Analysis
- max time kernel
150s - max time network
100s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 08:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6c4607225df2b9ec9d2ac8e485b72f10_NeikiAnalytics.exe
Resource
win7-20240611-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
6c4607225df2b9ec9d2ac8e485b72f10_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 6c4607225df2b9ec9d2ac8e485b72f10_NeikiAnalytics.exe
- Size 206KB
- Sample240613-j7729avclm
- SHA256 8aa36c803e06d6701bc59acc77dfb7f9f9f295e91300d58f9ad5eee84354eec0
- MD5 6c4607225df2b9ec9d2ac8e485b72f10
- SHA1 35b97ec1e7dd160da1a240333e69bcd0bde34b69
- SHA512 d2d8724429db3085b1df0387f851c49dc524ce19f26d15fb2e675ca527c341a24fec6cd8afab5cb182e99a7639a64ab0071b5016435fb576365f7ba225d034e3
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unLq:5vEN2U+T6i5LirrllHy4HUcMQY6Kq
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Modifies Installed Components in the registry 2 TTPs 8 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe - Executes dropped EXE 4 IoCs
pid Process 4900 explorer.exe 2900 spoolsv.exe 3528 svchost.exe 2192 spoolsv.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe 6c4607225df2b9ec9d2ac8e485b72f10_NeikiAnalytics.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3768 6c4607225df2b9ec9d2ac8e485b72f10_NeikiAnalytics.exe 3768 6c4607225df2b9ec9d2ac8e485b72f10_NeikiAnalytics.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 3528 svchost.exe 3528 svchost.exe 3528 svchost.exe 3528 svchost.exe 4900 explorer.exe 4900 explorer.exe 3528 svchost.exe 3528 svchost.exe 4900 explorer.exe 4900 explorer.exe 3528 svchost.exe 3528 svchost.exe 4900 explorer.exe 4900 explorer.exe 3528 svchost.exe 3528 svchost.exe 4900 explorer.exe 4900 explorer.exe 3528 svchost.exe 3528 svchost.exe 4900 explorer.exe 4900 explorer.exe 3528 svchost.exe 3528 svchost.exe 4900 explorer.exe 4900 explorer.exe 3528 svchost.exe 3528 svchost.exe 4900 explorer.exe 4900 explorer.exe 3528 svchost.exe 3528 svchost.exe 4900 explorer.exe 4900 explorer.exe 3528 svchost.exe 3528 svchost.exe 4900 explorer.exe 4900 explorer.exe 3528 svchost.exe 3528 svchost.exe 4900 explorer.exe 4900 explorer.exe 3528 svchost.exe 3528 svchost.exe 4900 explorer.exe 4900 explorer.exe 3528 svchost.exe 3528 svchost.exe 4900 explorer.exe 4900 explorer.exe 3528 svchost.exe 3528 svchost.exe 4900 explorer.exe 4900 explorer.exe 3528 svchost.exe 3528 svchost.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4900 explorer.exe 3528 svchost.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3768 6c4607225df2b9ec9d2ac8e485b72f10_NeikiAnalytics.exe 3768 6c4607225df2b9ec9d2ac8e485b72f10_NeikiAnalytics.exe 4900 explorer.exe 4900 explorer.exe 2900 spoolsv.exe 2900 spoolsv.exe 3528 svchost.exe 3528 svchost.exe 2192 spoolsv.exe 2192 spoolsv.exe 4900 explorer.exe 4900 explorer.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 3768 wrote to memory of 4900 3768 6c4607225df2b9ec9d2ac8e485b72f10_NeikiAnalytics.exe 81 PID 3768 wrote to memory of 4900 3768 6c4607225df2b9ec9d2ac8e485b72f10_NeikiAnalytics.exe 81 PID 3768 wrote to memory of 4900 3768 6c4607225df2b9ec9d2ac8e485b72f10_NeikiAnalytics.exe 81 PID 4900 wrote to memory of 2900 4900 explorer.exe 82 PID 4900 wrote to memory of 2900 4900 explorer.exe 82 PID 4900 wrote to memory of 2900 4900 explorer.exe 82 PID 2900 wrote to memory of 3528 2900 spoolsv.exe 84 PID 2900 wrote to memory of 3528 2900 spoolsv.exe 84 PID 2900 wrote to memory of 3528 2900 spoolsv.exe 84 PID 3528 wrote to memory of 2192 3528 svchost.exe 85 PID 3528 wrote to memory of 2192 3528 svchost.exe 85 PID 3528 wrote to memory of 2192 3528 svchost.exe 85 PID 3528 wrote to memory of 2400 3528 svchost.exe 86 PID 3528 wrote to memory of 2400 3528 svchost.exe 86 PID 3528 wrote to memory of 2400 3528 svchost.exe 86 PID 3528 wrote to memory of 3484 3528 svchost.exe 94 PID 3528 wrote to memory of 3484 3528 svchost.exe 94 PID 3528 wrote to memory of 3484 3528 svchost.exe 94 PID 3528 wrote to memory of 5008 3528 svchost.exe 98 PID 3528 wrote to memory of 5008 3528 svchost.exe 98 PID 3528 wrote to memory of 5008 3528 svchost.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c4607225df2b9ec9d2ac8e485b72f10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6c4607225df2b9ec9d2ac8e485b72f10_NeikiAnalytics.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3768 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2192
-
-
C:\Windows\SysWOW64\at.exeat 08:21 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:2400
-
-
C:\Windows\SysWOW64\at.exeat 08:22 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:3484
-
-
C:\Windows\SysWOW64\at.exeat 08:23 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:5008
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\mrsys.exe
- Size 206KB
- SHA256 05eb5893d672fe87fd3a91b17b5a9faccce70d26a95007640e4faf524e5016b2
- MD5 8822c3cf1ad9a0599ef37275cb9bced4
- SHA1 fe2559be2032f2e556fe7cef411c37588f6fc626
- SHA512 1329b78412c595d255fdc7c715864e5534658aa6dca7d093cd2a932f99478fdbbb9d399d810918a7eff49f0f1317628924216e3bf342f8e5b19daab9157df481
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unLN:5vEN2U+T6i5LirrllHy4HUcMQY6KN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\explorer.exe
- Size 206KB
- SHA256 e1bb8885623d8f7b43df4388c2bf67609701a532e250c66276419e3f8e449086
- MD5 9b0cfd465b34f87e10a54716b7faca56
- SHA1 67aca6232eedd475e627b2800bf543bc4e1ea8ee
- SHA512 65d3dab40913f0541d1cef08bd2d6f1e0f9ab8f38b99ed390eb3a9da96e4bac958a1ec648ab4d61a361e77cc6e16f8b549bf4c92fffb63d5d7095423ec6b0c07
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unLx:5vEN2U+T6i5LirrllHy4HUcMQY6Kx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\spoolsv.exe
- Size 207KB
- SHA256 bac2908fb97de51ed785eaebab03ad55414b9cc88a3bc36df8ae3a82397e34c0
- MD5 b3e84b19ac9e64898762c5a6b85f6341
- SHA1 52d057bef9e2f7c0abd788c798c9690767e85bb3
- SHA512 70e48fce32911c077d89c2a1a074d261bf261e39bcd29d405b43f6a8fbeac56db5937e482a7654ff5437fbb60dfd554b849904d16281c4f8233e26ca0c7f48de
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unLi:5vEN2U+T6i5LirrllHy4HUcMQY6Ki
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\svchost.exe
- Size 206KB
- SHA256 90e558d88595ae4d626f4dd78828187bf09d3292501c8c2abd31c4e21cbae5a7
- MD5 1f417545d9e672d0ba75f69d1e9fb217
- SHA1 c950047e6f49ce696029732b90683e1bc0e8aedc
- SHA512 2e04a8bc6da000c173e7e9dc2240cc1d9c6b44cfbcf0553831fd48acd75dbbf1dbce17ad6495195b93b6027876a8900525724531aa94bab6f1baa332952bb43a
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unLv:5vEN2U+T6i5LirrllHy4HUcMQY6Kv
- MD5 SHA1 SHA512 SSDEEP