7de2c19c7ee99b48e19d48e04f95efc542e06fdb284a4f3f7eb51e5fabcd594e

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
06/06/2024, 19:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08a09158b799ec0798be26fff576bf70_NeikiAnalytics.exe
Size

66KB
MD5

08a09158b799ec0798be26fff576bf70
SHA1

f072dd81838804709916d3487dd24ec663978139
SHA256

7de2c19c7ee99b48e19d48e04f95efc542e06fdb284a4f3f7eb51e5fabcd594e
SHA512

4dacfc088bdc9409d0c0804b2f8d0d780244aa53a50dfd5596e78fc806c3c6491d7987a7df3cd8ffa7ad583c125a5d016ddda8ad75f70285ea80297f19671758
SSDEEP

1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXi6:IeklMMYJhqezw/pXzH9i6

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2944	explorer.exe
2676	spoolsv.exe
2584	svchost.exe
2580	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
1720	08a09158b799ec0798be26fff576bf70_NeikiAnalytics.exe
1720	08a09158b799ec0798be26fff576bf70_NeikiAnalytics.exe
2944	explorer.exe
2944	explorer.exe
2676	spoolsv.exe
2676	spoolsv.exe
2584	svchost.exe
2584	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	08a09158b799ec0798be26fff576bf70_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1720	08a09158b799ec0798be26fff576bf70_NeikiAnalytics.exe
2944	explorer.exe
2944	explorer.exe
2944	explorer.exe
2944	explorer.exe
2584	svchost.exe
2584	svchost.exe
2584	svchost.exe
2944	explorer.exe
2584	svchost.exe
2944	explorer.exe
2584	svchost.exe
2944	explorer.exe
2944	explorer.exe
2584	svchost.exe
2944	explorer.exe
2584	svchost.exe
2944	explorer.exe
2584	svchost.exe
2584	svchost.exe
2944	explorer.exe
2944	explorer.exe
2584	svchost.exe
2944	explorer.exe
2584	svchost.exe
2584	svchost.exe
2944	explorer.exe
2584	svchost.exe
2944	explorer.exe
2944	explorer.exe
2584	svchost.exe
2584	svchost.exe
2944	explorer.exe
2944	explorer.exe
2584	svchost.exe
2944	explorer.exe
2584	svchost.exe
2944	explorer.exe
2584	svchost.exe
2584	svchost.exe
2944	explorer.exe
2944	explorer.exe
2584	svchost.exe
2584	svchost.exe
2944	explorer.exe
2584	svchost.exe
2944	explorer.exe
2944	explorer.exe
2584	svchost.exe
2944	explorer.exe
2584	svchost.exe
2944	explorer.exe
2584	svchost.exe
2944	explorer.exe
2584	svchost.exe
2944	explorer.exe
2584	svchost.exe
2944	explorer.exe
2584	svchost.exe
2944	explorer.exe
2584	svchost.exe
2944	explorer.exe
2584	svchost.exe
2584	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2944	explorer.exe
2584	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1720	08a09158b799ec0798be26fff576bf70_NeikiAnalytics.exe
1720	08a09158b799ec0798be26fff576bf70_NeikiAnalytics.exe
2944	explorer.exe
2944	explorer.exe
2676	spoolsv.exe
2676	spoolsv.exe
2584	svchost.exe
2584	svchost.exe
2580	spoolsv.exe
2580	spoolsv.exe
2944	explorer.exe
2944	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2944	1720	08a09158b799ec0798be26fff576bf70_NeikiAnalytics.exe	29
PID 1720 wrote to memory of 2944	1720	08a09158b799ec0798be26fff576bf70_NeikiAnalytics.exe	29
PID 1720 wrote to memory of 2944	1720	08a09158b799ec0798be26fff576bf70_NeikiAnalytics.exe	29
PID 1720 wrote to memory of 2944	1720	08a09158b799ec0798be26fff576bf70_NeikiAnalytics.exe	29
PID 2944 wrote to memory of 2676	2944	explorer.exe	30
PID 2944 wrote to memory of 2676	2944	explorer.exe	30
PID 2944 wrote to memory of 2676	2944	explorer.exe	30
PID 2944 wrote to memory of 2676	2944	explorer.exe	30
PID 2676 wrote to memory of 2584	2676	spoolsv.exe	31
PID 2676 wrote to memory of 2584	2676	spoolsv.exe	31
PID 2676 wrote to memory of 2584	2676	spoolsv.exe	31
PID 2676 wrote to memory of 2584	2676	spoolsv.exe	31
PID 2584 wrote to memory of 2580	2584	svchost.exe	32
PID 2584 wrote to memory of 2580	2584	svchost.exe	32
PID 2584 wrote to memory of 2580	2584	svchost.exe	32
PID 2584 wrote to memory of 2580	2584	svchost.exe	32
PID 2584 wrote to memory of 2268	2584	svchost.exe	33
PID 2584 wrote to memory of 2268	2584	svchost.exe	33
PID 2584 wrote to memory of 2268	2584	svchost.exe	33
PID 2584 wrote to memory of 2268	2584	svchost.exe	33
PID 2584 wrote to memory of 2508	2584	svchost.exe	37
PID 2584 wrote to memory of 2508	2584	svchost.exe	37
PID 2584 wrote to memory of 2508	2584	svchost.exe	37
PID 2584 wrote to memory of 2508	2584	svchost.exe	37
PID 2584 wrote to memory of 1596	2584	svchost.exe	39
PID 2584 wrote to memory of 1596	2584	svchost.exe	39
PID 2584 wrote to memory of 1596	2584	svchost.exe	39
PID 2584 wrote to memory of 1596	2584	svchost.exe	39

C:\Users\Admin\AppData\Local\Temp\08a09158b799ec0798be26fff576bf70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\08a09158b799ec0798be26fff576bf70_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2944
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2676
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2584
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2580
    - - C:\Windows\SysWOW64\at.exe
        
        at 19:24 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2268
    - - C:\Windows\SysWOW64\at.exe
        
        at 19:25 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2508
    - - C:\Windows\SysWOW64\at.exe
        
        at 19:26 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
66KB

MD5
2cd206bdd1c185e3395a3be723bbe17e

SHA1
2133950a60df210353c1a63c46a1588e7e85e52b

SHA256
6dd602e6461756cfab2d6c5ad81d78f0a0ead149700ff2c9b6502c2cdac444a6

SHA512
a8b5c6d96a0abac2b3eb46aedb37a82190d04daccb081d80770fa3f63af72d44bf05ac448e770c1448f232e540e4e86a6e4a2e1d0f756460f2c60a643c000945

Download Submit
C:\Windows\system\explorer.exe

Filesize
66KB

MD5
eb6518a153afadbfd52d51a5cb8db099

SHA1
57f72ed55c3bdf220f2deada4cbfce7389ee63aa

SHA256
15be68cac251cf5a777418840bdbd2d1bdb2a8ddd5ec3585515ffdaaa1e0f123

SHA512
dd76e1ca4b23b64b03d6df0d793232bbc0beea756cad0d1c936e853a662025669b89da19988fc3e2a5f1ec595cadefdf1bf494f0279fd91dd7125766d2404ef7

Download Submit
C:\Windows\system\svchost.exe

Filesize
66KB

MD5
c6b3d73d99c6b12a74972d1e2c1caee1

SHA1
d0618a4e053273b8ccd37dc5c571188eaa87591a

SHA256
11b0b4d7390c1da2b5e7f7f405c26d4a0007d942048aafcd8ddd8998f8f7806a

SHA512
a317d8e0b142dfcfcf46ea03300184e69a35d200696e18d00c9a9608c197715506c9cee04a068181006c027ef660c937208fa9132e0614a39f3599fc7607746b

Download Submit
\Windows\system\spoolsv.exe

Filesize
66KB

MD5
6e1b76e4b78b1ecb1bb838b821dec201

SHA1
240d975298cc6cc7e00345bf3c63430b10b32973

SHA256
98a33534203734361fcc3c4d3de413f1f0efe88814967288c04184c010762f82

SHA512
75ca0559bb0be080426311726225121ab870d536d0ce71a4cefd819006062399a9ff23c7f19c9c3d8d8436e1c89ec18455d74227df5f2fabbfd6a58a42d1b9bf

Download Submit
memory/1720-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/1720-79-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1720-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/1720-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1720-17-0x0000000003110000-0x0000000003141000-memory.dmp

Filesize
196KB

Download
memory/1720-78-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1720-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1720-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2580-64-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2580-72-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2580-70-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2584-83-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2584-67-0x00000000025C0000-0x00000000025F1000-memory.dmp

Filesize
196KB

Download
memory/2584-54-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2584-58-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2676-37-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2676-45-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2676-76-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2676-53-0x0000000001EE0000-0x0000000001F11000-memory.dmp

Filesize
196KB

Download
memory/2944-34-0x0000000002510000-0x0000000002541000-memory.dmp

Filesize
196KB

Download
memory/2944-35-0x0000000002510000-0x0000000002541000-memory.dmp

Filesize
196KB

Download
memory/2944-23-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2944-18-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2944-81-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2944-19-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2944-92-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download