Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-06-2024 02:12

General

  • Target

    9a4c7160bfaf6f401fe670e344bb3d00_NeikiAnalytics.exe

  • Size

    66KB

  • MD5

    9a4c7160bfaf6f401fe670e344bb3d00

  • SHA1

    dd9dd1beb84afb4559ad5df79d2714e473dc54ca

  • SHA256

    de4eae0e14a9519efaca31ff237a2315607cd412b0c023c697514b7bf826366d

  • SHA512

    a07e362498750c843bc874a324e0dcf73ae06662b2cb8feb5c0e99916ef0c305b2fd163960817e7bf5246318ae94bd468e14ada21ac2eabd314c4b0fe19b4570

  • SSDEEP

    1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXim:IeklMMYJhqezw/pXzH9im

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9a4c7160bfaf6f401fe670e344bb3d00_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\9a4c7160bfaf6f401fe670e344bb3d00_NeikiAnalytics.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3604
    • \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3012
      • \??\c:\windows\system\spoolsv.exe
        c:\windows\system\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1884
        • \??\c:\windows\system\svchost.exe
          c:\windows\system\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1768
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:3724
          • C:\Windows\SysWOW64\at.exe
            at 02:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
              PID:3448
            • C:\Windows\SysWOW64\at.exe
              at 02:15 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              5⤵
                PID:2152
              • C:\Windows\SysWOW64\at.exe
                at 02:16 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                5⤵
                  PID:4568
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4036 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
          1⤵
            PID:1976

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Roaming\mrsys.exe

            Filesize

            66KB

            MD5

            b073bca2ee17dc16c856f0196229a9fc

            SHA1

            4b6caa4c53080022144e0c0626545098f8904eed

            SHA256

            f6f96c49e162e8d9ef735240ed4f7bd221178e9c0f81bd7d1188d223d44623a5

            SHA512

            1e00cd520ac0b37add806c51dc54dc0fc727ec57bae1ed3042e0a1f68c374ba7872bfa86c528df4401bb50131d751db4eeef506e7685f285b5f61ac5b8cd2dae

          • C:\Windows\System\explorer.exe

            Filesize

            66KB

            MD5

            70ff2ffc60ef4e55b391e09c5ebebcac

            SHA1

            940a56d05d4edb44d539c076e7c95ea27ecabe1d

            SHA256

            3b5bc6618c11494d8a581c7bf48e79e8abd4db628e5a464978a7b7ace6e412c4

            SHA512

            83dee608fc09fbbdd1ba0c7d26a23c85ea6ced251d3683731af6a5a9e988815eb63cc7f7ac7677c107efef947df06308a58bbe2d618bc46b2cf833ed88bcfb97

          • C:\Windows\System\spoolsv.exe

            Filesize

            66KB

            MD5

            a9daa9feac887ea35a5305abd0778631

            SHA1

            9990624ec5741e7296d265d229e705fe57cab99a

            SHA256

            3c1fc159529a13d408376757eb8f02bb28a3190792f3c32987cd87397a3762e6

            SHA512

            9c7fe95b9ce56676563c64aed8f42b8e61f28f7410237ddd14a1f2c873eacdf79b0be8dc6478ea49b063db23f5091fff755f8b7bb22721a491875b66778804f5

          • \??\PIPE\atsvc

            MD5

            d41d8cd98f00b204e9800998ecf8427e

            SHA1

            da39a3ee5e6b4b0d3255bfef95601890afd80709

            SHA256

            e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

            SHA512

            cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

          • \??\c:\windows\system\svchost.exe

            Filesize

            66KB

            MD5

            cbef1234bc530e9fd250b4202659e9dd

            SHA1

            e8067359ebcf352aebd0319290a269b4252841b4

            SHA256

            6427e05ba3bbb4a194cede3dca49f0be65e5efa0610784735b34a1983cf1e72a

            SHA512

            adc063ba3d8d0fb96fd9425260589ed7c1857a266dc66ca3322a4e22211aac5a4eb3d927322c0d20237eff5c5ca74a2800004cba76ce08afa1448c49edc080f0

          • memory/1768-61-0x0000000000400000-0x0000000000431000-memory.dmp

            Filesize

            196KB

          • memory/1768-42-0x0000000000400000-0x0000000000431000-memory.dmp

            Filesize

            196KB

          • memory/1768-37-0x0000000075520000-0x000000007567D000-memory.dmp

            Filesize

            1.4MB

          • memory/1884-31-0x0000000000400000-0x0000000000431000-memory.dmp

            Filesize

            196KB

          • memory/1884-54-0x0000000000400000-0x0000000000431000-memory.dmp

            Filesize

            196KB

          • memory/1884-25-0x0000000000400000-0x0000000000431000-memory.dmp

            Filesize

            196KB

          • memory/1884-26-0x0000000075520000-0x000000007567D000-memory.dmp

            Filesize

            1.4MB

          • memory/3012-16-0x0000000000400000-0x0000000000431000-memory.dmp

            Filesize

            196KB

          • memory/3012-14-0x0000000075520000-0x000000007567D000-memory.dmp

            Filesize

            1.4MB

          • memory/3012-72-0x0000000000400000-0x0000000000431000-memory.dmp

            Filesize

            196KB

          • memory/3012-13-0x0000000000400000-0x0000000000431000-memory.dmp

            Filesize

            196KB

          • memory/3012-59-0x0000000000400000-0x0000000000431000-memory.dmp

            Filesize

            196KB

          • memory/3604-56-0x0000000000400000-0x0000000000431000-memory.dmp

            Filesize

            196KB

          • memory/3604-4-0x0000000000401000-0x000000000042E000-memory.dmp

            Filesize

            180KB

          • memory/3604-57-0x0000000000401000-0x000000000042E000-memory.dmp

            Filesize

            180KB

          • memory/3604-45-0x0000000000401000-0x000000000042E000-memory.dmp

            Filesize

            180KB

          • memory/3604-2-0x0000000075520000-0x000000007567D000-memory.dmp

            Filesize

            1.4MB

          • memory/3604-41-0x00000000001C0000-0x00000000001C4000-memory.dmp

            Filesize

            16KB

          • memory/3604-3-0x0000000000400000-0x0000000000431000-memory.dmp

            Filesize

            196KB

          • memory/3604-0-0x0000000000400000-0x0000000000431000-memory.dmp

            Filesize

            196KB

          • memory/3604-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

            Filesize

            16KB

          • memory/3724-46-0x0000000075520000-0x000000007567D000-memory.dmp

            Filesize

            1.4MB

          • memory/3724-51-0x0000000000400000-0x0000000000431000-memory.dmp

            Filesize

            196KB