Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12/06/2024, 22:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4a52794a8049b5a536306e33b93d1450_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
4a52794a8049b5a536306e33b93d1450_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
4a52794a8049b5a536306e33b93d1450_NeikiAnalytics.exe
-
Size
207KB
-
MD5
4a52794a8049b5a536306e33b93d1450
-
SHA1
f826479f48a3c4bb2d9f0d5eb2da3e7bd34f024b
-
SHA256
c1e4985eef887e50185f1ba2e28d148e721be38782a542298be1fdff1294218f
-
SHA512
a6df7e52d8e9bde571507ee1864a6aca5ce18c30907b5a064bccbc8a0a256bc617a96ac4c712b92f8be8a662034ae7fac02d132c65934e3cb5d870bf4db4c7d1
-
SSDEEP
3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unLt:5vEN2U+T6i5LirrllHy4HUcMQY6Kt
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
Modifies Installed Components in the registry 2 TTPs 8 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe -
Executes dropped EXE 4 IoCs
pid Process 2152 explorer.exe 2744 spoolsv.exe 2932 svchost.exe 2472 spoolsv.exe -
Loads dropped DLL 8 IoCs
pid Process 1976 4a52794a8049b5a536306e33b93d1450_NeikiAnalytics.exe 1976 4a52794a8049b5a536306e33b93d1450_NeikiAnalytics.exe 2152 explorer.exe 2152 explorer.exe 2744 spoolsv.exe 2744 spoolsv.exe 2932 svchost.exe 2932 svchost.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification \??\c:\windows\system\explorer.exe 4a52794a8049b5a536306e33b93d1450_NeikiAnalytics.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1976 4a52794a8049b5a536306e33b93d1450_NeikiAnalytics.exe 2152 explorer.exe 2152 explorer.exe 2152 explorer.exe 2152 explorer.exe 2932 svchost.exe 2932 svchost.exe 2932 svchost.exe 2152 explorer.exe 2932 svchost.exe 2152 explorer.exe 2932 svchost.exe 2152 explorer.exe 2932 svchost.exe 2152 explorer.exe 2152 explorer.exe 2932 svchost.exe 2152 explorer.exe 2932 svchost.exe 2932 svchost.exe 2152 explorer.exe 2152 explorer.exe 2932 svchost.exe 2932 svchost.exe 2152 explorer.exe 2932 svchost.exe 2152 explorer.exe 2152 explorer.exe 2932 svchost.exe 2152 explorer.exe 2932 svchost.exe 2152 explorer.exe 2932 svchost.exe 2152 explorer.exe 2932 svchost.exe 2152 explorer.exe 2932 svchost.exe 2932 svchost.exe 2152 explorer.exe 2932 svchost.exe 2152 explorer.exe 2152 explorer.exe 2932 svchost.exe 2152 explorer.exe 2932 svchost.exe 2932 svchost.exe 2152 explorer.exe 2932 svchost.exe 2152 explorer.exe 2932 svchost.exe 2152 explorer.exe 2152 explorer.exe 2932 svchost.exe 2152 explorer.exe 2932 svchost.exe 2932 svchost.exe 2152 explorer.exe 2152 explorer.exe 2932 svchost.exe 2932 svchost.exe 2152 explorer.exe 2932 svchost.exe 2152 explorer.exe 2152 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2152 explorer.exe 2932 svchost.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 1976 4a52794a8049b5a536306e33b93d1450_NeikiAnalytics.exe 1976 4a52794a8049b5a536306e33b93d1450_NeikiAnalytics.exe 2152 explorer.exe 2152 explorer.exe 2744 spoolsv.exe 2744 spoolsv.exe 2932 svchost.exe 2932 svchost.exe 2472 spoolsv.exe 2472 spoolsv.exe 2152 explorer.exe 2152 explorer.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1976 wrote to memory of 2152 1976 4a52794a8049b5a536306e33b93d1450_NeikiAnalytics.exe 28 PID 1976 wrote to memory of 2152 1976 4a52794a8049b5a536306e33b93d1450_NeikiAnalytics.exe 28 PID 1976 wrote to memory of 2152 1976 4a52794a8049b5a536306e33b93d1450_NeikiAnalytics.exe 28 PID 1976 wrote to memory of 2152 1976 4a52794a8049b5a536306e33b93d1450_NeikiAnalytics.exe 28 PID 2152 wrote to memory of 2744 2152 explorer.exe 29 PID 2152 wrote to memory of 2744 2152 explorer.exe 29 PID 2152 wrote to memory of 2744 2152 explorer.exe 29 PID 2152 wrote to memory of 2744 2152 explorer.exe 29 PID 2744 wrote to memory of 2932 2744 spoolsv.exe 30 PID 2744 wrote to memory of 2932 2744 spoolsv.exe 30 PID 2744 wrote to memory of 2932 2744 spoolsv.exe 30 PID 2744 wrote to memory of 2932 2744 spoolsv.exe 30 PID 2932 wrote to memory of 2472 2932 svchost.exe 31 PID 2932 wrote to memory of 2472 2932 svchost.exe 31 PID 2932 wrote to memory of 2472 2932 svchost.exe 31 PID 2932 wrote to memory of 2472 2932 svchost.exe 31 PID 2932 wrote to memory of 2448 2932 svchost.exe 32 PID 2932 wrote to memory of 2448 2932 svchost.exe 32 PID 2932 wrote to memory of 2448 2932 svchost.exe 32 PID 2932 wrote to memory of 2448 2932 svchost.exe 32 PID 2932 wrote to memory of 312 2932 svchost.exe 36 PID 2932 wrote to memory of 312 2932 svchost.exe 36 PID 2932 wrote to memory of 312 2932 svchost.exe 36 PID 2932 wrote to memory of 312 2932 svchost.exe 36 PID 2932 wrote to memory of 2080 2932 svchost.exe 38 PID 2932 wrote to memory of 2080 2932 svchost.exe 38 PID 2932 wrote to memory of 2080 2932 svchost.exe 38 PID 2932 wrote to memory of 2080 2932 svchost.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a52794a8049b5a536306e33b93d1450_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4a52794a8049b5a536306e33b93d1450_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2472
-
-
C:\Windows\SysWOW64\at.exeat 22:46 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:2448
-
-
C:\Windows\SysWOW64\at.exeat 22:47 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:312
-
-
C:\Windows\SysWOW64\at.exeat 22:48 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:2080
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
206KB
MD5cdc447bd76b600d57a8c0a90292c504a
SHA1567b1b47b43249986c8ab2c3125840f05100c027
SHA25653ad936a4f9edd52f95f2d0ef4cf5d364e1dc06676f7fc1fcf8b6c420ebca143
SHA5126917708df529013118a35b4aaa89d612fc312e7ab7cf0ab5384ce3edf1c2da820244f8760897cb517b9b6bad1c029e9eed919548b361946047ed2ca197598abb
-
Filesize
206KB
MD5262e4c0f7386f91966cd9d2bd344665e
SHA1710e95ae721c5d3980b1cf9104237766acfd3ff9
SHA256a400aeb76674d48199920ea40baf82b84947879ebe41f1627747ea43d1ffcf88
SHA51234594c182b3fbe703cabae129797e19d67541f859877bab643dd97d02b4b3a7d519987ab547322bc4fe026e824a657cefef699e6eb5eb05113c1ae2e8a890718
-
Filesize
206KB
MD5e4b1a2edbfd02d74ccc0f5636119c560
SHA14644b6a8b5c9734a5bbc0734cb5ff26dda4d6e5a
SHA2568f67816963cb01d13ec81da7ed8562ac384caca3f6e2b939ed4c25e5b1d4dec3
SHA512d97f276facf4c9e6ded5342f5427a275f2b5d949f64d28e14a3f27cadcd3436ad7531fdf22f0fe6b36477a239872f616b92df644aa8cb57567cd02aec48c3630
-
Filesize
206KB
MD50e3d1fecfb69a2965ebd71a243f36394
SHA14cd31fbaf50d7069afca65f2294ed2572deecb47
SHA2568c96190784fc9cf7fdd2d5f266f3554517a93a060a6910dd509f239d81b3317d
SHA5128634d3acd0e9e78436f2ee776263e76eef0963d329260a4180dd2b622119a6413c4ec02b53781f4fdb3a1321f51a7d3445f281cbbf0c7b43fe35856578bfd69e