7bfa16f4687747816f1e6c6e08404e8cdab82f13c9daa99e8d0c390f43b545de

Analysis

max time kernel
150s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 03:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9dcb6d48ac9e9d78af6cd6818951f180_NeikiAnalytics.exe
Size

65KB
MD5

9dcb6d48ac9e9d78af6cd6818951f180
SHA1

0cd44b249fb9b48da51e464e6ddf07b8cf32d175
SHA256

7bfa16f4687747816f1e6c6e08404e8cdab82f13c9daa99e8d0c390f43b545de
SHA512

c0dc7d217219905cebd6561fda3be1ef56c29c7f472bd1207c8c93825f8cbc4a0b8e982137150548d224bf36d23d73cf59eddbe090bfced799b5c1623a95578a
SSDEEP

1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Ouf:7WNqkOJWmo1HpM0MkTUmuf

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
3376	explorer.exe
2608	spoolsv.exe
4208	svchost.exe
4540	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	9dcb6d48ac9e9d78af6cd6818951f180_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1244	9dcb6d48ac9e9d78af6cd6818951f180_NeikiAnalytics.exe
1244	9dcb6d48ac9e9d78af6cd6818951f180_NeikiAnalytics.exe
3376	explorer.exe
3376	explorer.exe
3376	explorer.exe
3376	explorer.exe
3376	explorer.exe
3376	explorer.exe
3376	explorer.exe
3376	explorer.exe
4208	svchost.exe
4208	svchost.exe
4208	svchost.exe
4208	svchost.exe
3376	explorer.exe
3376	explorer.exe
4208	svchost.exe
4208	svchost.exe
3376	explorer.exe
3376	explorer.exe
4208	svchost.exe
4208	svchost.exe
3376	explorer.exe
3376	explorer.exe
4208	svchost.exe
4208	svchost.exe
3376	explorer.exe
3376	explorer.exe
4208	svchost.exe
4208	svchost.exe
3376	explorer.exe
3376	explorer.exe
4208	svchost.exe
4208	svchost.exe
3376	explorer.exe
3376	explorer.exe
4208	svchost.exe
4208	svchost.exe
3376	explorer.exe
3376	explorer.exe
4208	svchost.exe
4208	svchost.exe
3376	explorer.exe
3376	explorer.exe
4208	svchost.exe
4208	svchost.exe
3376	explorer.exe
3376	explorer.exe
4208	svchost.exe
4208	svchost.exe
3376	explorer.exe
3376	explorer.exe
4208	svchost.exe
4208	svchost.exe
3376	explorer.exe
3376	explorer.exe
4208	svchost.exe
4208	svchost.exe
3376	explorer.exe
3376	explorer.exe
4208	svchost.exe
4208	svchost.exe
3376	explorer.exe
3376	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3376	explorer.exe
4208	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1244	9dcb6d48ac9e9d78af6cd6818951f180_NeikiAnalytics.exe
1244	9dcb6d48ac9e9d78af6cd6818951f180_NeikiAnalytics.exe
3376	explorer.exe
3376	explorer.exe
2608	spoolsv.exe
2608	spoolsv.exe
4208	svchost.exe
4208	svchost.exe
4540	spoolsv.exe
4540	spoolsv.exe
3376	explorer.exe
3376	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 3376	1244	9dcb6d48ac9e9d78af6cd6818951f180_NeikiAnalytics.exe	81
PID 1244 wrote to memory of 3376	1244	9dcb6d48ac9e9d78af6cd6818951f180_NeikiAnalytics.exe	81
PID 1244 wrote to memory of 3376	1244	9dcb6d48ac9e9d78af6cd6818951f180_NeikiAnalytics.exe	81
PID 3376 wrote to memory of 2608	3376	explorer.exe	83
PID 3376 wrote to memory of 2608	3376	explorer.exe	83
PID 3376 wrote to memory of 2608	3376	explorer.exe	83
PID 2608 wrote to memory of 4208	2608	spoolsv.exe	84
PID 2608 wrote to memory of 4208	2608	spoolsv.exe	84
PID 2608 wrote to memory of 4208	2608	spoolsv.exe	84
PID 4208 wrote to memory of 4540	4208	svchost.exe	86
PID 4208 wrote to memory of 4540	4208	svchost.exe	86
PID 4208 wrote to memory of 4540	4208	svchost.exe	86
PID 4208 wrote to memory of 4916	4208	svchost.exe	87
PID 4208 wrote to memory of 4916	4208	svchost.exe	87
PID 4208 wrote to memory of 4916	4208	svchost.exe	87
PID 4208 wrote to memory of 1348	4208	svchost.exe	89
PID 4208 wrote to memory of 1348	4208	svchost.exe	89
PID 4208 wrote to memory of 1348	4208	svchost.exe	89
PID 4208 wrote to memory of 4108	4208	svchost.exe	91
PID 4208 wrote to memory of 4108	4208	svchost.exe	91
PID 4208 wrote to memory of 4108	4208	svchost.exe	91

C:\Users\Admin\AppData\Local\Temp\9dcb6d48ac9e9d78af6cd6818951f180_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9dcb6d48ac9e9d78af6cd6818951f180_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3376
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2608
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4208
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4540
    - - C:\Windows\SysWOW64\at.exe
        
        at 03:15 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:4916
    - - C:\Windows\SysWOW64\at.exe
        
        at 03:16 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1348
    - - C:\Windows\SysWOW64\at.exe
        
        at 03:17 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:4108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
65KB

MD5
e3590e121886fb4bfc4444ea41287ea9

SHA1
a3b0e4d03e2c37b73d6476d52db5ab8fb9135831

SHA256
f2ea424204b48df2204f1568c58ffc082fe58bdb7797249baf68f47a8d917e91

SHA512
4f87042e528a33c19d9fffce54a375919511842ce479fd002634a34a67eade9da456741f243c4ff7ac068684fce63d996243ea0ec2d4a324942ae65b378e60a3

Download Submit
C:\Windows\System\explorer.exe

Filesize
65KB

MD5
087109dff941fea6703a99c763352a39

SHA1
c5dfb76093edb57ec3e16d585bc747494ac4352e

SHA256
df0fb9a7e611aabe0ed67ba142be6d54caa70cb195e3fb084d4b28207272ad2c

SHA512
cc9d364ec5300b7f4f9f4f75de8cd877a65cad80cbd0934db703e12ed86bad6f5ae5bab88ec6fc9ef3ff69fa1ccba222e27a80fba8e82445dc2e7bcfaa6d22a0

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
65KB

MD5
e9ff000e76352f85913454294e5b1fef

SHA1
5470a75bb527d90ab4aecef5bcb290f843511ec1

SHA256
bd6ec90599694de83c9f843235c0a947429bb6fcaa92ff483cf22f7cc37aa60f

SHA512
4e343812ebb93c97596e27e3cca783672b83c3f4f6121d06bf990864c559f1f10fdd8156da6e685ee5b9285555882b6dd92655568fea666a35fe4ba36c8a8065

Download Submit
C:\Windows\System\svchost.exe

Filesize
65KB

MD5
3797e1491ba553229f1f86e914e14cf3

SHA1
3f339baed82311269cda32c65f58c962da8f3962

SHA256
2a09f9f5417561c170c332fbe1a5c69ba8378516ea67fe1360dbb4a16201960e

SHA512
c21645a6498c949c93d729f4431f194ec87d36538256856d471447ffa004d12838295b4e99b7a185e8330ce60cae7fc43e82089ed6ce0c84233ef232d3e91ef6

Download Submit
memory/1244-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1244-6-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1244-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1244-58-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1244-57-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1244-1-0x0000000074EE0000-0x000000007503D000-memory.dmp

Filesize
1.4MB

Download
memory/1244-2-0x00000000001C0000-0x00000000001C4000-memory.dmp

Filesize
16KB

Download
memory/2608-56-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2608-25-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2608-27-0x0000000074EE0000-0x000000007503D000-memory.dmp

Filesize
1.4MB

Download
memory/2608-31-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3376-14-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3376-19-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3376-13-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3376-15-0x0000000074EE0000-0x000000007503D000-memory.dmp

Filesize
1.4MB

Download
memory/3376-60-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3376-71-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4208-38-0x0000000074EE0000-0x000000007503D000-memory.dmp

Filesize
1.4MB

Download
memory/4208-40-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4208-62-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4540-45-0x0000000074EE0000-0x000000007503D000-memory.dmp

Filesize
1.4MB

Download
memory/4540-50-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4540-52-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download