023ba237012a2032267ca40442a5bbbc1237f1414cef5fb37b099b543136329d

Analysis

max time kernel
150s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 23:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

769cb826ac9a9994e1b505dc986e8670_NeikiAnalytics.exe
Size

66KB
MD5

769cb826ac9a9994e1b505dc986e8670
SHA1

e40cc3f7374a354e795e548bea42bef34dd92c90
SHA256

023ba237012a2032267ca40442a5bbbc1237f1414cef5fb37b099b543136329d
SHA512

f6fe44335d86067c5262be97039ffcccf44fa54c93f567b1a51b66f3618a367189dcbf6c65f8c159a8d641700109b4d98a9ef3779baa677564140b3350575800
SSDEEP

1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiy:IeklMMYJhqezw/pXzH9iy

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Executes dropped EXE 4 IoCs

pid	Process
220	explorer.exe
1592	spoolsv.exe
536	svchost.exe
1856	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	769cb826ac9a9994e1b505dc986e8670_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2860	769cb826ac9a9994e1b505dc986e8670_NeikiAnalytics.exe
2860	769cb826ac9a9994e1b505dc986e8670_NeikiAnalytics.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
536	svchost.exe
536	svchost.exe
536	svchost.exe
536	svchost.exe
220	explorer.exe
220	explorer.exe
536	svchost.exe
536	svchost.exe
220	explorer.exe
220	explorer.exe
536	svchost.exe
536	svchost.exe
220	explorer.exe
220	explorer.exe
536	svchost.exe
536	svchost.exe
220	explorer.exe
220	explorer.exe
536	svchost.exe
536	svchost.exe
220	explorer.exe
220	explorer.exe
536	svchost.exe
536	svchost.exe
220	explorer.exe
220	explorer.exe
536	svchost.exe
536	svchost.exe
220	explorer.exe
220	explorer.exe
536	svchost.exe
220	explorer.exe
220	explorer.exe
536	svchost.exe
536	svchost.exe
536	svchost.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
536	svchost.exe
536	svchost.exe
220	explorer.exe
220	explorer.exe
536	svchost.exe
220	explorer.exe
536	svchost.exe
536	svchost.exe
536	svchost.exe
220	explorer.exe
220	explorer.exe
220	explorer.exe
536	svchost.exe
536	svchost.exe
220	explorer.exe
220	explorer.exe
536	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
220	explorer.exe
536	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2860	769cb826ac9a9994e1b505dc986e8670_NeikiAnalytics.exe
2860	769cb826ac9a9994e1b505dc986e8670_NeikiAnalytics.exe
220	explorer.exe
220	explorer.exe
1592	spoolsv.exe
1592	spoolsv.exe
536	svchost.exe
536	svchost.exe
1856	spoolsv.exe
1856	spoolsv.exe
220	explorer.exe
220	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 220	2860	769cb826ac9a9994e1b505dc986e8670_NeikiAnalytics.exe	82
PID 2860 wrote to memory of 220	2860	769cb826ac9a9994e1b505dc986e8670_NeikiAnalytics.exe	82
PID 2860 wrote to memory of 220	2860	769cb826ac9a9994e1b505dc986e8670_NeikiAnalytics.exe	82
PID 220 wrote to memory of 1592	220	explorer.exe	83
PID 220 wrote to memory of 1592	220	explorer.exe	83
PID 220 wrote to memory of 1592	220	explorer.exe	83
PID 1592 wrote to memory of 536	1592	spoolsv.exe	84
PID 1592 wrote to memory of 536	1592	spoolsv.exe	84
PID 1592 wrote to memory of 536	1592	spoolsv.exe	84
PID 536 wrote to memory of 1856	536	svchost.exe	86
PID 536 wrote to memory of 1856	536	svchost.exe	86
PID 536 wrote to memory of 1856	536	svchost.exe	86
PID 536 wrote to memory of 3288	536	svchost.exe	87
PID 536 wrote to memory of 3288	536	svchost.exe	87
PID 536 wrote to memory of 3288	536	svchost.exe	87
PID 536 wrote to memory of 4012	536	svchost.exe	100
PID 536 wrote to memory of 4012	536	svchost.exe	100
PID 536 wrote to memory of 4012	536	svchost.exe	100
PID 536 wrote to memory of 4696	536	svchost.exe	102
PID 536 wrote to memory of 4696	536	svchost.exe	102
PID 536 wrote to memory of 4696	536	svchost.exe	102

C:\Users\Admin\AppData\Local\Temp\769cb826ac9a9994e1b505dc986e8670_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\769cb826ac9a9994e1b505dc986e8670_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:220
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1592
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:536
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1856
    - - C:\Windows\SysWOW64\at.exe
        
        at 23:25 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:3288
    - - C:\Windows\SysWOW64\at.exe
        
        at 23:26 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:4012
    - - C:\Windows\SysWOW64\at.exe
        
        at 23:27 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:4696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
66KB

MD5
73de097e5acd8784266a0b1efea04100

SHA1
b1c40e946a891b5ef9aea13952693d9de51ed310

SHA256
9ce364de666f9dff750ce6680c5e7463aeffea909ccaba4ed35c83014c87c5e6

SHA512
e6a273614685def18b2c262a4c8c920c8951c6147dbc1bed7f7d3dfa5d82e26d01204fc595bc01514d436c0e30f481b6566808d85bfdc565c780fa1e223ef2df

Download Submit
C:\Windows\System\explorer.exe

Filesize
66KB

MD5
6763a2a3adc66d3fa07a89eef7f2f949

SHA1
7253f1e78462b11ba1c12d34640d06f4fcedf155

SHA256
824f5e2f7c9013e23363d0b4afd868ba77ca600a48cd616d7213ac27d9b23a15

SHA512
076e942c2d81d546dc835e3b88f8196cf61563c7997579cdb20c6598f422e8b9c5523b4bec6da506ca084c23d3fffbf2be2f4057f63a358eb6096c52433e0ef3

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
66KB

MD5
3bcede5817292862db75adb9a3a285fc

SHA1
b2f687c17d50dc738544fd4c175711e7e5eee60a

SHA256
1910d4e0b194d27f8d8d76a781a6d19ad13b5c2afd2541f94f0e9dc11663f990

SHA512
0235bb09982a3127f8639b4dee9b064f6a3fc04ebd29eb576bfe5005be11c2e1269f3b88f0d1f5a6049173c92381d1e845bc30509832b50fc72dde08321a5246

Download Submit
C:\Windows\System\svchost.exe

Filesize
66KB

MD5
9a6382981b920b82d761ecaccdc3315a

SHA1
ad4e34f5401104aac1940f1932a44029218376a2

SHA256
a32c7079d517dbe8515d7c12eb1ca788e2d86c5d04d4f52f107413e375b2739b

SHA512
ca997214e1414b3b2d9119847870deac14dc2a779527bc54d09391bd84cd8ddee369f02b86521c43f1b0fe4739d04fb2f8f04bfda9fd350e080eeaf65a17881c

Download Submit
memory/220-13-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/220-68-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/220-16-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/220-14-0x00000000752A0000-0x00000000753FD000-memory.dmp

Filesize
1.4MB

Download
memory/220-57-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/536-36-0x00000000752A0000-0x00000000753FD000-memory.dmp

Filesize
1.4MB

Download
memory/536-59-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/536-40-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/536-35-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1592-53-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1592-25-0x00000000752A0000-0x00000000753FD000-memory.dmp

Filesize
1.4MB

Download
memory/1856-43-0x00000000752A0000-0x00000000753FD000-memory.dmp

Filesize
1.4MB

Download
memory/1856-49-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2860-1-0x00000000752A0000-0x00000000753FD000-memory.dmp

Filesize
1.4MB

Download
memory/2860-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2860-2-0x00000000001C0000-0x00000000001C4000-memory.dmp

Filesize
16KB

Download
memory/2860-55-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2860-56-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2860-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2860-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download