290549df7c08227c1f9f25d25264ba6cb6420200c0277ebb3c3c50b6e1886cbe

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11-06-2024 03:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

256790a9c5b61eac61c88fc946501a50_NeikiAnalytics.exe
Size

66KB
MD5

256790a9c5b61eac61c88fc946501a50
SHA1

65ea5473cdafb9b124eebd780f5f305e4d88303c
SHA256

290549df7c08227c1f9f25d25264ba6cb6420200c0277ebb3c3c50b6e1886cbe
SHA512

709c473b64384f40b89f5e5bd9c50c624d6dba9dac752ec5e3bf7da42875a50140b5fb13cc872d9a11d4755d18eb44e7b2c1528b86dcdb90b4902b266a6ea853
SSDEEP

1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXia:IeklMMYJhqezw/pXzH9ia

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
492	explorer.exe
2704	spoolsv.exe
2696	svchost.exe
2680	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
2428	256790a9c5b61eac61c88fc946501a50_NeikiAnalytics.exe
2428	256790a9c5b61eac61c88fc946501a50_NeikiAnalytics.exe
492	explorer.exe
492	explorer.exe
2704	spoolsv.exe
2704	spoolsv.exe
2696	svchost.exe
2696	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	256790a9c5b61eac61c88fc946501a50_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2428	256790a9c5b61eac61c88fc946501a50_NeikiAnalytics.exe
492	explorer.exe
492	explorer.exe
492	explorer.exe
2696	svchost.exe
2696	svchost.exe
492	explorer.exe
2696	svchost.exe
492	explorer.exe
2696	svchost.exe
2696	svchost.exe
492	explorer.exe
2696	svchost.exe
492	explorer.exe
2696	svchost.exe
492	explorer.exe
2696	svchost.exe
492	explorer.exe
492	explorer.exe
2696	svchost.exe
2696	svchost.exe
492	explorer.exe
492	explorer.exe
2696	svchost.exe
2696	svchost.exe
492	explorer.exe
492	explorer.exe
2696	svchost.exe
492	explorer.exe
2696	svchost.exe
492	explorer.exe
2696	svchost.exe
492	explorer.exe
2696	svchost.exe
2696	svchost.exe
492	explorer.exe
2696	svchost.exe
492	explorer.exe
2696	svchost.exe
492	explorer.exe
2696	svchost.exe
492	explorer.exe
2696	svchost.exe
492	explorer.exe
2696	svchost.exe
492	explorer.exe
492	explorer.exe
2696	svchost.exe
492	explorer.exe
2696	svchost.exe
492	explorer.exe
2696	svchost.exe
492	explorer.exe
2696	svchost.exe
2696	svchost.exe
492	explorer.exe
2696	svchost.exe
492	explorer.exe
492	explorer.exe
2696	svchost.exe
2696	svchost.exe
492	explorer.exe
2696	svchost.exe
492	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2696	svchost.exe
492	explorer.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2428	256790a9c5b61eac61c88fc946501a50_NeikiAnalytics.exe
2428	256790a9c5b61eac61c88fc946501a50_NeikiAnalytics.exe
492	explorer.exe
492	explorer.exe
2704	spoolsv.exe
2704	spoolsv.exe
2696	svchost.exe
2696	svchost.exe
2680	spoolsv.exe
2680	spoolsv.exe
492	explorer.exe
492	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 492	2428	256790a9c5b61eac61c88fc946501a50_NeikiAnalytics.exe	28
PID 2428 wrote to memory of 492	2428	256790a9c5b61eac61c88fc946501a50_NeikiAnalytics.exe	28
PID 2428 wrote to memory of 492	2428	256790a9c5b61eac61c88fc946501a50_NeikiAnalytics.exe	28
PID 2428 wrote to memory of 492	2428	256790a9c5b61eac61c88fc946501a50_NeikiAnalytics.exe	28
PID 492 wrote to memory of 2704	492	explorer.exe	29
PID 492 wrote to memory of 2704	492	explorer.exe	29
PID 492 wrote to memory of 2704	492	explorer.exe	29
PID 492 wrote to memory of 2704	492	explorer.exe	29
PID 2704 wrote to memory of 2696	2704	spoolsv.exe	30
PID 2704 wrote to memory of 2696	2704	spoolsv.exe	30
PID 2704 wrote to memory of 2696	2704	spoolsv.exe	30
PID 2704 wrote to memory of 2696	2704	spoolsv.exe	30
PID 2696 wrote to memory of 2680	2696	svchost.exe	31
PID 2696 wrote to memory of 2680	2696	svchost.exe	31
PID 2696 wrote to memory of 2680	2696	svchost.exe	31
PID 2696 wrote to memory of 2680	2696	svchost.exe	31
PID 2696 wrote to memory of 2332	2696	svchost.exe	32
PID 2696 wrote to memory of 2332	2696	svchost.exe	32
PID 2696 wrote to memory of 2332	2696	svchost.exe	32
PID 2696 wrote to memory of 2332	2696	svchost.exe	32
PID 2696 wrote to memory of 1476	2696	svchost.exe	36
PID 2696 wrote to memory of 1476	2696	svchost.exe	36
PID 2696 wrote to memory of 1476	2696	svchost.exe	36
PID 2696 wrote to memory of 1476	2696	svchost.exe	36
PID 2696 wrote to memory of 2484	2696	svchost.exe	38
PID 2696 wrote to memory of 2484	2696	svchost.exe	38
PID 2696 wrote to memory of 2484	2696	svchost.exe	38
PID 2696 wrote to memory of 2484	2696	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\256790a9c5b61eac61c88fc946501a50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\256790a9c5b61eac61c88fc946501a50_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:492
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2696
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2680
    - - C:\Windows\SysWOW64\at.exe
        
        at 03:04 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2332
    - - C:\Windows\SysWOW64\at.exe
        
        at 03:05 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1476
    - - C:\Windows\SysWOW64\at.exe
        
        at 03:06 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
66KB

MD5
271a45d49849ca692d380fccfa9a33a5

SHA1
66175c45f3d11a042223d0f46b7fc298ea38d271

SHA256
d0e14139c3efd5ebdfb519783033609203f1412e4d69a9d982ca258c6d31cf02

SHA512
90e20fb15999484880d10b54b625798e6418cfe54dcff63cf3396e63ad712255427e7d3d3e79c877749abaa644859679d6ce53df2020bced5dbe87f7245c6426

Download Submit
\Windows\system\explorer.exe

Filesize
66KB

MD5
2e515063c9bd516480a364a45c436c2a

SHA1
75591b5f6cdd5aac611884356cc74cd9a3ec3c3c

SHA256
256bc02e42d1d6e2097efc9903746b8da0712f16ac56106abbdba2218eb1b0f4

SHA512
c1257a4f3bd6137eafa90f943ed67cdcf2d3394aa9f8713929aef6bbca6eedbffd1242067bbfa5d16d8c2bbdebb726bf90dfc1a607052d60d8e6d3a48bba66da

Download Submit
\Windows\system\spoolsv.exe

Filesize
66KB

MD5
195fc5bcb1ab129826be820041fd9a3f

SHA1
7cfa43d7ee9b6933e3200ef09cb0693214a53f06

SHA256
6f35f940a0437c196462755ef875d7a5e6d12742e1123ac739721e843f95dbdd

SHA512
4bc790b170bf71647b9821aabb46e68fae3baed3dd94e087384eb0b18f47f2cf06a522ca452158aece7a95604e313d0dc3519e1b79f61a7261849a1142028fa7

Download Submit
\Windows\system\svchost.exe

Filesize
66KB

MD5
5e4ce2354b48ecead1aebd652814c8dd

SHA1
29b84abab45fee1477dcc872a8697418e0cd7e96

SHA256
2a60fc41a257d90dc00281d3fee9a1ea17857e770daa2e9800396e69d6897afc

SHA512
d70bba97c49d81b2863f50d4a9d998b370ab75574aaf0ee7fdf65725829e32e09decbd0376c59edd15840842d933e7684e047e9e59200d7846c31c30e849bf32

Download Submit
memory/492-84-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/492-19-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/492-20-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/492-83-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/492-37-0x0000000002460000-0x0000000002491000-memory.dmp

Filesize
196KB

Download
memory/492-25-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/492-95-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/492-31-0x0000000002460000-0x0000000002491000-memory.dmp

Filesize
196KB

Download
memory/2428-18-0x0000000002720000-0x0000000002751000-memory.dmp

Filesize
196KB

Download
memory/2428-54-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2428-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2428-17-0x0000000002720000-0x0000000002751000-memory.dmp

Filesize
196KB

Download
memory/2428-64-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2428-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2428-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2428-81-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2428-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2428-80-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2428-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2680-69-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2680-75-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2680-68-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2696-65-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2696-57-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2696-56-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2696-86-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2704-55-0x0000000000840000-0x0000000000871000-memory.dmp

Filesize
196KB

Download
memory/2704-78-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2704-38-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2704-42-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download