325ab324f3ae0e117a249454b78e43864562d3027b9be5a308b718bb0afbfb6b

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 13:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36a800275d8aa1ff86511f06eebb1230_NeikiAnalytics.exe
Size

66KB
MD5

36a800275d8aa1ff86511f06eebb1230
SHA1

b164a68f40d6234d313d97c30bd05876471a7012
SHA256

325ab324f3ae0e117a249454b78e43864562d3027b9be5a308b718bb0afbfb6b
SHA512

4cee6217901768577cbb3e2d7cfea9c8817def77e694b2d67f74217a663405ae05bd455f0f8b28224f1e4f6b6e1025c57362fe23d4434d17768eb3ab9a804b61
SSDEEP

1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXi9:IeklMMYJhqezw/pXzH9i9

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
3012	explorer.exe
2540	spoolsv.exe
2480	svchost.exe
2404	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
1924	36a800275d8aa1ff86511f06eebb1230_NeikiAnalytics.exe
1924	36a800275d8aa1ff86511f06eebb1230_NeikiAnalytics.exe
3012	explorer.exe
3012	explorer.exe
2540	spoolsv.exe
2540	spoolsv.exe
2480	svchost.exe
2480	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	36a800275d8aa1ff86511f06eebb1230_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1924	36a800275d8aa1ff86511f06eebb1230_NeikiAnalytics.exe
3012	explorer.exe
3012	explorer.exe
3012	explorer.exe
3012	explorer.exe
2480	svchost.exe
2480	svchost.exe
2480	svchost.exe
3012	explorer.exe
3012	explorer.exe
2480	svchost.exe
3012	explorer.exe
2480	svchost.exe
2480	svchost.exe
3012	explorer.exe
3012	explorer.exe
2480	svchost.exe
2480	svchost.exe
3012	explorer.exe
2480	svchost.exe
3012	explorer.exe
3012	explorer.exe
2480	svchost.exe
3012	explorer.exe
2480	svchost.exe
3012	explorer.exe
2480	svchost.exe
2480	svchost.exe
3012	explorer.exe
3012	explorer.exe
2480	svchost.exe
3012	explorer.exe
2480	svchost.exe
3012	explorer.exe
2480	svchost.exe
2480	svchost.exe
3012	explorer.exe
3012	explorer.exe
2480	svchost.exe
2480	svchost.exe
3012	explorer.exe
3012	explorer.exe
2480	svchost.exe
2480	svchost.exe
3012	explorer.exe
3012	explorer.exe
2480	svchost.exe
3012	explorer.exe
2480	svchost.exe
3012	explorer.exe
2480	svchost.exe
2480	svchost.exe
3012	explorer.exe
2480	svchost.exe
3012	explorer.exe
2480	svchost.exe
3012	explorer.exe
3012	explorer.exe
2480	svchost.exe
3012	explorer.exe
2480	svchost.exe
3012	explorer.exe
2480	svchost.exe
2480	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3012	explorer.exe
2480	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1924	36a800275d8aa1ff86511f06eebb1230_NeikiAnalytics.exe
1924	36a800275d8aa1ff86511f06eebb1230_NeikiAnalytics.exe
3012	explorer.exe
3012	explorer.exe
2540	spoolsv.exe
2540	spoolsv.exe
2480	svchost.exe
2480	svchost.exe
2404	spoolsv.exe
2404	spoolsv.exe
3012	explorer.exe
3012	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 3012	1924	36a800275d8aa1ff86511f06eebb1230_NeikiAnalytics.exe	28
PID 1924 wrote to memory of 3012	1924	36a800275d8aa1ff86511f06eebb1230_NeikiAnalytics.exe	28
PID 1924 wrote to memory of 3012	1924	36a800275d8aa1ff86511f06eebb1230_NeikiAnalytics.exe	28
PID 1924 wrote to memory of 3012	1924	36a800275d8aa1ff86511f06eebb1230_NeikiAnalytics.exe	28
PID 3012 wrote to memory of 2540	3012	explorer.exe	29
PID 3012 wrote to memory of 2540	3012	explorer.exe	29
PID 3012 wrote to memory of 2540	3012	explorer.exe	29
PID 3012 wrote to memory of 2540	3012	explorer.exe	29
PID 2540 wrote to memory of 2480	2540	spoolsv.exe	30
PID 2540 wrote to memory of 2480	2540	spoolsv.exe	30
PID 2540 wrote to memory of 2480	2540	spoolsv.exe	30
PID 2540 wrote to memory of 2480	2540	spoolsv.exe	30
PID 2480 wrote to memory of 2404	2480	svchost.exe	31
PID 2480 wrote to memory of 2404	2480	svchost.exe	31
PID 2480 wrote to memory of 2404	2480	svchost.exe	31
PID 2480 wrote to memory of 2404	2480	svchost.exe	31
PID 2480 wrote to memory of 2648	2480	svchost.exe	32
PID 2480 wrote to memory of 2648	2480	svchost.exe	32
PID 2480 wrote to memory of 2648	2480	svchost.exe	32
PID 2480 wrote to memory of 2648	2480	svchost.exe	32
PID 2480 wrote to memory of 2888	2480	svchost.exe	36
PID 2480 wrote to memory of 2888	2480	svchost.exe	36
PID 2480 wrote to memory of 2888	2480	svchost.exe	36
PID 2480 wrote to memory of 2888	2480	svchost.exe	36
PID 2480 wrote to memory of 2108	2480	svchost.exe	38
PID 2480 wrote to memory of 2108	2480	svchost.exe	38
PID 2480 wrote to memory of 2108	2480	svchost.exe	38
PID 2480 wrote to memory of 2108	2480	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\36a800275d8aa1ff86511f06eebb1230_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\36a800275d8aa1ff86511f06eebb1230_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3012
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2540
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2480
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2404
    - - C:\Windows\SysWOW64\at.exe
        
        at 13:39 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2648
    - - C:\Windows\SysWOW64\at.exe
        
        at 13:40 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2888
    - - C:\Windows\SysWOW64\at.exe
        
        at 13:41 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
66KB

MD5
614a966c12a485541a2339e11ea68b3a

SHA1
1b5086969adcfd9e8c8f4fbe6502d5c801c45f76

SHA256
4fafaff31c847ec8cd8879de9f16c2fe47fa0aa24ed76f833197b5227ca4ee41

SHA512
50fb99404385dde4eb543aaa3052ba4fac0db34f06354b6133c9fae070109e27184b162c55372b997bc3499f610c994f44628a4883b2219148e43670aee02a0c

Download Submit
\Windows\system\explorer.exe

Filesize
66KB

MD5
2d750619c34c414deb931775e8ee0f35

SHA1
f531ed0a2782d567b1a059bb52ac00bd2bdcdd23

SHA256
c982e12fc64df951ef3379e08f1650b5a5dd6711c772a7be4de960b31c182a34

SHA512
82ea93273912d9cfc4386ba6e42ac4dffb90ae4c17e03af71bd36fa36ff57858a2825f032ed71ebdf6aed23db737d8cd99fcfb193a0b7616864cefe2185186b6

Download Submit
\Windows\system\spoolsv.exe

Filesize
66KB

MD5
3ad6788ac959d56b4f2af5d0175c6c94

SHA1
4c2fca5ce2251d8d616c2adb899080240fc7614a

SHA256
954c19e269706f8df1bf7d66e2db9a2bc8d79023037c8ce498f4ff47ea3f9b56

SHA512
a44b400b952bf3686fb37e35fc84ae40b58459a49978546b1bb0ff4cfd0c214d7aab280814a08f4a5f11b12e82ce236de1590e2de1829c810187286b810760ca

Download Submit
\Windows\system\svchost.exe

Filesize
66KB

MD5
9cdfba968583764bf16cb480c6e0038a

SHA1
e824e9e63881c25b610d4bc8564d8a2666c57fac

SHA256
482bdedfd82d6632799b70bc216001514230d0773ef421fcb6b638599d2f7faa

SHA512
57b34afcb006dcd9852f50c351ec63529a67e01924c2fde2349a2bbd0b77166c5536c47bcebbf7c78c35178d73eb16f0a1651bba271c48ed19ccb5edb64d036e

Download Submit
memory/1924-79-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1924-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1924-1-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1924-2-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/1924-17-0x0000000003480000-0x00000000034B1000-memory.dmp

Filesize
196KB

Download
memory/1924-78-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1924-0-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/1924-63-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1924-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2404-73-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2404-67-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2480-64-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2480-84-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2480-55-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2480-54-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2480-65-0x0000000001D80000-0x0000000001DB1000-memory.dmp

Filesize
196KB

Download
memory/2540-52-0x0000000001F50000-0x0000000001F81000-memory.dmp

Filesize
196KB

Download
memory/2540-51-0x0000000001F50000-0x0000000001F81000-memory.dmp

Filesize
196KB

Download
memory/2540-42-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2540-36-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2540-76-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3012-30-0x00000000007B0000-0x00000000007E1000-memory.dmp

Filesize
196KB

Download
memory/3012-21-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3012-18-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3012-81-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3012-82-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3012-19-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/3012-93-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download