Malware Analysis Report

2024-10-19 09:41

Sample ID 240613-ptd5xayfqa
Target 7cd6169a5656572078e159fd6a1755a0_NeikiAnalytics.exe
SHA256 e4f1a7da104ef80b119bde79d629bc097d209e792796ebb6aa27a419cc29575b
Tags
evasion persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e4f1a7da104ef80b119bde79d629bc097d209e792796ebb6aa27a419cc29575b

Threat Level: Known bad

The file 7cd6169a5656572078e159fd6a1755a0_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

evasion persistence

Modifies visiblity of hidden/system files in Explorer

Modifies WinLogon for persistence

Modifies Installed Components in the registry

Loads dropped DLL

Executes dropped EXE

Adds Run key to start application

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-13 12:36

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 12:36

Reported

2024-06-13 12:39

Platform

win10v2004-20240611-en

Max time kernel

150s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7cd6169a5656572078e159fd6a1755a0_NeikiAnalytics.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\svchost.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\svchost.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\svchost.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\system\udsys.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\explorer.exe C:\Users\Admin\AppData\Local\Temp\7cd6169a5656572078e159fd6a1755a0_NeikiAnalytics.exe N/A
File opened for modification \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe N/A
File opened for modification \??\c:\windows\system\explorer.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\svchost.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cd6169a5656572078e159fd6a1755a0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cd6169a5656572078e159fd6a1755a0_NeikiAnalytics.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4204 wrote to memory of 3324 N/A C:\Users\Admin\AppData\Local\Temp\7cd6169a5656572078e159fd6a1755a0_NeikiAnalytics.exe \??\c:\windows\system\explorer.exe
PID 4204 wrote to memory of 3324 N/A C:\Users\Admin\AppData\Local\Temp\7cd6169a5656572078e159fd6a1755a0_NeikiAnalytics.exe \??\c:\windows\system\explorer.exe
PID 4204 wrote to memory of 3324 N/A C:\Users\Admin\AppData\Local\Temp\7cd6169a5656572078e159fd6a1755a0_NeikiAnalytics.exe \??\c:\windows\system\explorer.exe
PID 3324 wrote to memory of 1092 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 3324 wrote to memory of 1092 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 3324 wrote to memory of 1092 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 1092 wrote to memory of 2492 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 1092 wrote to memory of 2492 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 1092 wrote to memory of 2492 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2492 wrote to memory of 4504 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2492 wrote to memory of 4504 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2492 wrote to memory of 4504 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2492 wrote to memory of 2124 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2492 wrote to memory of 2124 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2492 wrote to memory of 2124 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2492 wrote to memory of 2140 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2492 wrote to memory of 2140 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2492 wrote to memory of 2140 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2492 wrote to memory of 3876 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2492 wrote to memory of 3876 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2492 wrote to memory of 3876 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe

Processes

C:\Users\Admin\AppData\Local\Temp\7cd6169a5656572078e159fd6a1755a0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\7cd6169a5656572078e159fd6a1755a0_NeikiAnalytics.exe"

\??\c:\windows\system\explorer.exe

c:\windows\system\explorer.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe SE

\??\c:\windows\system\svchost.exe

c:\windows\system\svchost.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe PR

C:\Windows\SysWOW64\at.exe

at 12:39 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4252,i,11049150160560877369,2866371920339304689,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:8

C:\Windows\SysWOW64\at.exe

at 12:40 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Windows\SysWOW64\at.exe

at 12:41 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp

Files

memory/4204-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

memory/4204-0-0x0000000000400000-0x0000000000431000-memory.dmp

memory/4204-3-0x0000000000400000-0x0000000000431000-memory.dmp

memory/4204-4-0x0000000000401000-0x000000000042E000-memory.dmp

memory/4204-2-0x0000000075270000-0x00000000753CD000-memory.dmp

C:\Windows\System\explorer.exe

MD5 7d95e3fc696410806d0b988aee691b9c
SHA1 358bac38c1bb5b56056f7e33fea28911f292cec8
SHA256 90a633d97758f69628fe1a01cd785537c54d8116c87a040e29298f5fccdff9ed
SHA512 22e2ae421f5b1fd0767778221892c400cc6641ea8bb244a00a81b83b5ad0b48a76561465a986437a658c694866c44cd743043735df8006b2272b79aceb1d781a

memory/3324-13-0x0000000000400000-0x0000000000431000-memory.dmp

memory/3324-14-0x0000000075270000-0x00000000753CD000-memory.dmp

memory/3324-18-0x0000000000400000-0x0000000000431000-memory.dmp

C:\Windows\System\spoolsv.exe

MD5 4308645528fa4e3261bdb0bed0aa509f
SHA1 df3a3fa70ddd762b463cc164382910ed0e06f45c
SHA256 966e5d115d1be4921ea0fa9c3745794b809622fb42c29168aaee5d48d11634df
SHA512 51aefdc872bc31ae2dff4b195fd6f5cd7a22066a697d11c8e593cdaeacb0a9dcb337126de85aea6538f921612893d6764c82c6ab69720416fcb72deeb121a367

memory/1092-25-0x0000000075270000-0x00000000753CD000-memory.dmp

memory/1092-30-0x0000000000400000-0x0000000000431000-memory.dmp

memory/1092-27-0x0000000000400000-0x0000000000431000-memory.dmp

C:\Windows\System\svchost.exe

MD5 3cea86b83d5e2d00953d502a52ca94ab
SHA1 077684bcf2fa6f9808f8e05d0ff62be09f7245f3
SHA256 4f3ea1a13aeb4f7938fa1fb6cbcab07ba6f9734532556a3282409661fe66f28b
SHA512 1d0fd7c0dfa3cad192d68dbff9e7e460cf2f07598cb2e16bb7a63b8c0cbe0d138c9a4f1ce425de16044b788daab5c298d6f02117cc859ef1e8e4d184f6583d91

memory/2492-37-0x0000000075270000-0x00000000753CD000-memory.dmp

memory/2492-42-0x0000000000400000-0x0000000000431000-memory.dmp

memory/4504-44-0x0000000075270000-0x00000000753CD000-memory.dmp

memory/4504-50-0x0000000000400000-0x0000000000431000-memory.dmp

memory/1092-54-0x0000000000400000-0x0000000000431000-memory.dmp

memory/4204-57-0x0000000000401000-0x000000000042E000-memory.dmp

memory/4204-56-0x0000000000400000-0x0000000000431000-memory.dmp

C:\Users\Admin\AppData\Roaming\mrsys.exe

MD5 fa77f3792d6cd1ed56e34dc98c3a192d
SHA1 97529bd1ea7a3ed61bf821289ad994a7d9d1f5a8
SHA256 69805f0aef3ce01d5d5c03ce41084739e70867eea686cd839e8ec0acc6c7e40a
SHA512 867585f79bee97379b92503a75d5310590ca1ce4bd0b4842586446c1f39c0b49adcb6692c5d8c43c5ac383d651066a17b353421c3235ba71f4f65c26ce51eb48

memory/3324-59-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2492-60-0x0000000000400000-0x0000000000431000-memory.dmp

memory/3324-69-0x0000000000400000-0x0000000000431000-memory.dmp

\??\PIPE\atsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 12:36

Reported

2024-06-13 12:39

Platform

win7-20240611-en

Max time kernel

150s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7cd6169a5656572078e159fd6a1755a0_NeikiAnalytics.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\svchost.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\svchost.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\svchost.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe N/A
File opened for modification \??\c:\windows\system\explorer.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\svchost.exe N/A
File opened for modification C:\Windows\system\udsys.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\explorer.exe C:\Users\Admin\AppData\Local\Temp\7cd6169a5656572078e159fd6a1755a0_NeikiAnalytics.exe N/A
File opened for modification \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\explorer.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7cd6169a5656572078e159fd6a1755a0_NeikiAnalytics.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2336 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\7cd6169a5656572078e159fd6a1755a0_NeikiAnalytics.exe \??\c:\windows\system\explorer.exe
PID 2336 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\7cd6169a5656572078e159fd6a1755a0_NeikiAnalytics.exe \??\c:\windows\system\explorer.exe
PID 2336 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\7cd6169a5656572078e159fd6a1755a0_NeikiAnalytics.exe \??\c:\windows\system\explorer.exe
PID 2336 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\7cd6169a5656572078e159fd6a1755a0_NeikiAnalytics.exe \??\c:\windows\system\explorer.exe
PID 2296 wrote to memory of 2684 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2296 wrote to memory of 2684 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2296 wrote to memory of 2684 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2296 wrote to memory of 2684 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2684 wrote to memory of 2672 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2684 wrote to memory of 2672 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2684 wrote to memory of 2672 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2684 wrote to memory of 2672 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2672 wrote to memory of 2676 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2672 wrote to memory of 2676 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2672 wrote to memory of 2676 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2672 wrote to memory of 2676 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2672 wrote to memory of 288 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2672 wrote to memory of 288 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2672 wrote to memory of 288 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2672 wrote to memory of 288 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2672 wrote to memory of 2044 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2672 wrote to memory of 2044 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2672 wrote to memory of 2044 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2672 wrote to memory of 2044 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2672 wrote to memory of 2508 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2672 wrote to memory of 2508 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2672 wrote to memory of 2508 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2672 wrote to memory of 2508 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe

Processes

C:\Users\Admin\AppData\Local\Temp\7cd6169a5656572078e159fd6a1755a0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\7cd6169a5656572078e159fd6a1755a0_NeikiAnalytics.exe"

\??\c:\windows\system\explorer.exe

c:\windows\system\explorer.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe SE

\??\c:\windows\system\svchost.exe

c:\windows\system\svchost.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe PR

C:\Windows\SysWOW64\at.exe

at 12:39 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Windows\SysWOW64\at.exe

at 12:40 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Windows\SysWOW64\at.exe

at 12:41 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

Network

N/A

Files

memory/2336-1-0x0000000000020000-0x0000000000024000-memory.dmp

memory/2336-0-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2336-2-0x0000000072940000-0x0000000072A93000-memory.dmp

memory/2336-3-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2336-6-0x0000000000401000-0x000000000042E000-memory.dmp

C:\Windows\system\explorer.exe

MD5 e8d85902003ee30f1b86f86ec190ad80
SHA1 8e3677c804beda3c574756c5c2978e0c1cf0b4e0
SHA256 760f0f07efdeb666c5378b2a1f2f9eda8a7c6aaa7e62e8d80fe813eba2b50838
SHA512 d9c00c943c43c92354e0b2de6fd745459c384e02980250c7bff4a3f440e2f6457f90e81ebe99ab323adcec467f09cb97f14be27125782592b4b3847430e10a8e

memory/2296-19-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2336-18-0x00000000005B0000-0x00000000005E1000-memory.dmp

memory/2336-17-0x00000000005B0000-0x00000000005E1000-memory.dmp

memory/2296-22-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2296-20-0x0000000072940000-0x0000000072A93000-memory.dmp

\Windows\system\spoolsv.exe

MD5 df7d5693e884551e9d650354031e8c92
SHA1 7ece731a2be8a980e242812fac961402584f6c0c
SHA256 dded968db64ff909c3c2c7d91095ccb7184e4ab67ef14075929fb528bed823b1
SHA512 8e78e1ecfbca7b006ef95b5be4549f5220be0fb34d7a61e6eeeec6b5ceadd869733285f91b01ce90937a0f12190e27e27c9c1cd2d25eb042f3a57a40193e8881

memory/2296-31-0x0000000002620000-0x0000000002651000-memory.dmp

memory/2684-37-0x0000000072940000-0x0000000072A93000-memory.dmp

memory/2684-41-0x0000000000400000-0x0000000000431000-memory.dmp

\Windows\system\svchost.exe

MD5 d5a49697acc762a5adc97f13f61798c1
SHA1 bffa2196a1f4f9770a1057d4b7e935852c028164
SHA256 070c2daa7a3f55c230159a3c6aae079d62c4d5052a3a7f35948cc4423966037f
SHA512 a4db793ed0d3d2d0e51947d50570a2e4e9dab415c2f52bc58592311ea502b4394e03e1133c20c239b3f687bbf1051f09bff0641cdb6c91d34669a67eee444970

memory/2672-54-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2684-53-0x0000000003130000-0x0000000003161000-memory.dmp

memory/2672-55-0x0000000072940000-0x0000000072A93000-memory.dmp

memory/2672-59-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2672-64-0x0000000002430000-0x0000000002461000-memory.dmp

memory/2672-65-0x0000000002430000-0x0000000002461000-memory.dmp

memory/2336-80-0x0000000000401000-0x000000000042E000-memory.dmp

memory/2336-79-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2684-76-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2676-74-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2676-72-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2676-67-0x0000000072940000-0x0000000072A93000-memory.dmp

C:\Users\Admin\AppData\Roaming\mrsys.exe

MD5 650d4c6a966e2372e3c2bfceda0b9d2e
SHA1 d869b2eb6d28aed73a7ff49058065200cc4d15cb
SHA256 5d7b41be846be96d427a78eaa9e23e414c9bfeeef5a9e3a2246b6d5b5b24b66b
SHA512 06fe7ff5bc69adb9cb11f12102dd254509c9a149c4616c0cab3d81bc5130f7c3541fc66372c79bb48d45168f686f08a916155d06572c1a6f1b47796f8ea72022

memory/2296-82-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2672-84-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2296-93-0x0000000000400000-0x0000000000431000-memory.dmp