Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 02:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9be22eacfd1763070b3f03a6cf461210_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
9be22eacfd1763070b3f03a6cf461210_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 9be22eacfd1763070b3f03a6cf461210_NeikiAnalytics.exe
- Size 206KB
- Sample240614-c6ewrawdnj
- SHA256 7bcbd61768f2222cdb3159c3c62d0049775edd8e410dc99673ac15081c2af9fb
- MD5 9be22eacfd1763070b3f03a6cf461210
- SHA1 a8851c556e249888185fc2a18f495e39140bbddd
- SHA512 37d76208c0bbedcc48f9a0e52ea7dbcdc1deae4de5c3e163cfcb74f54cff7c49bb4ababb580d98dd9429e462a9b7c04dc78e9143ebdb06ff83be820811b9d915
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unLo:5vEN2U+T6i5LirrllHy4HUcMQY6Ko
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Modifies Installed Components in the registry 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe - Executes dropped EXE 4 IoCs
pid Process 64 explorer.exe 3724 spoolsv.exe 5028 svchost.exe 3536 spoolsv.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe 9be22eacfd1763070b3f03a6cf461210_NeikiAnalytics.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4796 9be22eacfd1763070b3f03a6cf461210_NeikiAnalytics.exe 4796 9be22eacfd1763070b3f03a6cf461210_NeikiAnalytics.exe 64 explorer.exe 64 explorer.exe 64 explorer.exe 64 explorer.exe 64 explorer.exe 64 explorer.exe 5028 svchost.exe 5028 svchost.exe 5028 svchost.exe 5028 svchost.exe 64 explorer.exe 64 explorer.exe 64 explorer.exe 5028 svchost.exe 64 explorer.exe 5028 svchost.exe 5028 svchost.exe 64 explorer.exe 5028 svchost.exe 64 explorer.exe 5028 svchost.exe 64 explorer.exe 64 explorer.exe 5028 svchost.exe 5028 svchost.exe 64 explorer.exe 5028 svchost.exe 64 explorer.exe 5028 svchost.exe 64 explorer.exe 64 explorer.exe 5028 svchost.exe 5028 svchost.exe 5028 svchost.exe 64 explorer.exe 64 explorer.exe 5028 svchost.exe 64 explorer.exe 64 explorer.exe 5028 svchost.exe 5028 svchost.exe 5028 svchost.exe 64 explorer.exe 64 explorer.exe 64 explorer.exe 5028 svchost.exe 64 explorer.exe 5028 svchost.exe 64 explorer.exe 5028 svchost.exe 64 explorer.exe 5028 svchost.exe 64 explorer.exe 5028 svchost.exe 64 explorer.exe 5028 svchost.exe 64 explorer.exe 5028 svchost.exe 64 explorer.exe 5028 svchost.exe 5028 svchost.exe 64 explorer.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 64 explorer.exe 5028 svchost.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4796 9be22eacfd1763070b3f03a6cf461210_NeikiAnalytics.exe 4796 9be22eacfd1763070b3f03a6cf461210_NeikiAnalytics.exe 64 explorer.exe 64 explorer.exe 3724 spoolsv.exe 3724 spoolsv.exe 5028 svchost.exe 5028 svchost.exe 3536 spoolsv.exe 3536 spoolsv.exe 64 explorer.exe 64 explorer.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 4796 wrote to memory of 64 4796 9be22eacfd1763070b3f03a6cf461210_NeikiAnalytics.exe 82 PID 4796 wrote to memory of 64 4796 9be22eacfd1763070b3f03a6cf461210_NeikiAnalytics.exe 82 PID 4796 wrote to memory of 64 4796 9be22eacfd1763070b3f03a6cf461210_NeikiAnalytics.exe 82 PID 64 wrote to memory of 3724 64 explorer.exe 83 PID 64 wrote to memory of 3724 64 explorer.exe 83 PID 64 wrote to memory of 3724 64 explorer.exe 83 PID 3724 wrote to memory of 5028 3724 spoolsv.exe 85 PID 3724 wrote to memory of 5028 3724 spoolsv.exe 85 PID 3724 wrote to memory of 5028 3724 spoolsv.exe 85 PID 5028 wrote to memory of 3536 5028 svchost.exe 86 PID 5028 wrote to memory of 3536 5028 svchost.exe 86 PID 5028 wrote to memory of 3536 5028 svchost.exe 86 PID 5028 wrote to memory of 776 5028 svchost.exe 87 PID 5028 wrote to memory of 776 5028 svchost.exe 87 PID 5028 wrote to memory of 776 5028 svchost.exe 87 PID 5028 wrote to memory of 3076 5028 svchost.exe 96 PID 5028 wrote to memory of 3076 5028 svchost.exe 96 PID 5028 wrote to memory of 3076 5028 svchost.exe 96 PID 5028 wrote to memory of 5112 5028 svchost.exe 98 PID 5028 wrote to memory of 5112 5028 svchost.exe 98 PID 5028 wrote to memory of 5112 5028 svchost.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\9be22eacfd1763070b3f03a6cf461210_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9be22eacfd1763070b3f03a6cf461210_NeikiAnalytics.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:64 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3724 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3536
-
-
C:\Windows\SysWOW64\at.exeat 02:43 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:776
-
-
C:\Windows\SysWOW64\at.exeat 02:44 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:3076
-
-
C:\Windows\SysWOW64\at.exeat 02:45 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:5112
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\mrsys.exe
- Size 206KB
- SHA256 5d189a8e082f798c06c1e280c547edaf20519d1cf16bc9276599ef347105becc
- MD5 4573cdf28f5101acd235e04055c8e64a
- SHA1 116f235f77fbd99aef381bc39a0f0e9f43478db0
- SHA512 c639d93ef85988111e7e07d2eca42230e36097262114d502fb675d1a438fae6911fb028b3f2be0f43b968d31e5bbac4b2a7b53d77c8098d8f895ea75698d3ff7
- SSDEEP 6144:5vEN2U+T6i5LirrllHy4HUcMQY6KXyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyK:RENN+T5xYrllrU7QY6K6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\explorer.exe
- Size 206KB
- SHA256 5106f22dec0e81c97aed119ab8d538768ef20d5119f4988bffec71b577bffcfc
- MD5 c14ace8fac88d0aeade2ca9e3e401b90
- SHA1 6a8f8c3fb47f3256c550482191e42d1623399ef8
- SHA512 e1fa9c6af0730b3cf426cd0715239b45ffb1af6b3c9b288164af33c8d6662738a06903641b522abaa21166a61293bd63972f4c7126ceffced301d3572511aab2
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unLy:5vEN2U+T6i5LirrllHy4HUcMQY6Ky
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\spoolsv.exe
- Size 206KB
- SHA256 f59dfe1b7ac6495c96e9e5edfc5876e3159a32b342a6b2f2c28fecb4c594e207
- MD5 ddd32cb15b825f27eb5b6fdb1d105769
- SHA1 b6bdd61145bda1f427b2bbe987fcaabb81c1a79a
- SHA512 72d738358a7c47f1902a15eef37418de3f88ded9501a4b7d78a1a0c41e85133a9889f5749c5dfe90c709550aa28b1f192fedc9f56fa5a2e7d341ec9ffa7c5734
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unLz:5vEN2U+T6i5LirrllHy4HUcMQY6Kz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\svchost.exe
- Size 206KB
- SHA256 754183680dbe21d70e9f276d95c0fb7af30578d45deffa730f6429e9a663e719
- MD5 59ff2542ba5e23161edc88e0a0ad9065
- SHA1 2583c08b191ec502df71531bd6c6db9ac56bd82a
- SHA512 dc60f7b2b30b1e09881544c0c74b6adae39a0250924429aa6d4096163c0474742f6c134b962570d62975229fedae0364261a9e7ca57991c9c6b14c86941f77b9
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unLO:5vEN2U+T6i5LirrllHy4HUcMQY6KO
- MD5 SHA1 SHA512 SSDEEP