e8a18138bbf6382520c7f36a32c33d5f7a490041158b8f4984e50d0016af7f93

Analysis

max time kernel
150s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 22:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8c18a403b9c421c2766337291b207470_NeikiAnalytics.exe
Size 65KB
Sample240613-2cscessgjg
SHA256 e8a18138bbf6382520c7f36a32c33d5f7a490041158b8f4984e50d0016af7f93
MD5 8c18a403b9c421c2766337291b207470
SHA1 7aa0f03b42d2e916509fca26c7b38bd505c03bdc
SHA512 8433f0a6e1742c19de15d08d3333ca0691b9847e23e5e457c4b1c5952eb4c923ea0bb18356536ece42b154944e8a6bad6751a1dfe8684ab2400e66af8708cc38
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuZ000000000000000000X:7WNqkOJWmo1HpM0MkTUmuF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
4596	explorer.exe
4880	spoolsv.exe
1908	svchost.exe
1116	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	8c18a403b9c421c2766337291b207470_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3688	8c18a403b9c421c2766337291b207470_NeikiAnalytics.exe
3688	8c18a403b9c421c2766337291b207470_NeikiAnalytics.exe
4596	explorer.exe
4596	explorer.exe
4596	explorer.exe
4596	explorer.exe
4596	explorer.exe
4596	explorer.exe
1908	svchost.exe
1908	svchost.exe
1908	svchost.exe
1908	svchost.exe
4596	explorer.exe
4596	explorer.exe
1908	svchost.exe
1908	svchost.exe
4596	explorer.exe
4596	explorer.exe
1908	svchost.exe
1908	svchost.exe
4596	explorer.exe
4596	explorer.exe
1908	svchost.exe
1908	svchost.exe
4596	explorer.exe
4596	explorer.exe
1908	svchost.exe
1908	svchost.exe
4596	explorer.exe
4596	explorer.exe
1908	svchost.exe
1908	svchost.exe
4596	explorer.exe
4596	explorer.exe
1908	svchost.exe
1908	svchost.exe
4596	explorer.exe
4596	explorer.exe
1908	svchost.exe
1908	svchost.exe
4596	explorer.exe
4596	explorer.exe
1908	svchost.exe
1908	svchost.exe
4596	explorer.exe
4596	explorer.exe
1908	svchost.exe
1908	svchost.exe
4596	explorer.exe
4596	explorer.exe
1908	svchost.exe
1908	svchost.exe
4596	explorer.exe
4596	explorer.exe
1908	svchost.exe
1908	svchost.exe
4596	explorer.exe
4596	explorer.exe
1908	svchost.exe
1908	svchost.exe
4596	explorer.exe
4596	explorer.exe
1908	svchost.exe
1908	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4596	explorer.exe
1908	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3688	8c18a403b9c421c2766337291b207470_NeikiAnalytics.exe
3688	8c18a403b9c421c2766337291b207470_NeikiAnalytics.exe
4596	explorer.exe
4596	explorer.exe
4880	spoolsv.exe
4880	spoolsv.exe
1908	svchost.exe
1908	svchost.exe
1116	spoolsv.exe
1116	spoolsv.exe
4596	explorer.exe
4596	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3688 wrote to memory of 4596	3688	8c18a403b9c421c2766337291b207470_NeikiAnalytics.exe	89
PID 3688 wrote to memory of 4596	3688	8c18a403b9c421c2766337291b207470_NeikiAnalytics.exe	89
PID 3688 wrote to memory of 4596	3688	8c18a403b9c421c2766337291b207470_NeikiAnalytics.exe	89
PID 4596 wrote to memory of 4880	4596	explorer.exe	90
PID 4596 wrote to memory of 4880	4596	explorer.exe	90
PID 4596 wrote to memory of 4880	4596	explorer.exe	90
PID 4880 wrote to memory of 1908	4880	spoolsv.exe	91
PID 4880 wrote to memory of 1908	4880	spoolsv.exe	91
PID 4880 wrote to memory of 1908	4880	spoolsv.exe	91
PID 1908 wrote to memory of 1116	1908	svchost.exe	93
PID 1908 wrote to memory of 1116	1908	svchost.exe	93
PID 1908 wrote to memory of 1116	1908	svchost.exe	93
PID 1908 wrote to memory of 4952	1908	svchost.exe	95
PID 1908 wrote to memory of 4952	1908	svchost.exe	95
PID 1908 wrote to memory of 4952	1908	svchost.exe	95
PID 1908 wrote to memory of 4784	1908	svchost.exe	102
PID 1908 wrote to memory of 4784	1908	svchost.exe	102
PID 1908 wrote to memory of 4784	1908	svchost.exe	102
PID 1908 wrote to memory of 4276	1908	svchost.exe	104
PID 1908 wrote to memory of 4276	1908	svchost.exe	104
PID 1908 wrote to memory of 4276	1908	svchost.exe	104

C:\Users\Admin\AppData\Local\Temp\8c18a403b9c421c2766337291b207470_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8c18a403b9c421c2766337291b207470_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3688
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4596
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4880
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1908
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1116
    - - C:\Windows\SysWOW64\at.exe
        
        at 22:28 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:4952
    - - C:\Windows\SysWOW64\at.exe
        
        at 22:29 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:4784
    - - C:\Windows\SysWOW64\at.exe
        
        at 22:30 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:4276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4304,i,11749492925348081608,8895412282206755658,262144 --variations-seed-version --mojo-platform-channel-handle=1284 /prefetch:8
1⤵
PID:4048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mrsys.exe

Path C:\Users\Admin\AppData\Roaming\mrsys.exe
Size 65KB
SHA256 10d4c60227aa2bf74abd0a40be1d3dd0c8eb1a479c264bbadf1aac13cdb3c59c
MD5 0e52d83c2d1ef6230138a0f9fdc9a634
SHA1 81430cd483135e489dc0dc0e833520f6fba6dc26
SHA512 a8230c5c3f56706201a6bd9a2f07111a2d1e685392f683440377187c0dbac8140f84334fcbd4dd4de72187c98ccfba853e4433f3cd6e9d0ebc880d0cbca8eec2
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuN:7WNqkOJWmo1HpM0MkTUmuN
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 65KB
SHA256 2de05d66f692da7d104bae70c75d6a33a859c6d06ae8f6004624dd277633a051
MD5 66eaaa911fad7b1ccd0489047d65dc8b
SHA1 c745b151d1159a4715afe0fea1ec6d02b313dafc
SHA512 3d29f3670d0078c718f25f8fd938cce91f8232e77e5e1adc59015043c509f7e2a5949b5a694fb4683a04feee055b0155a6c107337b53800eafa5b4a5ed991816
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/OuD:7WNqkOJWmo1HpM0MkTUmuD
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 65KB
SHA256 5d3049d2c7f850282dfe1801b7d03819ceae4b93149bea8ea981542a9bcd36b9
MD5 9edec073e5f770e38281e44488501db7
SHA1 1e38375f03728694ad0f914f92a67aaaaee27a06
SHA512 74503d925c8773951cd48d5c1d029c9eacdc5b474d86e0e46443c02112081eaa9063b433e868a4adec89a430241bbaeb7bc7ffca43baeac0d2ad2826068e97f2
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Oup:7WNqkOJWmo1HpM0MkTUmup
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Windows\System\svchost.exe
Size 65KB
SHA256 59413e38d3fc773ef67de66b88515d3ab86e4a4953c10d49ab7cd01190b46963
MD5 4662862de45e5e882bff34dd37b7aacf
SHA1 42ff2cf413dc1d391794c511e1bda1bb03c1a549
SHA512 627cf7cb3779de2590456a06df53f5392587e7dc4b7879144027d6b75380e07dd67fd39e000c4ef504bc71aad894741d5e019df8507a204ed9320f7fa8225916
SSDEEP 1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Ou8:7WNqkOJWmo1HpM0MkTUmu8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1116-54-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1116-44-0x00000000759C0000-0x0000000075B1D000-memory.dmp

Download

memory/1908-60-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1908-42-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1908-37-0x00000000759C0000-0x0000000075B1D000-memory.dmp

Download

memory/1908-35-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3688-55-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3688-57-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/3688-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

Download

memory/3688-2-0x00000000759C0000-0x0000000075B1D000-memory.dmp

Download

memory/3688-3-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3688-0-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3688-4-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/4596-13-0x00000000759C0000-0x0000000075B1D000-memory.dmp

Download

memory/4596-15-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4596-58-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4596-69-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4880-52-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4880-26-0x00000000759C0000-0x0000000075B1D000-memory.dmp

Download

memory/4880-25-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/4880-24-0x0000000000400000-0x0000000000431000-memory.dmp

Download