Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 20:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
83b44bbb36f4c6ba7c0c2d1ec8887990_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
83b44bbb36f4c6ba7c0c2d1ec8887990_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 83b44bbb36f4c6ba7c0c2d1ec8887990_NeikiAnalytics.exe
- Size 207KB
- Sample240613-y3yeksyhrf
- SHA256 e69754e5b31907ddec3a0c03bd67371772156925f1cdfd5ae77a23b1e3e4035b
- MD5 83b44bbb36f4c6ba7c0c2d1ec8887990
- SHA1 f4b5cf1d64e0e674d07cf02b78c111602e9c7d18
- SHA512 8b7df82a11c13641794afc206ea7e80030de8213229e868184386c316109ffd0c1d975cbd4f1db7f885407eed4519656feea7f5f9607879a709e07f9cd56bf20
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unw1:5vEN2U+T6i5LirrllHy4HUcMQY6J
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Modifies Installed Components in the registry 2 TTPs 8 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe - Executes dropped EXE 4 IoCs
pid Process 1976 explorer.exe 4392 spoolsv.exe 4844 svchost.exe 4688 spoolsv.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe 83b44bbb36f4c6ba7c0c2d1ec8887990_NeikiAnalytics.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2644 83b44bbb36f4c6ba7c0c2d1ec8887990_NeikiAnalytics.exe 2644 83b44bbb36f4c6ba7c0c2d1ec8887990_NeikiAnalytics.exe 1976 explorer.exe 1976 explorer.exe 1976 explorer.exe 1976 explorer.exe 1976 explorer.exe 1976 explorer.exe 4844 svchost.exe 4844 svchost.exe 4844 svchost.exe 4844 svchost.exe 1976 explorer.exe 1976 explorer.exe 4844 svchost.exe 4844 svchost.exe 1976 explorer.exe 1976 explorer.exe 4844 svchost.exe 4844 svchost.exe 1976 explorer.exe 1976 explorer.exe 4844 svchost.exe 4844 svchost.exe 1976 explorer.exe 1976 explorer.exe 4844 svchost.exe 4844 svchost.exe 1976 explorer.exe 1976 explorer.exe 4844 svchost.exe 4844 svchost.exe 1976 explorer.exe 1976 explorer.exe 4844 svchost.exe 4844 svchost.exe 1976 explorer.exe 1976 explorer.exe 4844 svchost.exe 4844 svchost.exe 1976 explorer.exe 1976 explorer.exe 4844 svchost.exe 4844 svchost.exe 1976 explorer.exe 1976 explorer.exe 4844 svchost.exe 4844 svchost.exe 1976 explorer.exe 1976 explorer.exe 4844 svchost.exe 4844 svchost.exe 1976 explorer.exe 1976 explorer.exe 4844 svchost.exe 4844 svchost.exe 1976 explorer.exe 1976 explorer.exe 4844 svchost.exe 4844 svchost.exe 1976 explorer.exe 1976 explorer.exe 4844 svchost.exe 4844 svchost.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1976 explorer.exe 4844 svchost.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2644 83b44bbb36f4c6ba7c0c2d1ec8887990_NeikiAnalytics.exe 2644 83b44bbb36f4c6ba7c0c2d1ec8887990_NeikiAnalytics.exe 1976 explorer.exe 1976 explorer.exe 4392 spoolsv.exe 4392 spoolsv.exe 4844 svchost.exe 4844 svchost.exe 4688 spoolsv.exe 4688 spoolsv.exe 1976 explorer.exe 1976 explorer.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2644 wrote to memory of 1976 2644 83b44bbb36f4c6ba7c0c2d1ec8887990_NeikiAnalytics.exe 82 PID 2644 wrote to memory of 1976 2644 83b44bbb36f4c6ba7c0c2d1ec8887990_NeikiAnalytics.exe 82 PID 2644 wrote to memory of 1976 2644 83b44bbb36f4c6ba7c0c2d1ec8887990_NeikiAnalytics.exe 82 PID 1976 wrote to memory of 4392 1976 explorer.exe 83 PID 1976 wrote to memory of 4392 1976 explorer.exe 83 PID 1976 wrote to memory of 4392 1976 explorer.exe 83 PID 4392 wrote to memory of 4844 4392 spoolsv.exe 84 PID 4392 wrote to memory of 4844 4392 spoolsv.exe 84 PID 4392 wrote to memory of 4844 4392 spoolsv.exe 84 PID 4844 wrote to memory of 4688 4844 svchost.exe 85 PID 4844 wrote to memory of 4688 4844 svchost.exe 85 PID 4844 wrote to memory of 4688 4844 svchost.exe 85 PID 4844 wrote to memory of 3272 4844 svchost.exe 87 PID 4844 wrote to memory of 3272 4844 svchost.exe 87 PID 4844 wrote to memory of 3272 4844 svchost.exe 87 PID 4844 wrote to memory of 5012 4844 svchost.exe 99 PID 4844 wrote to memory of 5012 4844 svchost.exe 99 PID 4844 wrote to memory of 5012 4844 svchost.exe 99 PID 4844 wrote to memory of 1080 4844 svchost.exe 101 PID 4844 wrote to memory of 1080 4844 svchost.exe 101 PID 4844 wrote to memory of 1080 4844 svchost.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\83b44bbb36f4c6ba7c0c2d1ec8887990_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\83b44bbb36f4c6ba7c0c2d1ec8887990_NeikiAnalytics.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4392 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4688
-
-
C:\Windows\SysWOW64\at.exeat 20:21 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:3272
-
-
C:\Windows\SysWOW64\at.exeat 20:22 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:5012
-
-
C:\Windows\SysWOW64\at.exeat 20:23 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:1080
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\mrsys.exe
- Size 206KB
- SHA256 64f00220bd1eef616ae08ee55c620a5bb3b56044b63dfd67c550b475793ac06d
- MD5 c12f1ec6449553afcf816d5b7ab8792d
- SHA1 51ad795d936f32470bb4a382eca25e5396c3a456
- SHA512 703662cbc7242bb761cb1a2af98cb76f7d090937423c4101b70009a7b1d8a19211aaac80399423b227843de6e6163c6d56e48316f3540c078646a4e3f89db9c8
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unwJ:5vEN2U+T6i5LirrllHy4HUcMQY61
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\explorer.exe
- Size 206KB
- SHA256 a756a46b9469a517ea1872154cfb6c1b99ad74ade381ef657aea201647fe3fcc
- MD5 314dd79759cd25c33b9d62775e3495fb
- SHA1 80c37152874127dd878771aecd3bafd59bde2cda
- SHA512 9c8938f95b7f0659c1e9f952ff51fb6cac0c396a2399e94f6b317c4b934c8b76f59f95e3f6501216e3f07df84911210ab1ad4c60a8655f49d776e1daf148444c
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unwD:5vEN2U+T6i5LirrllHy4HUcMQY6v
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\spoolsv.exe
- Size 207KB
- SHA256 549cd9cb45e7c0df528309c72fd8dc8012cb48789be2e69bf8e46f7792c26edb
- MD5 d2a5fd7a0fea663b0d76f9a0e9e25bfb
- SHA1 c45d03e7a4391bdecdd879238dc8fa0dba7766e8
- SHA512 bf5cbd2252be15c247627ceaa7949078935bbe594d2b85af023031846daff1352279d820ff141dc6330b8c60eee19903a9f6ef2b7c0f46369b77f6b85c7ffd42
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unwk:5vEN2U+T6i5LirrllHy4HUcMQY6w
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\svchost.exe
- Size 206KB
- SHA256 c7c97b6a429ae2549fc7ae3a54d0efeb8d4162301e8de97604bf8b2dc40b19cf
- MD5 1705f90aeeccfc29402ffe620b73d301
- SHA1 cae0550990060a29d9b32c396a680fa7f00a2508
- SHA512 9924416756d4db04c1e6910d5eac36194ed65410f94f46cc12aede27c7bd5a58377aae92ff44f14a58b394f84331f1f74f9e360082b4a9473dff502e0cf7562a
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unwM:5vEN2U+T6i5LirrllHy4HUcMQY64
- MD5 SHA1 SHA512 SSDEEP