2ec2060b1ccc60f75f8223110fc7ea1739c68e402847230d5d519d4596c8f3db

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 02:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9c358170ad200b520d22458ecd8a9cd0_NeikiAnalytics.exe
Size

65KB
MD5

9c358170ad200b520d22458ecd8a9cd0
SHA1

9948614bc4b957b6c5d506a1876cac01aa7fa1a1
SHA256

2ec2060b1ccc60f75f8223110fc7ea1739c68e402847230d5d519d4596c8f3db
SHA512

214c380257316e21dfa7d01da508e531a654af11a09a5529b4925b31587399d4111c388e29f4d853443833fe676be738fb502fe6b84f51c85ddcdbad3011546a
SSDEEP

1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Oux:7WNqkOJWmo1HpM0MkTUmux

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2412	explorer.exe
2672	spoolsv.exe
2732	svchost.exe
2716	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
1276	9c358170ad200b520d22458ecd8a9cd0_NeikiAnalytics.exe
1276	9c358170ad200b520d22458ecd8a9cd0_NeikiAnalytics.exe
2412	explorer.exe
2412	explorer.exe
2672	spoolsv.exe
2672	spoolsv.exe
2732	svchost.exe
2732	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	9c358170ad200b520d22458ecd8a9cd0_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1276	9c358170ad200b520d22458ecd8a9cd0_NeikiAnalytics.exe
2412	explorer.exe
2412	explorer.exe
2412	explorer.exe
2732	svchost.exe
2732	svchost.exe
2412	explorer.exe
2732	svchost.exe
2412	explorer.exe
2732	svchost.exe
2412	explorer.exe
2732	svchost.exe
2412	explorer.exe
2732	svchost.exe
2412	explorer.exe
2732	svchost.exe
2412	explorer.exe
2732	svchost.exe
2412	explorer.exe
2732	svchost.exe
2412	explorer.exe
2732	svchost.exe
2412	explorer.exe
2732	svchost.exe
2412	explorer.exe
2732	svchost.exe
2412	explorer.exe
2732	svchost.exe
2412	explorer.exe
2732	svchost.exe
2412	explorer.exe
2732	svchost.exe
2412	explorer.exe
2732	svchost.exe
2412	explorer.exe
2732	svchost.exe
2412	explorer.exe
2732	svchost.exe
2412	explorer.exe
2732	svchost.exe
2412	explorer.exe
2732	svchost.exe
2412	explorer.exe
2732	svchost.exe
2412	explorer.exe
2732	svchost.exe
2412	explorer.exe
2732	svchost.exe
2412	explorer.exe
2732	svchost.exe
2412	explorer.exe
2732	svchost.exe
2412	explorer.exe
2732	svchost.exe
2412	explorer.exe
2732	svchost.exe
2412	explorer.exe
2732	svchost.exe
2412	explorer.exe
2732	svchost.exe
2412	explorer.exe
2732	svchost.exe
2412	explorer.exe
2732	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2412	explorer.exe
2732	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1276	9c358170ad200b520d22458ecd8a9cd0_NeikiAnalytics.exe
1276	9c358170ad200b520d22458ecd8a9cd0_NeikiAnalytics.exe
2412	explorer.exe
2412	explorer.exe
2672	spoolsv.exe
2672	spoolsv.exe
2732	svchost.exe
2732	svchost.exe
2716	spoolsv.exe
2716	spoolsv.exe
2412	explorer.exe
2412	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 2412	1276	9c358170ad200b520d22458ecd8a9cd0_NeikiAnalytics.exe	28
PID 1276 wrote to memory of 2412	1276	9c358170ad200b520d22458ecd8a9cd0_NeikiAnalytics.exe	28
PID 1276 wrote to memory of 2412	1276	9c358170ad200b520d22458ecd8a9cd0_NeikiAnalytics.exe	28
PID 1276 wrote to memory of 2412	1276	9c358170ad200b520d22458ecd8a9cd0_NeikiAnalytics.exe	28
PID 2412 wrote to memory of 2672	2412	explorer.exe	29
PID 2412 wrote to memory of 2672	2412	explorer.exe	29
PID 2412 wrote to memory of 2672	2412	explorer.exe	29
PID 2412 wrote to memory of 2672	2412	explorer.exe	29
PID 2672 wrote to memory of 2732	2672	spoolsv.exe	30
PID 2672 wrote to memory of 2732	2672	spoolsv.exe	30
PID 2672 wrote to memory of 2732	2672	spoolsv.exe	30
PID 2672 wrote to memory of 2732	2672	spoolsv.exe	30
PID 2732 wrote to memory of 2716	2732	svchost.exe	31
PID 2732 wrote to memory of 2716	2732	svchost.exe	31
PID 2732 wrote to memory of 2716	2732	svchost.exe	31
PID 2732 wrote to memory of 2716	2732	svchost.exe	31
PID 2732 wrote to memory of 2932	2732	svchost.exe	32
PID 2732 wrote to memory of 2932	2732	svchost.exe	32
PID 2732 wrote to memory of 2932	2732	svchost.exe	32
PID 2732 wrote to memory of 2932	2732	svchost.exe	32
PID 2732 wrote to memory of 1624	2732	svchost.exe	36
PID 2732 wrote to memory of 1624	2732	svchost.exe	36
PID 2732 wrote to memory of 1624	2732	svchost.exe	36
PID 2732 wrote to memory of 1624	2732	svchost.exe	36
PID 2732 wrote to memory of 632	2732	svchost.exe	38
PID 2732 wrote to memory of 632	2732	svchost.exe	38
PID 2732 wrote to memory of 632	2732	svchost.exe	38
PID 2732 wrote to memory of 632	2732	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\9c358170ad200b520d22458ecd8a9cd0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9c358170ad200b520d22458ecd8a9cd0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1276
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2412
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2672
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2732
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2716
    - - C:\Windows\SysWOW64\at.exe
        
        at 02:46 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2932
    - - C:\Windows\SysWOW64\at.exe
        
        at 02:47 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1624
    - - C:\Windows\SysWOW64\at.exe
        
        at 02:48 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
65KB

MD5
68c94d89366af39acea06387a508b57a

SHA1
1cb56c95a47ce163ef1764357f394420f3712f7b

SHA256
63ed0e05e972033aaa3e6517d744ee134f36b940faf5ec62e24b90f3f0aaa218

SHA512
94d361eed1b16435dd2a44f584ce5928b7afccf86581f9fd546bb8038b16d96b29ca35ad7b0e5c87c6422ec218edd143177baf5deed2e31638e572fbd46fb924

Download Submit
C:\Windows\system\spoolsv.exe

Filesize
65KB

MD5
560e3d5105acd1f63c257b4da300d164

SHA1
cef47cc52e81aecc1de6d6e0df276211480f2c0b

SHA256
ba19c315d28e41819f4e1f38606a43a93a898d7f4d07591835d721c9f9a7e3c8

SHA512
6e7969c634128bd7714a60cbeda90bc5008ad9c083f6403844f42a1a69d89faf7087fda6b97617f8c0e415725c39ec68bb3e6b25b032c0ae1943818baac7eb2c

Download Submit
\Windows\system\explorer.exe

Filesize
65KB

MD5
39928f169fdf4af65f45affeb1fa0276

SHA1
582bf0ed6d053f7d94726026d73761939980c80f

SHA256
203da0ffc57c19994f203981b326baa6b1f62599dc008e20f157f931b838e0e3

SHA512
99484a9b326a0d34ff2fecfe1b9bca0a67766d10a235e636c2f846cc2982265743bd054b4f8f24efad8a71d285fae302986f010c56cd17f9e9acb4a62ca9bed1

Download Submit
\Windows\system\svchost.exe

Filesize
65KB

MD5
e06cd744898437a571c73c8141987ede

SHA1
1974308ef4b1092ee23e170c485fd92731e65f7e

SHA256
270ca601089c0167a09946e661c44343fbbb5a76e4894e4f93f1538c78b062ff

SHA512
903d8696db8e36821598ea170e171c699ffeac34991a079637d967acf6017e42441c033c325378f0f9b71c4e9f4e6eb0a663a076e4d7a567212af108e222a65c

Download Submit
memory/1276-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1276-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1276-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1276-48-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/1276-17-0x0000000003250000-0x0000000003281000-memory.dmp

Filesize
196KB

Download
memory/1276-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/1276-77-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1276-78-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1276-52-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1276-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/2412-20-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2412-18-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2412-21-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2412-90-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2412-59-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2412-80-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2412-34-0x0000000002490000-0x00000000024C1000-memory.dmp

Filesize
196KB

Download
memory/2672-53-0x0000000002520000-0x0000000002551000-memory.dmp

Filesize
196KB

Download
memory/2672-40-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2672-36-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2672-76-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2716-72-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2716-66-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2732-81-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2732-60-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2732-55-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download