Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
14-06-2024 02:17
Static task
static1
Behavioral task
behavioral1
Sample
9a988c6d6e79862014355cfd15de3880_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
9a988c6d6e79862014355cfd15de3880_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
9a988c6d6e79862014355cfd15de3880_NeikiAnalytics.exe
-
Size
211KB
-
MD5
9a988c6d6e79862014355cfd15de3880
-
SHA1
35c096be0fec01146e8322bf0e4b11b56f45e022
-
SHA256
9162b42d29acba7304b15c72248286e2fab156fc71787d4dad94df98f56894d1
-
SHA512
99857d9335ac45ca6c9bf179cb61f974da0403d41e715040c753774d53626c6bc61c05cfd39c10a30ec1d6866b9a1fa994460abf466b4a1e955c85a6805eec39
-
SSDEEP
3072:JD6Xtx68yygRBE52mxkEOHLRMpZ4deth8PEAjAfIbAYGPhz6sPJBInxZqOH:Jh8cBzHLRMpZ4d1ZH
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
userinit.exeswchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\userinit.exe" userinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\userinit.exe" swchost.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
userinit.exeswchost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" userinit.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" swchost.exe -
Modifies Installed Components in the registry 2 TTPs 8 IoCs
Processes:
swchost.exeuserinit.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} swchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} userinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\mrsys.exe MR" userinit.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} swchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\mrsys.exe MR" swchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} swchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} swchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\mrsys.exe MR" swchost.exe -
Executes dropped EXE 4 IoCs
Processes:
userinit.exespoolsw.exeswchost.exespoolsw.exepid process 2348 userinit.exe 2160 spoolsw.exe 2896 swchost.exe 2760 spoolsw.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
userinit.exeswchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\userinit = "c:\\windows\\userinit.exe RO" userinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Swchost = "c:\\windows\\swchost.exe RO" userinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\userinit = "c:\\windows\\userinit.exe RO" swchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Swchost = "c:\\windows\\swchost.exe RO" swchost.exe -
Drops file in System32 directory 1 IoCs
Processes:
userinit.exedescription ioc process File opened for modification C:\Windows\SysWOW64\system\udsys.exe userinit.exe -
Drops file in Windows directory 5 IoCs
Processes:
9a988c6d6e79862014355cfd15de3880_NeikiAnalytics.exeuserinit.exespoolsw.exeswchost.exedescription ioc process File opened for modification \??\c:\windows\userinit.exe 9a988c6d6e79862014355cfd15de3880_NeikiAnalytics.exe File opened for modification \??\c:\windows\spoolsw.exe userinit.exe File opened for modification \??\c:\windows\swchost.exe spoolsw.exe File opened for modification \??\c:\windows\userinit.exe userinit.exe File opened for modification \??\c:\windows\swchost.exe swchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
9a988c6d6e79862014355cfd15de3880_NeikiAnalytics.exeuserinit.exeswchost.exepid process 2436 9a988c6d6e79862014355cfd15de3880_NeikiAnalytics.exe 2348 userinit.exe 2348 userinit.exe 2348 userinit.exe 2896 swchost.exe 2896 swchost.exe 2348 userinit.exe 2896 swchost.exe 2348 userinit.exe 2896 swchost.exe 2348 userinit.exe 2896 swchost.exe 2348 userinit.exe 2896 swchost.exe 2348 userinit.exe 2896 swchost.exe 2348 userinit.exe 2896 swchost.exe 2348 userinit.exe 2896 swchost.exe 2348 userinit.exe 2896 swchost.exe 2348 userinit.exe 2896 swchost.exe 2348 userinit.exe 2896 swchost.exe 2348 userinit.exe 2896 swchost.exe 2348 userinit.exe 2896 swchost.exe 2348 userinit.exe 2896 swchost.exe 2348 userinit.exe 2896 swchost.exe 2348 userinit.exe 2896 swchost.exe 2348 userinit.exe 2896 swchost.exe 2348 userinit.exe 2896 swchost.exe 2348 userinit.exe 2896 swchost.exe 2348 userinit.exe 2896 swchost.exe 2348 userinit.exe 2896 swchost.exe 2348 userinit.exe 2896 swchost.exe 2348 userinit.exe 2896 swchost.exe 2348 userinit.exe 2896 swchost.exe 2348 userinit.exe 2896 swchost.exe 2348 userinit.exe 2896 swchost.exe 2348 userinit.exe 2896 swchost.exe 2348 userinit.exe 2896 swchost.exe 2348 userinit.exe 2896 swchost.exe 2348 userinit.exe 2896 swchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
userinit.exeswchost.exepid process 2348 userinit.exe 2896 swchost.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
9a988c6d6e79862014355cfd15de3880_NeikiAnalytics.exeuserinit.exespoolsw.exeswchost.exespoolsw.exepid process 2436 9a988c6d6e79862014355cfd15de3880_NeikiAnalytics.exe 2436 9a988c6d6e79862014355cfd15de3880_NeikiAnalytics.exe 2348 userinit.exe 2348 userinit.exe 2160 spoolsw.exe 2160 spoolsw.exe 2896 swchost.exe 2896 swchost.exe 2760 spoolsw.exe 2760 spoolsw.exe 2348 userinit.exe 2348 userinit.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
9a988c6d6e79862014355cfd15de3880_NeikiAnalytics.exeuserinit.exespoolsw.exeswchost.exedescription pid process target process PID 2436 wrote to memory of 2348 2436 9a988c6d6e79862014355cfd15de3880_NeikiAnalytics.exe userinit.exe PID 2436 wrote to memory of 2348 2436 9a988c6d6e79862014355cfd15de3880_NeikiAnalytics.exe userinit.exe PID 2436 wrote to memory of 2348 2436 9a988c6d6e79862014355cfd15de3880_NeikiAnalytics.exe userinit.exe PID 2436 wrote to memory of 2348 2436 9a988c6d6e79862014355cfd15de3880_NeikiAnalytics.exe userinit.exe PID 2348 wrote to memory of 2160 2348 userinit.exe spoolsw.exe PID 2348 wrote to memory of 2160 2348 userinit.exe spoolsw.exe PID 2348 wrote to memory of 2160 2348 userinit.exe spoolsw.exe PID 2348 wrote to memory of 2160 2348 userinit.exe spoolsw.exe PID 2160 wrote to memory of 2896 2160 spoolsw.exe swchost.exe PID 2160 wrote to memory of 2896 2160 spoolsw.exe swchost.exe PID 2160 wrote to memory of 2896 2160 spoolsw.exe swchost.exe PID 2160 wrote to memory of 2896 2160 spoolsw.exe swchost.exe PID 2896 wrote to memory of 2760 2896 swchost.exe spoolsw.exe PID 2896 wrote to memory of 2760 2896 swchost.exe spoolsw.exe PID 2896 wrote to memory of 2760 2896 swchost.exe spoolsw.exe PID 2896 wrote to memory of 2760 2896 swchost.exe spoolsw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a988c6d6e79862014355cfd15de3880_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9a988c6d6e79862014355cfd15de3880_NeikiAnalytics.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\windows\userinit.exec:\windows\userinit.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\windows\spoolsw.exec:\windows\spoolsw.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\windows\swchost.exec:\windows\swchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\windows\spoolsw.exec:\windows\spoolsw.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2760
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
211KB
MD56d83a07b32984250bdd1fc2742dc7a5d
SHA1f485891fdf02e5fc3dc6b6cde471146b325d3fe2
SHA256a45eab6100e471b06f3d7c9b7c9f8a7576ebd9d4df619760ed6d359e331c5ece
SHA5122f3710e9c1427b8f2bc6e7de6e35ecd5231c59b21537a2d3aba76c9e0bb0a03024f7bcfb2042f241115d7c1c54f7c7823597fcc633b5682185e994f9d8c614c4
-
Filesize
211KB
MD5b11cc491b34331ae5e4488a908e2d8ce
SHA1db728ab7400dfca011b2350ff7756506d55e1d1f
SHA256a2ff1bacabadf27ac79358e563b60fa569b2b88232a1275907faef6fbd1bdd89
SHA51299eeaae5c44904aacee86135893e8ab06c06bbd29383efa3127ab2fd7de00a42444d32d6eec0e0279b84c56df60272958f2f0c42dcd66ee7071c6e7d6c43017d
-
Filesize
211KB
MD5cef476eb8683e268b3c72455148a470d
SHA1bd5917d15d500520e8b2dccaa064c193c836cee4
SHA2562c4ec805f769a7409e37fc9e05646216ee183b1c0b5be88ab7c6f350c539348f
SHA512ca5bafc90033482fb271c6624c0a015b6616032a01b942fa0a6c266e19c00323ead0297cab4c0661a752187b67835028055964570a3d7c4e1ed7fefb62f67de4
-
Filesize
211KB
MD5248632488064c618f792a4f7bdf21c35
SHA1939d9559dbd3e9877f22a317b17d8a77eca0f2a3
SHA25665b30f1fe56ef5359e0e8f01ee97007890af8b99a97b28edc9a50b854b49b95f
SHA5121f9171122ebcae67cf010ad2fc2db2898300fa2da2daf8b8900cc6206385f0901a03a955a1bbba1a1d700a7c8db44510d56ae2f65b5aff6096eac24032906113