56f36684641bf10a757827a468557c14ec2b3667c6efdb917fd316bf36c5f641

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9ffe3a6dd504f31bcd57d46ba22b0550_NeikiAnalytics.exe
Size 66KB
Sample240614-eekc9stgrb
SHA256 56f36684641bf10a757827a468557c14ec2b3667c6efdb917fd316bf36c5f641
MD5 9ffe3a6dd504f31bcd57d46ba22b0550
SHA1 4c0dc4a8b988ed0dd230afaa89fcd758cbaf7dc8
SHA512 88176d344b2823960b266f667d0dd79540ac5e7ab34629f57133401805c759fd195b2eab8922c16b9b3e12983bfc8ad59b0200ec98d881e9140d3a89b881e05e
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXi6ffffffffffffffffffffe:IeklMMYJhqezw/pXzH9i6ffffffffffe
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
1984	explorer.exe
2576	spoolsv.exe
2864	svchost.exe
2476	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
940	9ffe3a6dd504f31bcd57d46ba22b0550_NeikiAnalytics.exe
940	9ffe3a6dd504f31bcd57d46ba22b0550_NeikiAnalytics.exe
1984	explorer.exe
1984	explorer.exe
2576	spoolsv.exe
2576	spoolsv.exe
2864	svchost.exe
2864	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	9ffe3a6dd504f31bcd57d46ba22b0550_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
940	9ffe3a6dd504f31bcd57d46ba22b0550_NeikiAnalytics.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
2864	svchost.exe
2864	svchost.exe
1984	explorer.exe
2864	svchost.exe
1984	explorer.exe
2864	svchost.exe
1984	explorer.exe
2864	svchost.exe
1984	explorer.exe
2864	svchost.exe
1984	explorer.exe
2864	svchost.exe
1984	explorer.exe
2864	svchost.exe
1984	explorer.exe
2864	svchost.exe
1984	explorer.exe
2864	svchost.exe
1984	explorer.exe
2864	svchost.exe
1984	explorer.exe
2864	svchost.exe
1984	explorer.exe
2864	svchost.exe
1984	explorer.exe
2864	svchost.exe
1984	explorer.exe
2864	svchost.exe
1984	explorer.exe
2864	svchost.exe
1984	explorer.exe
2864	svchost.exe
1984	explorer.exe
2864	svchost.exe
1984	explorer.exe
2864	svchost.exe
1984	explorer.exe
2864	svchost.exe
1984	explorer.exe
2864	svchost.exe
1984	explorer.exe
2864	svchost.exe
1984	explorer.exe
2864	svchost.exe
1984	explorer.exe
2864	svchost.exe
1984	explorer.exe
2864	svchost.exe
1984	explorer.exe
2864	svchost.exe
1984	explorer.exe
2864	svchost.exe
1984	explorer.exe
2864	svchost.exe
1984	explorer.exe
2864	svchost.exe
1984	explorer.exe
2864	svchost.exe
1984	explorer.exe
2864	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1984	explorer.exe
2864	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
940	9ffe3a6dd504f31bcd57d46ba22b0550_NeikiAnalytics.exe
940	9ffe3a6dd504f31bcd57d46ba22b0550_NeikiAnalytics.exe
1984	explorer.exe
1984	explorer.exe
2576	spoolsv.exe
2576	spoolsv.exe
2864	svchost.exe
2864	svchost.exe
2476	spoolsv.exe
2476	spoolsv.exe
1984	explorer.exe
1984	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 1984	940	9ffe3a6dd504f31bcd57d46ba22b0550_NeikiAnalytics.exe	28
PID 940 wrote to memory of 1984	940	9ffe3a6dd504f31bcd57d46ba22b0550_NeikiAnalytics.exe	28
PID 940 wrote to memory of 1984	940	9ffe3a6dd504f31bcd57d46ba22b0550_NeikiAnalytics.exe	28
PID 940 wrote to memory of 1984	940	9ffe3a6dd504f31bcd57d46ba22b0550_NeikiAnalytics.exe	28
PID 1984 wrote to memory of 2576	1984	explorer.exe	29
PID 1984 wrote to memory of 2576	1984	explorer.exe	29
PID 1984 wrote to memory of 2576	1984	explorer.exe	29
PID 1984 wrote to memory of 2576	1984	explorer.exe	29
PID 2576 wrote to memory of 2864	2576	spoolsv.exe	30
PID 2576 wrote to memory of 2864	2576	spoolsv.exe	30
PID 2576 wrote to memory of 2864	2576	spoolsv.exe	30
PID 2576 wrote to memory of 2864	2576	spoolsv.exe	30
PID 2864 wrote to memory of 2476	2864	svchost.exe	31
PID 2864 wrote to memory of 2476	2864	svchost.exe	31
PID 2864 wrote to memory of 2476	2864	svchost.exe	31
PID 2864 wrote to memory of 2476	2864	svchost.exe	31
PID 2864 wrote to memory of 2524	2864	svchost.exe	32
PID 2864 wrote to memory of 2524	2864	svchost.exe	32
PID 2864 wrote to memory of 2524	2864	svchost.exe	32
PID 2864 wrote to memory of 2524	2864	svchost.exe	32
PID 2864 wrote to memory of 1680	2864	svchost.exe	36
PID 2864 wrote to memory of 1680	2864	svchost.exe	36
PID 2864 wrote to memory of 1680	2864	svchost.exe	36
PID 2864 wrote to memory of 1680	2864	svchost.exe	36
PID 2864 wrote to memory of 2304	2864	svchost.exe	38
PID 2864 wrote to memory of 2304	2864	svchost.exe	38
PID 2864 wrote to memory of 2304	2864	svchost.exe	38
PID 2864 wrote to memory of 2304	2864	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\9ffe3a6dd504f31bcd57d46ba22b0550_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9ffe3a6dd504f31bcd57d46ba22b0550_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:940
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1984
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2864
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2476
    - - C:\Windows\SysWOW64\at.exe
        
        at 03:53 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2524
    - - C:\Windows\SysWOW64\at.exe
        
        at 03:54 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1680
    - - C:\Windows\SysWOW64\at.exe
        
        at 03:55 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mrsys.exe

Path C:\Users\Admin\AppData\Roaming\mrsys.exe
Size 66KB
SHA256 27a74225afd9edf3f9884e8fc3d82ef1d7c0084cc92a55720fdb2380fe111290
MD5 573851c9c108bcb3da37e17c92831c8d
SHA1 fbb3b3ed884f9cfc2b12820c04cd888ea5c2fd8a
SHA512 788ef9cd6f9f70516b67e01fbd23348be6d4048652b62eadd7f3385fb7d0f2fdfe59a02388fd17b5198e473fec2f3d18f8070cfea38adbb844d9fd7d0ea17444
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXir:IeklMMYJhqezw/pXzH9ir
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path \Windows\system\explorer.exe
Size 66KB
SHA256 3586749e81c9c6b52c3ccb6ad1b31f77ec6826af3a4f2ff3be219c250fc7e48e
MD5 9d50d25dab6da32b20a6960b8b85832b
SHA1 b86895fc7c4a8adc221dd3d4159c3eed37c02f75
SHA512 5c7a04e7b322d51a502acd49a6dc8e43434970ee65133a6607ac3bfff9e227bc2b4436d577aae4f340ea8cdec35cbc2c4b0148d25b381b84f73d322f27ea750f
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXic:IeklMMYJhqezw/pXzH9ic
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path \Windows\system\spoolsv.exe
Size 66KB
SHA256 b9fb4717725464e324b4215a69b9d672358528fb6170fec44944643715b0eb09
MD5 e77f575dd69b01223570c1fb95e1c174
SHA1 dd88a49c38803bd6a90dae766d225e1ef09a95e7
SHA512 a67b00d515581824576bbf3cd57affe56b1809a693ea66b659340803fd1214d5adff2ec059c3c72de438e00a2a7411f258e82dff1f729b9c48deb3654e5bbc31
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiR:IeklMMYJhqezw/pXzH9iR
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path \Windows\system\svchost.exe
Size 66KB
SHA256 ea51dd142407cfb72d2265b2a60c6cb2d4e6a30a9b8f52c76ad226e112cff67c
MD5 aabfd5c5b58526fa45acc81b6ebe6270
SHA1 df7ae966f690c395d6144553ca68ad4d1621ca43
SHA512 de2412f664653f834f3d142d8d300a452dff88bbbfbfbb736467075c5befd90cda405985cfc9675c9f45f63357e0824696a0af45b244041df178ccf38216cee5
SSDEEP 1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiE:IeklMMYJhqezw/pXzH9iE
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/940-17-0x00000000030E0000-0x0000000003111000-memory.dmp

Download

memory/940-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Download

memory/940-79-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/940-64-0x0000000000020000-0x0000000000024000-memory.dmp

Download

memory/940-0-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/940-16-0x00000000030E0000-0x0000000003111000-memory.dmp

Download

memory/940-3-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/940-78-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/940-1-0x0000000000020000-0x0000000000024000-memory.dmp

Download

memory/940-4-0x0000000000401000-0x000000000042E000-memory.dmp

Download

memory/1984-81-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1984-35-0x0000000003100000-0x0000000003131000-memory.dmp

Download

memory/1984-92-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1984-19-0x0000000072940000-0x0000000072A93000-memory.dmp

Download

memory/1984-21-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2476-66-0x0000000072940000-0x0000000072A93000-memory.dmp

Download

memory/2476-72-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2576-53-0x0000000002680000-0x00000000026B1000-memory.dmp

Download

memory/2576-76-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2576-41-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2576-37-0x0000000072940000-0x0000000072A93000-memory.dmp

Download

memory/2576-36-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2864-54-0x0000000072940000-0x0000000072A93000-memory.dmp

Download

memory/2864-58-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/2864-65-0x0000000002520000-0x0000000002551000-memory.dmp

Download

memory/2864-83-0x0000000000400000-0x0000000000431000-memory.dmp

Download