
-
C:\Windows\SysWOW64\at.exeat 00:47 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:2320
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1036,i,13640054265074968359,8146127767143474550,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:81⤵PID:2160
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\mrsys.exe
- Size 206KB
- SHA256 115ec2b52ff74ef40d734795b9147cb45ceba0936d202d2d6c40e7a917997a02
- MD5 67f57a95a556f00164d3655870f0f51e
- SHA1 aa51a681eaae848dad974366d354f673ab0029e2
- SHA512 dd2d99a85ab457fe1d88d9f3f5a4016660f6760d68a91ba2c5d76552d9b77fc9f4b7da82ce57e05af64729f1a2016a628b32c62e21b1f42623a25056c4f7148a
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unL9:5vEN2U+T6i5LirrllHy4HUcMQY6K9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\explorer.exe
- Size 206KB
- SHA256 1023ef59d5088f9d82df8e320f7c0d8e39f8815e067119ab7677c0112ee167f0
- MD5 114e238f12bb9d6344fc8d1f6f04e876
- SHA1 5508033615ac8463cb81cb6bb853be6bda697041
- SHA512 95aa457c5abb14f4a7fed1de4d710338be92af717b16a960762cebad3fbbd1bdc9c7f7e673f2ed14ba4c1324f6653c71f968f47c5dcbab3ee078652fafee2e86
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unLN:5vEN2U+T6i5LirrllHy4HUcMQY6KN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\spoolsv.exe
- Size 206KB
- SHA256 78b4161412898c9ca423fa087b9ba528977b4d4184cdb9ed367577b8c3027237
- MD5 29775ad1b1de416968f125bc255100c0
- SHA1 59cba4f5876c552ce0164aa04ca5321bdf3d5619
- SHA512 dd4b5ea650e5cf08e50b652ec127022b85f9b7a26c8730e102df1164f3d6668b6133149957760b938837c00a9f406d44fa3efd5ab0672b8570d18166d6863404
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unLts:5vEN2U+T6i5LirrllHy4HUcMQY6K2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\svchost.exe
- Size 206KB
- SHA256 6fd9b3f3e3f2f84ed284702d0ca40b2b8e1fb7417f2a97c7570e9931bffdde8a
- MD5 4ecd479babaa65af886bb53c7ee0d60a
- SHA1 10fd725bd8d0723312fa985caf3d14d62edb70d3
- SHA512 02aeb967f2b49bbcf2d4e8383ac9672806115516adf3dbf00f8a4cdb442b04be1a2d023fe6f9aa06a3fbd8b01c6fcf092b442dd0cf398b8cd314bd415386a756
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unLf:5vEN2U+T6i5LirrllHy4HUcMQY6Kf
- MD5 SHA1 SHA512 SSDEEP