Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
04/06/2024, 01:44
Behavioral task
behavioral1
Sample
1e5a7c90f8ef875b5e92744c487bcdc0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
1e5a7c90f8ef875b5e92744c487bcdc0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target 1e5a7c90f8ef875b5e92744c487bcdc0_NeikiAnalytics.exe
- Size 222KB
- Sample240604-b5tsvaha4z
- SHA256 18ed275187c2a8bf4155cd558a5b8e5a86f0e752177b5e06523b3c32ede6fa7c
- MD5 1e5a7c90f8ef875b5e92744c487bcdc0
- SHA1 72328cdb5582c7a4e2081fece670e3045875e7b5
- SHA512 fdf5c58955ac4aa0478a5f4aa54bd9ffdea478d28eba07c5ab7d34ddb467f70e8a124c64470a86da84e498c6091d65368d92fa5f87637437ce5985a39e7ec30e
- SSDEEP 3072:psSYlMdU5Uj4o9hHbiJygCullUQN7gsBh1L1M:BdoUk8JmRleK771W
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Modifies Installed Components in the registry 2 TTPs 8 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe - Executes dropped EXE 4 IoCs
pid Process 216 explorer.exe 4276 spoolsv.exe 3296 svchost.exe 4008 spoolsv.exe -
resource yara_rule behavioral2/memory/3676-0-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/files/0x00090000000235db-7.dat upx behavioral2/files/0x00080000000235df-13.dat upx behavioral2/files/0x00080000000235e0-23.dat upx behavioral2/memory/4008-29-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4008-34-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4276-38-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3676-40-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/files/0x00080000000235e1-41.dat upx behavioral2/memory/216-42-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3296-43-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/216-44-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/216-45-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/216-49-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/216-51-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/216-55-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/216-59-0x0000000000400000-0x0000000000421000-memory.dmp upx - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe - Drops file in Windows directory 7 IoCs
description ioc Process File opened for modification \??\c:\windows\system\explorer.exe 1e5a7c90f8ef875b5e92744c487bcdc0_NeikiAnalytics.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe File opened for modification C:\Windows\System\tjud.exe explorer.exe File opened for modification C:\Windows\System\tjcm.cmn explorer.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3676 1e5a7c90f8ef875b5e92744c487bcdc0_NeikiAnalytics.exe 3676 1e5a7c90f8ef875b5e92744c487bcdc0_NeikiAnalytics.exe 216 explorer.exe 216 explorer.exe 216 explorer.exe 216 explorer.exe 216 explorer.exe 216 explorer.exe 216 explorer.exe 3296 svchost.exe 216 explorer.exe 3296 svchost.exe 3296 svchost.exe 3296 svchost.exe 3296 svchost.exe 216 explorer.exe 216 explorer.exe 3296 svchost.exe 3296 svchost.exe 216 explorer.exe 216 explorer.exe 3296 svchost.exe 3296 svchost.exe 216 explorer.exe 3296 svchost.exe 216 explorer.exe 216 explorer.exe 3296 svchost.exe 216 explorer.exe 3296 svchost.exe 216 explorer.exe 3296 svchost.exe 216 explorer.exe 3296 svchost.exe 216 explorer.exe 3296 svchost.exe 216 explorer.exe 3296 svchost.exe 3296 svchost.exe 216 explorer.exe 216 explorer.exe 3296 svchost.exe 3296 svchost.exe 216 explorer.exe 216 explorer.exe 3296 svchost.exe 216 explorer.exe 3296 svchost.exe 216 explorer.exe 3296 svchost.exe 216 explorer.exe 3296 svchost.exe 216 explorer.exe 3296 svchost.exe 216 explorer.exe 3296 svchost.exe 216 explorer.exe 3296 svchost.exe 216 explorer.exe 3296 svchost.exe 216 explorer.exe 3296 svchost.exe 216 explorer.exe 3296 svchost.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 216 explorer.exe 3296 svchost.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 3676 1e5a7c90f8ef875b5e92744c487bcdc0_NeikiAnalytics.exe 3676 1e5a7c90f8ef875b5e92744c487bcdc0_NeikiAnalytics.exe 216 explorer.exe 216 explorer.exe 4276 spoolsv.exe 4276 spoolsv.exe 3296 svchost.exe 3296 svchost.exe 4008 spoolsv.exe 4008 spoolsv.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3676 wrote to memory of 216 3676 1e5a7c90f8ef875b5e92744c487bcdc0_NeikiAnalytics.exe 90 PID 3676 wrote to memory of 216 3676 1e5a7c90f8ef875b5e92744c487bcdc0_NeikiAnalytics.exe 90 PID 3676 wrote to memory of 216 3676 1e5a7c90f8ef875b5e92744c487bcdc0_NeikiAnalytics.exe 90 PID 216 wrote to memory of 4276 216 explorer.exe 91 PID 216 wrote to memory of 4276 216 explorer.exe 91 PID 216 wrote to memory of 4276 216 explorer.exe 91 PID 4276 wrote to memory of 3296 4276 spoolsv.exe 92 PID 4276 wrote to memory of 3296 4276 spoolsv.exe 92 PID 4276 wrote to memory of 3296 4276 spoolsv.exe 92 PID 3296 wrote to memory of 4008 3296 svchost.exe 93 PID 3296 wrote to memory of 4008 3296 svchost.exe 93 PID 3296 wrote to memory of 4008 3296 svchost.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e5a7c90f8ef875b5e92744c487bcdc0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1e5a7c90f8ef875b5e92744c487bcdc0_NeikiAnalytics.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3676 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4276 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3296 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4008
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4552,i,14486271492189381216,15799931579469722648,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:81⤵PID:1180
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\mrsys.exe
- Size 222KB
- SHA256 6d7d1cef418e1ed341a5c8081ca87547e5002eea8d766f4ba474c933a05ffd3c
- MD5 6b8c8327e5489765996b078c4ab6659a
- SHA1 ddc6147bf0bda90b6ec2c3fdb3cd0609630c1e45
- SHA512 dce23919da035e3cad7e02cc7a868539153e901b9b8f60893d510bf07a36b2d42c722ff802e9ec71aeae53e5dcddbb837d854ff46c42a76b85c365e27db74162
- SSDEEP 3072:psSYlMdU5Uj4o9hHbiJygCullUQN7gsBh1L1n:BdoUk8JmRleK7719
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\explorer.exe
- Size 222KB
- SHA256 f06bec74a04b77a4a241be2c550760505ff3201837dee00652053a37d915d341
- MD5 84c950444d1381b403b8ff3da9d03646
- SHA1 38e9aa98494d9a0b99ef10525bfba6901a61554f
- SHA512 3c2ffd3b053eb54073b64200ba2abffb3c4c6fb2232f8da6ef66666a24b700f9da1e4d3e6c1f2a56749c0a258d94ba9b891d386fb87f4b3b40819f0a6e3df107
- SSDEEP 3072:psSYlMdU5Uj4o9hHbiJygCullUQN7gsBh1L1y:BdoUk8JmRleK771Y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\spoolsv.exe
- Size 222KB
- SHA256 5eb38bff170d91452cac4853f4d76f7ad8c8a3f1b1f6fc8c9df75d091cde6087
- MD5 731304797681ec5f6e0cab0dc2c364e1
- SHA1 374e2a444624e2091f041b4afd94f843e65451d7
- SHA512 5e9e8500efac41c214ab6f785d19526c8ea8a00c082b3b552ebcf579806e60d3fa31973998c2a3e8cd47d0a6982a831113a3d5e224887eb8b8d91030f2ae70a6
- SSDEEP 3072:psSYlMdU5Uj4o9hHbiJygCullUQN7gsBh1L1q:BdoUk8JmRleK771g
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\svchost.exe
- Size 222KB
- SHA256 b8fe0cb2b346c1638be30dd0f08534a40717fa508aee3443a09b62648fbfdb43
- MD5 133fd6d650a40fb749388c6b10ccd4d0
- SHA1 9627ab42c4b09bc3918cd6f2ab139171639adc00
- SHA512 4e456633cfc87e19ad8836b2aa1033c3f86b2ab4a8b6e36afcd6c5fdf7038a2c17920e941cfa6a325bfacb871e20e2bb9a8e856b287c9304c28e933a0ce51f8b
- SSDEEP 3072:psSYlMdU5Uj4o9hHbiJygCullUQN7gsBh1L1t:BdoUk8JmRleK771f
- MD5 SHA1 SHA512 SSDEEP