7de2c19c7ee99b48e19d48e04f95efc542e06fdb284a4f3f7eb51e5fabcd594e

Analysis

max time kernel
150s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
06-06-2024 19:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08a09158b799ec0798be26fff576bf70_NeikiAnalytics.exe
Size

66KB
MD5

08a09158b799ec0798be26fff576bf70
SHA1

f072dd81838804709916d3487dd24ec663978139
SHA256

7de2c19c7ee99b48e19d48e04f95efc542e06fdb284a4f3f7eb51e5fabcd594e
SHA512

4dacfc088bdc9409d0c0804b2f8d0d780244aa53a50dfd5596e78fc806c3c6491d7987a7df3cd8ffa7ad583c125a5d016ddda8ad75f70285ea80297f19671758
SSDEEP

1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXi6:IeklMMYJhqezw/pXzH9i6

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
5032	explorer.exe
4612	spoolsv.exe
1260	svchost.exe
848	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	08a09158b799ec0798be26fff576bf70_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3088	08a09158b799ec0798be26fff576bf70_NeikiAnalytics.exe
3088	08a09158b799ec0798be26fff576bf70_NeikiAnalytics.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
1260	svchost.exe
1260	svchost.exe
1260	svchost.exe
1260	svchost.exe
5032	explorer.exe
1260	svchost.exe
5032	explorer.exe
1260	svchost.exe
1260	svchost.exe
5032	explorer.exe
1260	svchost.exe
5032	explorer.exe
5032	explorer.exe
1260	svchost.exe
5032	explorer.exe
1260	svchost.exe
5032	explorer.exe
1260	svchost.exe
1260	svchost.exe
5032	explorer.exe
5032	explorer.exe
1260	svchost.exe
5032	explorer.exe
1260	svchost.exe
5032	explorer.exe
1260	svchost.exe
5032	explorer.exe
1260	svchost.exe
1260	svchost.exe
5032	explorer.exe
5032	explorer.exe
1260	svchost.exe
1260	svchost.exe
1260	svchost.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
1260	svchost.exe
5032	explorer.exe
1260	svchost.exe
1260	svchost.exe
1260	svchost.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
1260	svchost.exe
5032	explorer.exe
1260	svchost.exe
5032	explorer.exe
1260	svchost.exe
5032	explorer.exe
1260	svchost.exe
1260	svchost.exe
5032	explorer.exe
1260	svchost.exe
5032	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5032	explorer.exe
1260	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3088	08a09158b799ec0798be26fff576bf70_NeikiAnalytics.exe
3088	08a09158b799ec0798be26fff576bf70_NeikiAnalytics.exe
5032	explorer.exe
5032	explorer.exe
4612	spoolsv.exe
4612	spoolsv.exe
1260	svchost.exe
1260	svchost.exe
848	spoolsv.exe
848	spoolsv.exe
5032	explorer.exe
5032	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 5032	3088	08a09158b799ec0798be26fff576bf70_NeikiAnalytics.exe	82
PID 3088 wrote to memory of 5032	3088	08a09158b799ec0798be26fff576bf70_NeikiAnalytics.exe	82
PID 3088 wrote to memory of 5032	3088	08a09158b799ec0798be26fff576bf70_NeikiAnalytics.exe	82
PID 5032 wrote to memory of 4612	5032	explorer.exe	83
PID 5032 wrote to memory of 4612	5032	explorer.exe	83
PID 5032 wrote to memory of 4612	5032	explorer.exe	83
PID 4612 wrote to memory of 1260	4612	spoolsv.exe	84
PID 4612 wrote to memory of 1260	4612	spoolsv.exe	84
PID 4612 wrote to memory of 1260	4612	spoolsv.exe	84
PID 1260 wrote to memory of 848	1260	svchost.exe	86
PID 1260 wrote to memory of 848	1260	svchost.exe	86
PID 1260 wrote to memory of 848	1260	svchost.exe	86
PID 1260 wrote to memory of 392	1260	svchost.exe	87
PID 1260 wrote to memory of 392	1260	svchost.exe	87
PID 1260 wrote to memory of 392	1260	svchost.exe	87
PID 1260 wrote to memory of 1980	1260	svchost.exe	98
PID 1260 wrote to memory of 1980	1260	svchost.exe	98
PID 1260 wrote to memory of 1980	1260	svchost.exe	98
PID 1260 wrote to memory of 4796	1260	svchost.exe	100
PID 1260 wrote to memory of 4796	1260	svchost.exe	100
PID 1260 wrote to memory of 4796	1260	svchost.exe	100

C:\Users\Admin\AppData\Local\Temp\08a09158b799ec0798be26fff576bf70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\08a09158b799ec0798be26fff576bf70_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3088
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5032
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4612
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1260
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:848
    - - C:\Windows\SysWOW64\at.exe
        
        at 19:24 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:392
    - - C:\Windows\SysWOW64\at.exe
        
        at 19:25 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1980
    - - C:\Windows\SysWOW64\at.exe
        
        at 19:26 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:4796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
66KB

MD5
f3245d5c81a5bdb0c0ee75accbc6a61a

SHA1
5443a622ba1a03e29d12911781877265acacae48

SHA256
07578769ffb18c144ca5166b669e79cc9f3865897c78c871cc3ce8a945e47411

SHA512
0f57cb59b31de2bdd2d82cd076213503381640cff649e54ae6a8d2a29ae24e8c25a6bc1196e7da2debb53469986ad4bbc827183a7fd866792e5e4769f11a0337

Download Submit
C:\Windows\System\explorer.exe

Filesize
66KB

MD5
b29c83d468ce180ac7369a45337d3a76

SHA1
8244e527ef7076fe6056a5869265a03f0a42d5fe

SHA256
446d75643fac89ad2b2c15d2fc4cbfd8f8a47295f17629489b47b4b2117a4d9f

SHA512
36a02eadfa8e1edd9c2e9b73a73578e89c614888d8d62e950efd782047f1a2b03dfafb2f168a53ed0ee10046e8b9da032e5127ed99de3cf84bbe0018cf9f619e

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
66KB

MD5
8f7510a28201abea38bb870a1baecfae

SHA1
5265eaf87d78c525d292d4575de21cb49ef300b6

SHA256
eb16382919dcbdb7f4b8d7bd8e31db8d429c3c443668e86d84ef6d674d2e8e14

SHA512
0d01907ee5bcc9826d6a26681a02b90d593ab888086d1a35ac3d764e8431c0ae73b557bdae8cc65ff18e9d7a656d2179b599c2df051156f9b17fafaf55d2d40c

Download Submit
C:\Windows\System\svchost.exe

Filesize
66KB

MD5
490c84b3cbed1d70d20f60763ee30370

SHA1
d77cb52b1a7b57b6a25dbc06e8a4c451e93a8278

SHA256
d68b0fde1bf631e59300fc46ef67b2d5d7ac4475e0e9d446eed600abdb3c94c5

SHA512
698243db535faeeaba2ec472b3053c1454a43b964471352a28f862eca498e3cba76b1434db1395c6d8642377139b8e3617c784cf14810a1c4aefae2372534a8a

Download Submit
memory/848-49-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/848-43-0x00000000757F0000-0x000000007594D000-memory.dmp

Filesize
1.4MB

Download
memory/1260-41-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1260-60-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1260-36-0x00000000757F0000-0x000000007594D000-memory.dmp

Filesize
1.4MB

Download
memory/3088-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/3088-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3088-57-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/3088-56-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3088-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3088-2-0x00000000757F0000-0x000000007594D000-memory.dmp

Filesize
1.4MB

Download
memory/3088-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

Filesize
16KB

Download
memory/4612-53-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4612-26-0x00000000757F0000-0x000000007594D000-memory.dmp

Filesize
1.4MB

Download
memory/4612-25-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/5032-13-0x00000000757F0000-0x000000007594D000-memory.dmp

Filesize
1.4MB

Download
memory/5032-58-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/5032-16-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/5032-69-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/5032-15-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download