cfea0df984074cd7f8bf55227682874d7fe0aeb02a7eaf5fbd609f4c56d6c675

Analysis

max time kernel
150s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-06-2024 03:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07d65ca25a563a1f51e50b782d9078d0_NeikiAnalytics.exe
Size

66KB
MD5

07d65ca25a563a1f51e50b782d9078d0
SHA1

67447186b8067c8f7f25c4bbce8813ef763e283f
SHA256

cfea0df984074cd7f8bf55227682874d7fe0aeb02a7eaf5fbd609f4c56d6c675
SHA512

5445036d9a5d11549c5d5b16d54aabf3e36d9a9f8ec282699793a9dc3e551294b259ff8709631e19dcbd1e08d80e5a473095ca0dae2b1c2b5de5e28e7b193393
SSDEEP

1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXi0RRRRRRRRRRRRRRRRRRRRq:IeklMMYJhqezw/pXzH9i0RRRRRRRRRRm

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe

Executes dropped EXE 4 IoCs

pid	Process
2564	explorer.exe
2572	spoolsv.exe
4820	svchost.exe
3416	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	07d65ca25a563a1f51e50b782d9078d0_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1552	07d65ca25a563a1f51e50b782d9078d0_NeikiAnalytics.exe
1552	07d65ca25a563a1f51e50b782d9078d0_NeikiAnalytics.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
2564	explorer.exe
4820	svchost.exe
4820	svchost.exe
4820	svchost.exe
4820	svchost.exe
2564	explorer.exe
2564	explorer.exe
4820	svchost.exe
4820	svchost.exe
2564	explorer.exe
2564	explorer.exe
4820	svchost.exe
4820	svchost.exe
2564	explorer.exe
2564	explorer.exe
4820	svchost.exe
4820	svchost.exe
2564	explorer.exe
2564	explorer.exe
4820	svchost.exe
4820	svchost.exe
2564	explorer.exe
2564	explorer.exe
4820	svchost.exe
4820	svchost.exe
2564	explorer.exe
2564	explorer.exe
4820	svchost.exe
4820	svchost.exe
2564	explorer.exe
2564	explorer.exe
4820	svchost.exe
4820	svchost.exe
2564	explorer.exe
2564	explorer.exe
4820	svchost.exe
4820	svchost.exe
2564	explorer.exe
2564	explorer.exe
4820	svchost.exe
4820	svchost.exe
2564	explorer.exe
2564	explorer.exe
4820	svchost.exe
4820	svchost.exe
2564	explorer.exe
2564	explorer.exe
4820	svchost.exe
4820	svchost.exe
2564	explorer.exe
2564	explorer.exe
4820	svchost.exe
4820	svchost.exe
2564	explorer.exe
2564	explorer.exe
4820	svchost.exe
4820	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2564	explorer.exe
4820	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1552	07d65ca25a563a1f51e50b782d9078d0_NeikiAnalytics.exe
1552	07d65ca25a563a1f51e50b782d9078d0_NeikiAnalytics.exe
2564	explorer.exe
2564	explorer.exe
2572	spoolsv.exe
2572	spoolsv.exe
4820	svchost.exe
4820	svchost.exe
3416	spoolsv.exe
3416	spoolsv.exe
2564	explorer.exe
2564	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 2564	1552	07d65ca25a563a1f51e50b782d9078d0_NeikiAnalytics.exe	82
PID 1552 wrote to memory of 2564	1552	07d65ca25a563a1f51e50b782d9078d0_NeikiAnalytics.exe	82
PID 1552 wrote to memory of 2564	1552	07d65ca25a563a1f51e50b782d9078d0_NeikiAnalytics.exe	82
PID 2564 wrote to memory of 2572	2564	explorer.exe	83
PID 2564 wrote to memory of 2572	2564	explorer.exe	83
PID 2564 wrote to memory of 2572	2564	explorer.exe	83
PID 2572 wrote to memory of 4820	2572	spoolsv.exe	85
PID 2572 wrote to memory of 4820	2572	spoolsv.exe	85
PID 2572 wrote to memory of 4820	2572	spoolsv.exe	85
PID 4820 wrote to memory of 3416	4820	svchost.exe	86
PID 4820 wrote to memory of 3416	4820	svchost.exe	86
PID 4820 wrote to memory of 3416	4820	svchost.exe	86
PID 4820 wrote to memory of 3328	4820	svchost.exe	88
PID 4820 wrote to memory of 3328	4820	svchost.exe	88
PID 4820 wrote to memory of 3328	4820	svchost.exe	88
PID 4820 wrote to memory of 4368	4820	svchost.exe	100
PID 4820 wrote to memory of 4368	4820	svchost.exe	100
PID 4820 wrote to memory of 4368	4820	svchost.exe	100
PID 4820 wrote to memory of 4180	4820	svchost.exe	102
PID 4820 wrote to memory of 4180	4820	svchost.exe	102
PID 4820 wrote to memory of 4180	4820	svchost.exe	102

C:\Users\Admin\AppData\Local\Temp\07d65ca25a563a1f51e50b782d9078d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\07d65ca25a563a1f51e50b782d9078d0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1552
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2564
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2572
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4820
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3416
    - - C:\Windows\SysWOW64\at.exe
        
        at 03:12 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:3328
    - - C:\Windows\SysWOW64\at.exe
        
        at 03:13 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:4368
    - - C:\Windows\SysWOW64\at.exe
        
        at 03:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:4180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
66KB

MD5
7b269e9297380d664a1f228646493623

SHA1
2687b3aaf3023770a9a8e34db9bca2b24f6f8cb1

SHA256
5eace63de48a34a72908e3413f648145aa6eb26b9d8f518e5232224e1b4d3d55

SHA512
f406594495a033b3864d90e348997cf9ac2a2b6a9bd12a2ad941770b90a9943820d16367de693cda5a4a4650129be93d0ccb1dbbe68ed08c23091a1f081377e0

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
66KB

MD5
5bb2b0ff50e9371a50412f42025ed3a1

SHA1
6f948fd2825c04816dea90c2701a98e7431106d4

SHA256
9668a64e9742d345542ee892f6e67c9d34410ab340da4c0b975e65fbacdd959a

SHA512
544a5f5019e33872f5af0432f7c2b086aac3e797d449657607da1c48b5f98c5a05d848aaacc06e2a9ef40197807ed0b0f7ccc768fda070e3b3970bf8e1b2a5f0

Download Submit
\??\c:\windows\system\explorer.exe

Filesize
66KB

MD5
5d38b4e695b0ed67d00fba2dc162715e

SHA1
77dce913a090eeb7554b3b4d0666811c19fc3125

SHA256
fb7a6b189d5796d24858ad17dcba162e3f5e3bc4f1cd316d95e81cccf9b17c19

SHA512
55e98b61389687d2a6487a61b88a5b0049fc10d6f3916948abb3ab1def218e4f888b0a2fd6869462230835fc51a0fe0bede9be337f7ed1691f79829c0e1ad679

Download Submit
\??\c:\windows\system\svchost.exe

Filesize
66KB

MD5
4e0b356bd5b4ed3192c06eac4b30e738

SHA1
99207034300bfeac04d995f7f77279e485d8e449

SHA256
303cf089fc964ebc180df2eec459f69cb3f901be8ea67344345c13884272b4c7

SHA512
0b561d95cb28abb4c32d0117f61ff71bbc283e0abc0a888616980c601b264bae70a1e27ecdb4d3b7c9e14cf3ea73577fa44af722c0d8fb0f797c2fcf5b86f92e

Download Submit
memory/1552-5-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1552-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1552-2-0x0000000075AB0000-0x0000000075C0D000-memory.dmp

Filesize
1.4MB

Download
memory/1552-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1552-56-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1552-55-0x00000000001C0000-0x00000000001C4000-memory.dmp

Filesize
16KB

Download
memory/1552-54-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1552-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

Filesize
16KB

Download
memory/2564-16-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2564-68-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2564-58-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2564-13-0x0000000075AB0000-0x0000000075C0D000-memory.dmp

Filesize
1.4MB

Download
memory/2572-24-0x0000000075AB0000-0x0000000075C0D000-memory.dmp

Filesize
1.4MB

Download
memory/2572-28-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2572-53-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3416-44-0x0000000075AB0000-0x0000000075C0D000-memory.dmp

Filesize
1.4MB

Download
memory/3416-50-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4820-37-0x0000000075AB0000-0x0000000075C0D000-memory.dmp

Filesize
1.4MB

Download
memory/4820-35-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4820-41-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4820-59-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4820-36-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download