660f40e3d538ea675e4114bd7290e1a184f4c91c53b732d8c375a6142a8a105b

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/06/2024, 12:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

59e05d8c234b2d0f1da1867d33b5c760_NeikiAnalytics.exe
Size

65KB
MD5

59e05d8c234b2d0f1da1867d33b5c760
SHA1

4d491ea435b2d5cdfebfaa3473017adb6b35f725
SHA256

660f40e3d538ea675e4114bd7290e1a184f4c91c53b732d8c375a6142a8a105b
SHA512

31a58fcdb1fd65b67bab71935b0d8e18d42d2154cdd67323e1613c7a61c5643ecf37964de0ad731ea50846b5e16eb4ce279846ec30329c3fa2fdc788ebe32e30
SSDEEP

1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuE:7WNqkOJWmo1HpM0MkTUmuE

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2620	explorer.exe
2676	spoolsv.exe
2668	svchost.exe
2648	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
1808	59e05d8c234b2d0f1da1867d33b5c760_NeikiAnalytics.exe
1808	59e05d8c234b2d0f1da1867d33b5c760_NeikiAnalytics.exe
2620	explorer.exe
2620	explorer.exe
2676	spoolsv.exe
2676	spoolsv.exe
2668	svchost.exe
2668	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	59e05d8c234b2d0f1da1867d33b5c760_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1808	59e05d8c234b2d0f1da1867d33b5c760_NeikiAnalytics.exe
2620	explorer.exe
2620	explorer.exe
2620	explorer.exe
2620	explorer.exe
2668	svchost.exe
2668	svchost.exe
2620	explorer.exe
2668	svchost.exe
2668	svchost.exe
2620	explorer.exe
2668	svchost.exe
2620	explorer.exe
2620	explorer.exe
2668	svchost.exe
2668	svchost.exe
2620	explorer.exe
2668	svchost.exe
2620	explorer.exe
2620	explorer.exe
2668	svchost.exe
2620	explorer.exe
2668	svchost.exe
2668	svchost.exe
2620	explorer.exe
2668	svchost.exe
2620	explorer.exe
2668	svchost.exe
2620	explorer.exe
2620	explorer.exe
2668	svchost.exe
2668	svchost.exe
2620	explorer.exe
2620	explorer.exe
2668	svchost.exe
2668	svchost.exe
2620	explorer.exe
2620	explorer.exe
2668	svchost.exe
2668	svchost.exe
2620	explorer.exe
2668	svchost.exe
2620	explorer.exe
2620	explorer.exe
2668	svchost.exe
2620	explorer.exe
2668	svchost.exe
2668	svchost.exe
2620	explorer.exe
2620	explorer.exe
2668	svchost.exe
2668	svchost.exe
2620	explorer.exe
2620	explorer.exe
2668	svchost.exe
2668	svchost.exe
2620	explorer.exe
2620	explorer.exe
2668	svchost.exe
2620	explorer.exe
2668	svchost.exe
2668	svchost.exe
2620	explorer.exe
2668	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2620	explorer.exe
2668	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1808	59e05d8c234b2d0f1da1867d33b5c760_NeikiAnalytics.exe
1808	59e05d8c234b2d0f1da1867d33b5c760_NeikiAnalytics.exe
2620	explorer.exe
2620	explorer.exe
2676	spoolsv.exe
2676	spoolsv.exe
2668	svchost.exe
2668	svchost.exe
2648	spoolsv.exe
2648	spoolsv.exe
2620	explorer.exe
2620	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 2620	1808	59e05d8c234b2d0f1da1867d33b5c760_NeikiAnalytics.exe	28
PID 1808 wrote to memory of 2620	1808	59e05d8c234b2d0f1da1867d33b5c760_NeikiAnalytics.exe	28
PID 1808 wrote to memory of 2620	1808	59e05d8c234b2d0f1da1867d33b5c760_NeikiAnalytics.exe	28
PID 1808 wrote to memory of 2620	1808	59e05d8c234b2d0f1da1867d33b5c760_NeikiAnalytics.exe	28
PID 2620 wrote to memory of 2676	2620	explorer.exe	29
PID 2620 wrote to memory of 2676	2620	explorer.exe	29
PID 2620 wrote to memory of 2676	2620	explorer.exe	29
PID 2620 wrote to memory of 2676	2620	explorer.exe	29
PID 2676 wrote to memory of 2668	2676	spoolsv.exe	30
PID 2676 wrote to memory of 2668	2676	spoolsv.exe	30
PID 2676 wrote to memory of 2668	2676	spoolsv.exe	30
PID 2676 wrote to memory of 2668	2676	spoolsv.exe	30
PID 2668 wrote to memory of 2648	2668	svchost.exe	31
PID 2668 wrote to memory of 2648	2668	svchost.exe	31
PID 2668 wrote to memory of 2648	2668	svchost.exe	31
PID 2668 wrote to memory of 2648	2668	svchost.exe	31
PID 2668 wrote to memory of 2604	2668	svchost.exe	32
PID 2668 wrote to memory of 2604	2668	svchost.exe	32
PID 2668 wrote to memory of 2604	2668	svchost.exe	32
PID 2668 wrote to memory of 2604	2668	svchost.exe	32
PID 2668 wrote to memory of 1488	2668	svchost.exe	36
PID 2668 wrote to memory of 1488	2668	svchost.exe	36
PID 2668 wrote to memory of 1488	2668	svchost.exe	36
PID 2668 wrote to memory of 1488	2668	svchost.exe	36
PID 2668 wrote to memory of 1800	2668	svchost.exe	38
PID 2668 wrote to memory of 1800	2668	svchost.exe	38
PID 2668 wrote to memory of 1800	2668	svchost.exe	38
PID 2668 wrote to memory of 1800	2668	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\59e05d8c234b2d0f1da1867d33b5c760_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\59e05d8c234b2d0f1da1867d33b5c760_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1808
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2620
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2676
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2668
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2648
    - - C:\Windows\SysWOW64\at.exe
        
        at 12:56 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2604
    - - C:\Windows\SysWOW64\at.exe
        
        at 12:57 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1488
    - - C:\Windows\SysWOW64\at.exe
        
        at 12:58 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
65KB

MD5
1f89140b80ea589874f93a9f39225a1c

SHA1
710004125d871918effd53a2432a70f1198d5c02

SHA256
fbb6aa69f0e8c3a0b8db07132e340c07d1b8a0aa4f79903af76bdb73f731d13d

SHA512
fe8d04d6ad3a3c466c246b0ce6a5f43249648d551bb37bb386c17ffef50798477a4c2459bbe37125323ed0c3e07548f1770337152c64651dd5a0da76c8f749e6

Download Submit
C:\Windows\system\svchost.exe

Filesize
65KB

MD5
aaa85b9cd4480631dc39ea603fd2b874

SHA1
c2133d0258cd8a8704c09ec219eaf9535e4c1cba

SHA256
83fb13a913a8f8929506ba5ab91c370b124379d260e9df1bde63c6887f2d3448

SHA512
95d153aed23ffe884d89ab22dbe1158fd7e9fa052b0e0e06f696f63ada8ab783368f77e8c127bcb8c99ec7035d809e964a9dedc27a118bf873d56defe1edbe52

Download Submit
\Windows\system\explorer.exe

Filesize
65KB

MD5
8ca64f1ef699e0a912d217f7e18fde9f

SHA1
c884caa83964abfbf25e59bc4b7c0ae19a1eee96

SHA256
7dabe7e0fc783dba11b0d674b024853e1358d007788dad1953e36cd8c06a2ab4

SHA512
d6e0414b6f43fadffb0a26d210e4108d742b72d9880ac84e17bdbb81f1bff1ec8f053f5b6c18668a81298643f917e6e07c18d262ed1acc87cc1cd7591f73facb

Download Submit
\Windows\system\spoolsv.exe

Filesize
65KB

MD5
0bacd262e593d8c5414300a68530b636

SHA1
2749675c998d9556163250bd7fa0d923fe4d1d02

SHA256
13bfc60c61b8193b8590700121b2e6ffdfc5f4869ead7812f2375e933ec23253

SHA512
d6c12876d56365276dd7036ebefa7af596a0989205c83b8d950ec08a92d0a513602b2243c6d7f8dd83d34fc3c4b1562eea9aa7d9e8e4256561bf7a7a1e66fc09

Download Submit
memory/1808-12-0x0000000001EE0000-0x0000000001F11000-memory.dmp

Filesize
196KB

Download
memory/1808-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1808-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1808-19-0x0000000001EE0000-0x0000000001F11000-memory.dmp

Filesize
196KB

Download
memory/1808-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1808-75-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1808-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/1808-76-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/1808-77-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1808-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2620-20-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2620-79-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2620-90-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2620-39-0x0000000000730000-0x0000000000761000-memory.dmp

Filesize
196KB

Download
memory/2620-18-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2620-24-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2648-70-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2648-64-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2648-68-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2668-58-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2668-81-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2668-54-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2676-36-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2676-53-0x0000000002510000-0x0000000002541000-memory.dmp

Filesize
196KB

Download
memory/2676-74-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2676-41-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download