0e7d5ad6a29cf1bff20666d4f3b38327fc9adac35f7196fcf327c67fa0189bdc

Analysis

max time kernel
150s
max time network
126s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
06/06/2024, 16:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

136d1122ad4c00c5f10a13558842b630_NeikiAnalytics.exe
Size

65KB
MD5

136d1122ad4c00c5f10a13558842b630
SHA1

658b7ce961b1e03386be6c17b84a7af8cb4595dd
SHA256

0e7d5ad6a29cf1bff20666d4f3b38327fc9adac35f7196fcf327c67fa0189bdc
SHA512

39de3a3c3f5875982afa115390086c457b7ac8cc6e07ed82c128c04a6a35a29439f74495bede4496cec05a9e5e8c196f86ce53b61ad96190c39a83bf6705b53a
SSDEEP

1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuL:7WNqkOJWmo1HpM0MkTUmuL

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2872	explorer.exe
1372	spoolsv.exe
1868	svchost.exe
2580	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
2440	136d1122ad4c00c5f10a13558842b630_NeikiAnalytics.exe
2440	136d1122ad4c00c5f10a13558842b630_NeikiAnalytics.exe
2872	explorer.exe
2872	explorer.exe
1372	spoolsv.exe
1372	spoolsv.exe
1868	svchost.exe
1868	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	136d1122ad4c00c5f10a13558842b630_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2440	136d1122ad4c00c5f10a13558842b630_NeikiAnalytics.exe
2872	explorer.exe
2872	explorer.exe
2872	explorer.exe
2872	explorer.exe
1868	svchost.exe
1868	svchost.exe
2872	explorer.exe
1868	svchost.exe
2872	explorer.exe
1868	svchost.exe
2872	explorer.exe
1868	svchost.exe
2872	explorer.exe
1868	svchost.exe
2872	explorer.exe
1868	svchost.exe
2872	explorer.exe
1868	svchost.exe
2872	explorer.exe
1868	svchost.exe
2872	explorer.exe
1868	svchost.exe
2872	explorer.exe
1868	svchost.exe
2872	explorer.exe
1868	svchost.exe
2872	explorer.exe
1868	svchost.exe
2872	explorer.exe
1868	svchost.exe
2872	explorer.exe
1868	svchost.exe
2872	explorer.exe
1868	svchost.exe
2872	explorer.exe
1868	svchost.exe
2872	explorer.exe
1868	svchost.exe
2872	explorer.exe
1868	svchost.exe
2872	explorer.exe
1868	svchost.exe
2872	explorer.exe
1868	svchost.exe
2872	explorer.exe
1868	svchost.exe
2872	explorer.exe
1868	svchost.exe
2872	explorer.exe
1868	svchost.exe
2872	explorer.exe
1868	svchost.exe
2872	explorer.exe
1868	svchost.exe
2872	explorer.exe
1868	svchost.exe
2872	explorer.exe
1868	svchost.exe
2872	explorer.exe
1868	svchost.exe
2872	explorer.exe
1868	svchost.exe
2872	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2872	explorer.exe
1868	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2440	136d1122ad4c00c5f10a13558842b630_NeikiAnalytics.exe
2440	136d1122ad4c00c5f10a13558842b630_NeikiAnalytics.exe
2872	explorer.exe
2872	explorer.exe
1372	spoolsv.exe
1372	spoolsv.exe
1868	svchost.exe
1868	svchost.exe
2580	spoolsv.exe
2580	spoolsv.exe
2872	explorer.exe
2872	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2872	2440	136d1122ad4c00c5f10a13558842b630_NeikiAnalytics.exe	28
PID 2440 wrote to memory of 2872	2440	136d1122ad4c00c5f10a13558842b630_NeikiAnalytics.exe	28
PID 2440 wrote to memory of 2872	2440	136d1122ad4c00c5f10a13558842b630_NeikiAnalytics.exe	28
PID 2440 wrote to memory of 2872	2440	136d1122ad4c00c5f10a13558842b630_NeikiAnalytics.exe	28
PID 2872 wrote to memory of 1372	2872	explorer.exe	29
PID 2872 wrote to memory of 1372	2872	explorer.exe	29
PID 2872 wrote to memory of 1372	2872	explorer.exe	29
PID 2872 wrote to memory of 1372	2872	explorer.exe	29
PID 1372 wrote to memory of 1868	1372	spoolsv.exe	30
PID 1372 wrote to memory of 1868	1372	spoolsv.exe	30
PID 1372 wrote to memory of 1868	1372	spoolsv.exe	30
PID 1372 wrote to memory of 1868	1372	spoolsv.exe	30
PID 1868 wrote to memory of 2580	1868	svchost.exe	31
PID 1868 wrote to memory of 2580	1868	svchost.exe	31
PID 1868 wrote to memory of 2580	1868	svchost.exe	31
PID 1868 wrote to memory of 2580	1868	svchost.exe	31
PID 1868 wrote to memory of 340	1868	svchost.exe	32
PID 1868 wrote to memory of 340	1868	svchost.exe	32
PID 1868 wrote to memory of 340	1868	svchost.exe	32
PID 1868 wrote to memory of 340	1868	svchost.exe	32
PID 1868 wrote to memory of 1692	1868	svchost.exe	36
PID 1868 wrote to memory of 1692	1868	svchost.exe	36
PID 1868 wrote to memory of 1692	1868	svchost.exe	36
PID 1868 wrote to memory of 1692	1868	svchost.exe	36
PID 1868 wrote to memory of 1840	1868	svchost.exe	38
PID 1868 wrote to memory of 1840	1868	svchost.exe	38
PID 1868 wrote to memory of 1840	1868	svchost.exe	38
PID 1868 wrote to memory of 1840	1868	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\136d1122ad4c00c5f10a13558842b630_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\136d1122ad4c00c5f10a13558842b630_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2872
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1372
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1868
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2580
    - - C:\Windows\SysWOW64\at.exe
        
        at 16:32 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:340
    - - C:\Windows\SysWOW64\at.exe
        
        at 16:33 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1692
    - - C:\Windows\SysWOW64\at.exe
        
        at 16:34 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
65KB

MD5
a407c7e7894091bccea478806efa8416

SHA1
a4fc74868569bcb517850fe97fda8b4d67e48668

SHA256
1e3b542ee6d3a0844ceea746eea5bfc38369efd820e1f4f77584049ebbebc506

SHA512
df4d14546d3fcb8da17aebe46277d4da2995abeb7e8eccf8c0e5808ad86163c3bb67f8f0fc249f0d3a51eeaaf570db0d005d454f12f60b915d091f36c6331112

Download Submit
\Windows\system\explorer.exe

Filesize
65KB

MD5
532f5946f6699f015831df3ff56cf0de

SHA1
bc0d093a2c79fd0c7f81e59988d72dac4dddb7b5

SHA256
d91d14fcdeca4469e7c51fc72c03a67828099b2cda1267f2212281b1d12c45d9

SHA512
5e974ea9778f2bf428270ee28705ae08b306e6139838a02c7c55e1c2caebb821f1eeb8110a7a87eb04659ef4bd1d5ed6be03acd65349b2c3ada7bef437923458

Download Submit
\Windows\system\spoolsv.exe

Filesize
65KB

MD5
a227b91e2839a248ac36c128d7ca067f

SHA1
a0a60285705f2ed204be58e6d3687dee1eac6d24

SHA256
e480e73d4e351f2187e740adef35f37061816f0f8c5dc0251a43dd1b864a6bac

SHA512
dedb156718b2cf00b489b1831c66262bd00de4db408358a33f205e2f71a263c3ace40df389c3ecc75d65a12a4ac0ac0b62ba4ec2c1efdd3a42e45dfa6fa7798b

Download Submit
\Windows\system\svchost.exe

Filesize
65KB

MD5
f07d53187ca957a33b4b4408fec8e259

SHA1
659133740d1bd8a0a7a9a2b2d3537cfaea38303d

SHA256
ab9944ad77bd49753a996b429ab3b48f4e9816c175b255b3bf9d24a2b0f3eec7

SHA512
c1afd18f673a3e99efe20eeec7bd71c99788b25f4b3c258f01dc9e4c08ee8ae546a9fa368421f51132a404de5a491f472448c2cc9a39dae9441debd427c8cfd6

Download Submit
memory/1372-75-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1372-43-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1372-37-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/1868-83-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1868-53-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/1868-59-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2440-78-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2440-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2440-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2440-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2440-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2440-58-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2440-17-0x0000000000760000-0x0000000000791000-memory.dmp

Filesize
196KB

Download
memory/2440-77-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2440-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2440-64-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2580-71-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2580-66-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2580-65-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2872-36-0x0000000001E80000-0x0000000001EB1000-memory.dmp

Filesize
196KB

Download
memory/2872-18-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2872-19-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2872-80-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2872-81-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2872-23-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2872-92-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2872-30-0x0000000001E80000-0x0000000001EB1000-memory.dmp

Filesize
196KB

Download