6fff8ef0b05c90fa26600b071f14f4b2e60caf2e72698f71f3bae263e28e979b

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 02:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5705fac196d3cbd91c3b90fb1321f5c0_NeikiAnalytics.exe
Size

66KB
MD5

5705fac196d3cbd91c3b90fb1321f5c0
SHA1

5607bc8cdda9ab02594e2a134d0abc440eebbb01
SHA256

6fff8ef0b05c90fa26600b071f14f4b2e60caf2e72698f71f3bae263e28e979b
SHA512

80a3fe2b42c982d10bb088fdf01bb68ce08a53f8c78d2b458b9a1a8ec875109e3f8a034519a4776aebc46524fab9172921a990799ada0e74c4a9a6bc8a1d90a7
SSDEEP

1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXi9:IeklMMYJhqezw/pXzH9i9

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe

Executes dropped EXE 4 IoCs

pid	Process
2976	explorer.exe
2640	spoolsv.exe
2588	svchost.exe
2540	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
2084	5705fac196d3cbd91c3b90fb1321f5c0_NeikiAnalytics.exe
2084	5705fac196d3cbd91c3b90fb1321f5c0_NeikiAnalytics.exe
2976	explorer.exe
2976	explorer.exe
2640	spoolsv.exe
2640	spoolsv.exe
2588	svchost.exe
2588	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	5705fac196d3cbd91c3b90fb1321f5c0_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2084	5705fac196d3cbd91c3b90fb1321f5c0_NeikiAnalytics.exe
2976	explorer.exe
2976	explorer.exe
2976	explorer.exe
2976	explorer.exe
2976	explorer.exe
2976	explorer.exe
2588	svchost.exe
2588	svchost.exe
2976	explorer.exe
2588	svchost.exe
2976	explorer.exe
2588	svchost.exe
2976	explorer.exe
2588	svchost.exe
2976	explorer.exe
2588	svchost.exe
2976	explorer.exe
2588	svchost.exe
2976	explorer.exe
2588	svchost.exe
2976	explorer.exe
2588	svchost.exe
2976	explorer.exe
2588	svchost.exe
2976	explorer.exe
2588	svchost.exe
2976	explorer.exe
2588	svchost.exe
2976	explorer.exe
2588	svchost.exe
2976	explorer.exe
2588	svchost.exe
2976	explorer.exe
2588	svchost.exe
2976	explorer.exe
2588	svchost.exe
2976	explorer.exe
2588	svchost.exe
2976	explorer.exe
2588	svchost.exe
2976	explorer.exe
2588	svchost.exe
2976	explorer.exe
2588	svchost.exe
2976	explorer.exe
2588	svchost.exe
2976	explorer.exe
2588	svchost.exe
2976	explorer.exe
2588	svchost.exe
2976	explorer.exe
2588	svchost.exe
2976	explorer.exe
2588	svchost.exe
2976	explorer.exe
2588	svchost.exe
2976	explorer.exe
2588	svchost.exe
2976	explorer.exe
2588	svchost.exe
2976	explorer.exe
2588	svchost.exe
2976	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2976	explorer.exe
2588	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2084	5705fac196d3cbd91c3b90fb1321f5c0_NeikiAnalytics.exe
2084	5705fac196d3cbd91c3b90fb1321f5c0_NeikiAnalytics.exe
2976	explorer.exe
2976	explorer.exe
2640	spoolsv.exe
2640	spoolsv.exe
2588	svchost.exe
2588	svchost.exe
2540	spoolsv.exe
2540	spoolsv.exe
2976	explorer.exe
2976	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2976	2084	5705fac196d3cbd91c3b90fb1321f5c0_NeikiAnalytics.exe	28
PID 2084 wrote to memory of 2976	2084	5705fac196d3cbd91c3b90fb1321f5c0_NeikiAnalytics.exe	28
PID 2084 wrote to memory of 2976	2084	5705fac196d3cbd91c3b90fb1321f5c0_NeikiAnalytics.exe	28
PID 2084 wrote to memory of 2976	2084	5705fac196d3cbd91c3b90fb1321f5c0_NeikiAnalytics.exe	28
PID 2976 wrote to memory of 2640	2976	explorer.exe	29
PID 2976 wrote to memory of 2640	2976	explorer.exe	29
PID 2976 wrote to memory of 2640	2976	explorer.exe	29
PID 2976 wrote to memory of 2640	2976	explorer.exe	29
PID 2640 wrote to memory of 2588	2640	spoolsv.exe	30
PID 2640 wrote to memory of 2588	2640	spoolsv.exe	30
PID 2640 wrote to memory of 2588	2640	spoolsv.exe	30
PID 2640 wrote to memory of 2588	2640	spoolsv.exe	30
PID 2588 wrote to memory of 2540	2588	svchost.exe	31
PID 2588 wrote to memory of 2540	2588	svchost.exe	31
PID 2588 wrote to memory of 2540	2588	svchost.exe	31
PID 2588 wrote to memory of 2540	2588	svchost.exe	31
PID 2588 wrote to memory of 804	2588	svchost.exe	32
PID 2588 wrote to memory of 804	2588	svchost.exe	32
PID 2588 wrote to memory of 804	2588	svchost.exe	32
PID 2588 wrote to memory of 804	2588	svchost.exe	32
PID 2588 wrote to memory of 1792	2588	svchost.exe	36
PID 2588 wrote to memory of 1792	2588	svchost.exe	36
PID 2588 wrote to memory of 1792	2588	svchost.exe	36
PID 2588 wrote to memory of 1792	2588	svchost.exe	36
PID 2588 wrote to memory of 1568	2588	svchost.exe	38
PID 2588 wrote to memory of 1568	2588	svchost.exe	38
PID 2588 wrote to memory of 1568	2588	svchost.exe	38
PID 2588 wrote to memory of 1568	2588	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\5705fac196d3cbd91c3b90fb1321f5c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5705fac196d3cbd91c3b90fb1321f5c0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2976
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2640
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2588
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2540
    - - C:\Windows\SysWOW64\at.exe
        
        at 02:29 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:804
    - - C:\Windows\SysWOW64\at.exe
        
        at 02:30 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1792
    - - C:\Windows\SysWOW64\at.exe
        
        at 02:31 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
66KB

MD5
f06faad5c765d0fbd861c2938ec8b95b

SHA1
9bd7a80b2f0994b244e7bcf0851eb3f2b0bb0459

SHA256
9b521d7bab65ca77f968e5be413d1191d1720ebd5317adc0de51862d8f9ba382

SHA512
de46254eab0d25ffb11921afdb1590530da226ff934cd9d63a0b66f3515e8569fe7484ffc855afdd22ac4890294f60b3c9a3b81ed8684d8991a6cea985a1617f

Download Submit
C:\Windows\system\svchost.exe

Filesize
66KB

MD5
0db9274770940f767c890c738a9061c3

SHA1
190cd20ef9fd2fd4968ecb901fcb9181cf85c449

SHA256
ca9eb3d5bfc196e9cd52e3ca2f992255bf190d6ba9577d9c3dbaa2e767d324fa

SHA512
2ec8656c69508ece60567e338fead35e0170caa7e141e3d24440aec26b626152ed446c5d6daef900faccda1e4ce12dadf234395aeb1bc6bccec52ea7de7f6670

Download Submit
\Windows\system\explorer.exe

Filesize
66KB

MD5
f6dfa5a86e5fe8ced874df0f05180e2c

SHA1
b36001e509a1a19e77a77f961c36defd30f1ffd8

SHA256
9d7fb6f1734ab8861648828e1f0961e363e9d544b0c6700ed5612eed97bc2ca9

SHA512
029e0b33584a4e6dfedab9ef265b0b8415b79c652cc2f0eec675028d1f86e18d8d7f8e690ed3517bf240d71e3ffc3b5eff1746b5ad164df0fc9054841dcbd18c

Download Submit
\Windows\system\spoolsv.exe

Filesize
66KB

MD5
61d4f17cdd9a89d8746be1ab1728e309

SHA1
8833deb6d56403520b9f93d1d3776507b75e8e9f

SHA256
70f80ca719e06d5ccb57de5d9ace0e94065b774851d946e54440de4286227e3d

SHA512
bdd3c6f683cf4cec72d86108ff5f9efee7092972171899b0f83828fc012649bc73534ae3c6a7f9da2c1ed17ea8f535a8a57fab3f9b59553169faa8a1042ede9d

Download Submit
memory/2084-12-0x00000000026B0000-0x00000000026E1000-memory.dmp

Filesize
196KB

Download
memory/2084-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2084-42-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2084-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2084-18-0x00000000026B0000-0x00000000026E1000-memory.dmp

Filesize
196KB

Download
memory/2084-80-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2084-81-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2084-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2084-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2084-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2084-54-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/2540-68-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2540-74-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2588-84-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2588-57-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2588-63-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2640-38-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2640-43-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2640-56-0x00000000004A0000-0x00000000004D1000-memory.dmp

Filesize
196KB

Download
memory/2640-78-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2976-31-0x00000000027E0000-0x0000000002811000-memory.dmp

Filesize
196KB

Download
memory/2976-61-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2976-24-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2976-20-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2976-19-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2976-83-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2976-35-0x00000000027E0000-0x0000000002811000-memory.dmp

Filesize
196KB

Download
memory/2976-93-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download