Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 02:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9c28bb1e6cbc76b9cf40425506208130_NeikiAnalytics.exe
Resource
win7-20240611-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
9c28bb1e6cbc76b9cf40425506208130_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 9c28bb1e6cbc76b9cf40425506208130_NeikiAnalytics.exe
- Size 206KB
- Sample240614-c7sh8ssdpb
- SHA256 6a07f957ae327899b2363f818aa3d0c250be1892b0e82f219d85b62e5ff4d599
- MD5 9c28bb1e6cbc76b9cf40425506208130
- SHA1 5f9f93582280a869b45c3c8053e80f01bbde91f9
- SHA512 2f63d93f7e0f1e41585cb0eaa717e6125cd70fad099d5be86932988adc3dec25269a68a489b50d6a02257e1fa2ae180a953003cb1704d25535f4ffccc988dc91
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unLn:5vEN2U+T6i5LirrllHy4HUcMQY6Kn
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Modifies Installed Components in the registry 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe - Executes dropped EXE 4 IoCs
pid Process 5076 explorer.exe 2836 spoolsv.exe 2444 svchost.exe 1112 spoolsv.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe 9c28bb1e6cbc76b9cf40425506208130_NeikiAnalytics.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3692 9c28bb1e6cbc76b9cf40425506208130_NeikiAnalytics.exe 3692 9c28bb1e6cbc76b9cf40425506208130_NeikiAnalytics.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 5076 explorer.exe 2444 svchost.exe 2444 svchost.exe 2444 svchost.exe 2444 svchost.exe 5076 explorer.exe 5076 explorer.exe 2444 svchost.exe 2444 svchost.exe 5076 explorer.exe 5076 explorer.exe 2444 svchost.exe 2444 svchost.exe 5076 explorer.exe 5076 explorer.exe 2444 svchost.exe 2444 svchost.exe 5076 explorer.exe 5076 explorer.exe 2444 svchost.exe 2444 svchost.exe 5076 explorer.exe 5076 explorer.exe 2444 svchost.exe 2444 svchost.exe 5076 explorer.exe 5076 explorer.exe 2444 svchost.exe 2444 svchost.exe 5076 explorer.exe 5076 explorer.exe 2444 svchost.exe 2444 svchost.exe 5076 explorer.exe 5076 explorer.exe 2444 svchost.exe 2444 svchost.exe 5076 explorer.exe 5076 explorer.exe 2444 svchost.exe 2444 svchost.exe 5076 explorer.exe 5076 explorer.exe 2444 svchost.exe 2444 svchost.exe 5076 explorer.exe 5076 explorer.exe 2444 svchost.exe 2444 svchost.exe 5076 explorer.exe 5076 explorer.exe 2444 svchost.exe 2444 svchost.exe 5076 explorer.exe 5076 explorer.exe 2444 svchost.exe 2444 svchost.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 5076 explorer.exe 2444 svchost.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3692 9c28bb1e6cbc76b9cf40425506208130_NeikiAnalytics.exe 3692 9c28bb1e6cbc76b9cf40425506208130_NeikiAnalytics.exe 5076 explorer.exe 5076 explorer.exe 2836 spoolsv.exe 2836 spoolsv.exe 2444 svchost.exe 2444 svchost.exe 1112 spoolsv.exe 1112 spoolsv.exe 5076 explorer.exe 5076 explorer.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 3692 wrote to memory of 5076 3692 9c28bb1e6cbc76b9cf40425506208130_NeikiAnalytics.exe 81 PID 3692 wrote to memory of 5076 3692 9c28bb1e6cbc76b9cf40425506208130_NeikiAnalytics.exe 81 PID 3692 wrote to memory of 5076 3692 9c28bb1e6cbc76b9cf40425506208130_NeikiAnalytics.exe 81 PID 5076 wrote to memory of 2836 5076 explorer.exe 82 PID 5076 wrote to memory of 2836 5076 explorer.exe 82 PID 5076 wrote to memory of 2836 5076 explorer.exe 82 PID 2836 wrote to memory of 2444 2836 spoolsv.exe 83 PID 2836 wrote to memory of 2444 2836 spoolsv.exe 83 PID 2836 wrote to memory of 2444 2836 spoolsv.exe 83 PID 2444 wrote to memory of 1112 2444 svchost.exe 84 PID 2444 wrote to memory of 1112 2444 svchost.exe 84 PID 2444 wrote to memory of 1112 2444 svchost.exe 84 PID 2444 wrote to memory of 4428 2444 svchost.exe 85 PID 2444 wrote to memory of 4428 2444 svchost.exe 85 PID 2444 wrote to memory of 4428 2444 svchost.exe 85 PID 2444 wrote to memory of 2428 2444 svchost.exe 97 PID 2444 wrote to memory of 2428 2444 svchost.exe 97 PID 2444 wrote to memory of 2428 2444 svchost.exe 97 PID 2444 wrote to memory of 3948 2444 svchost.exe 99 PID 2444 wrote to memory of 3948 2444 svchost.exe 99 PID 2444 wrote to memory of 3948 2444 svchost.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\9c28bb1e6cbc76b9cf40425506208130_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9c28bb1e6cbc76b9cf40425506208130_NeikiAnalytics.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1112
-
-
C:\Windows\SysWOW64\at.exeat 02:45 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:4428
-
-
C:\Windows\SysWOW64\at.exeat 02:46 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:2428
-
-
C:\Windows\SysWOW64\at.exeat 02:47 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:3948
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\mrsys.exe
- Size 206KB
- SHA256 5e5b1d1ade2c13d13d29cc0d9d9a337c7ede1e950fc60ee3a6ee0b4c3fdf96a9
- MD5 f5e91af47d514f75b3cec3d67f4f3a12
- SHA1 3fcdc1a8baaea75c57f3a3524937572d450d2df7
- SHA512 d455bb5512e9a022648423cef3ca0d83f5feed593ca58fbd60c06b0720045737e8bb8918a850c46042a2c72b15be58e767071fb2daa493dabbbd45102b516041
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unLR:5vEN2U+T6i5LirrllHy4HUcMQY6KR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\spoolsv.exe
- Size 206KB
- SHA256 d35c2f2cf100517ffb4e63fedeef1ca8a10467620f5e4dd55ecd71c7da3065d0
- MD5 ca7a310e5899c7e7f9ac1edbaf4f6dde
- SHA1 bfc9e861fefcde43ac75fe8acb1a5c7e9bf4b82c
- SHA512 2d223cd2a4b9507da79ef23bdd1c9b5fa893e3918b563e0062544e48d94c4298349d069c381afb029a80962e7603fef6065b70f7a3edee5857f1aa144f38a229
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unL/:5vEN2U+T6i5LirrllHy4HUcMQY6K/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\svchost.exe
- Size 206KB
- SHA256 7887a56259a65494af9066381c32658a3631d0aa1ce30d890d2d1a290b9035df
- MD5 f15d482c6e21ecd6dd4a1ed727b1ff1a
- SHA1 ca136fcc69d994520e5a2f6c91b94f95edf03b83
- SHA512 4555cd24e56ff17628d4df60a520c4c068cf3b5e6872b48359e945a663f7ea2fb23957f42033c74b5e1359fdf02565a86c688095cde6d34f409cfeb3a55df0cb
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unLw:5vEN2U+T6i5LirrllHy4HUcMQY6Kw
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\windows\system\explorer.exe
- Size 206KB
- SHA256 01fd395bed4a3ea92a9241b893da9ebc606d97bb59504565b39711d806019542
- MD5 f9ec4861cc325cac83debdeaf0fc7b89
- SHA1 07c4edbebc94a3c06f598b7c3204696f4595af4c
- SHA512 f0b407deacde81abfb16724ff4cbae0beed6102b52ba5e1256512eb9fe8e4ea2976f8443ed6b8b50ba90633dbdf5a29f26e2ce6bf6fad1e924c28ba40507a3e1
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unLg:5vEN2U+T6i5LirrllHy4HUcMQY6Kg
- MD5 SHA1 SHA512 SSDEEP