Analysis
- max time kernel
150s - max time network
119s - platform
windows7_x64 - resource
win7-20231129-en - resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system - submitted
14/06/2024, 04:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a0fdc8e23499a7b7e6725a0b36c340c0_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
a0fdc8e23499a7b7e6725a0b36c340c0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target a0fdc8e23499a7b7e6725a0b36c340c0_NeikiAnalytics.exe
- Size 206KB
- Sample240614-en9draycml
- SHA256 f4318e3504a7e5fac6f4baf1fb311e4aa5ac319bcb836cc1effb5d2ca47b8c4d
- MD5 a0fdc8e23499a7b7e6725a0b36c340c0
- SHA1 738664a3fea7d92bd17166b291bf99838c5eb6c7
- SHA512 bfd3ec4b7a1477a08843883811410efeb8ff9ab64320e18e94d8e9b739341008f6888a030dc465aeb605514b03efab7fa63fe56a20b0cf8ce0d2d51f7a05d106
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unLC:5vEN2U+T6i5LirrllHy4HUcMQY6KC
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Modifies Installed Components in the registry 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe - Executes dropped EXE 4 IoCs
pid Process 2204 explorer.exe 2128 spoolsv.exe 2660 svchost.exe 2712 spoolsv.exe - Loads dropped DLL 8 IoCs
pid Process 2820 a0fdc8e23499a7b7e6725a0b36c340c0_NeikiAnalytics.exe 2820 a0fdc8e23499a7b7e6725a0b36c340c0_NeikiAnalytics.exe 2204 explorer.exe 2204 explorer.exe 2128 spoolsv.exe 2128 spoolsv.exe 2660 svchost.exe 2660 svchost.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification \??\c:\windows\system\explorer.exe a0fdc8e23499a7b7e6725a0b36c340c0_NeikiAnalytics.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2820 a0fdc8e23499a7b7e6725a0b36c340c0_NeikiAnalytics.exe 2204 explorer.exe 2204 explorer.exe 2204 explorer.exe 2660 svchost.exe 2660 svchost.exe 2204 explorer.exe 2660 svchost.exe 2204 explorer.exe 2660 svchost.exe 2204 explorer.exe 2660 svchost.exe 2204 explorer.exe 2660 svchost.exe 2204 explorer.exe 2660 svchost.exe 2204 explorer.exe 2660 svchost.exe 2204 explorer.exe 2660 svchost.exe 2204 explorer.exe 2660 svchost.exe 2204 explorer.exe 2660 svchost.exe 2204 explorer.exe 2660 svchost.exe 2204 explorer.exe 2660 svchost.exe 2204 explorer.exe 2660 svchost.exe 2204 explorer.exe 2660 svchost.exe 2204 explorer.exe 2660 svchost.exe 2204 explorer.exe 2660 svchost.exe 2204 explorer.exe 2660 svchost.exe 2204 explorer.exe 2660 svchost.exe 2204 explorer.exe 2660 svchost.exe 2204 explorer.exe 2660 svchost.exe 2204 explorer.exe 2660 svchost.exe 2204 explorer.exe 2660 svchost.exe 2204 explorer.exe 2660 svchost.exe 2204 explorer.exe 2660 svchost.exe 2204 explorer.exe 2660 svchost.exe 2204 explorer.exe 2660 svchost.exe 2204 explorer.exe 2660 svchost.exe 2204 explorer.exe 2660 svchost.exe 2204 explorer.exe 2660 svchost.exe 2204 explorer.exe 2660 svchost.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2204 explorer.exe 2660 svchost.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2820 a0fdc8e23499a7b7e6725a0b36c340c0_NeikiAnalytics.exe 2820 a0fdc8e23499a7b7e6725a0b36c340c0_NeikiAnalytics.exe 2204 explorer.exe 2204 explorer.exe 2128 spoolsv.exe 2128 spoolsv.exe 2660 svchost.exe 2660 svchost.exe 2712 spoolsv.exe 2712 spoolsv.exe 2204 explorer.exe 2204 explorer.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2820 wrote to memory of 2204 2820 a0fdc8e23499a7b7e6725a0b36c340c0_NeikiAnalytics.exe 28 PID 2820 wrote to memory of 2204 2820 a0fdc8e23499a7b7e6725a0b36c340c0_NeikiAnalytics.exe 28 PID 2820 wrote to memory of 2204 2820 a0fdc8e23499a7b7e6725a0b36c340c0_NeikiAnalytics.exe 28 PID 2820 wrote to memory of 2204 2820 a0fdc8e23499a7b7e6725a0b36c340c0_NeikiAnalytics.exe 28 PID 2204 wrote to memory of 2128 2204 explorer.exe 29 PID 2204 wrote to memory of 2128 2204 explorer.exe 29 PID 2204 wrote to memory of 2128 2204 explorer.exe 29 PID 2204 wrote to memory of 2128 2204 explorer.exe 29 PID 2128 wrote to memory of 2660 2128 spoolsv.exe 30 PID 2128 wrote to memory of 2660 2128 spoolsv.exe 30 PID 2128 wrote to memory of 2660 2128 spoolsv.exe 30 PID 2128 wrote to memory of 2660 2128 spoolsv.exe 30 PID 2660 wrote to memory of 2712 2660 svchost.exe 31 PID 2660 wrote to memory of 2712 2660 svchost.exe 31 PID 2660 wrote to memory of 2712 2660 svchost.exe 31 PID 2660 wrote to memory of 2712 2660 svchost.exe 31 PID 2660 wrote to memory of 2688 2660 svchost.exe 32 PID 2660 wrote to memory of 2688 2660 svchost.exe 32 PID 2660 wrote to memory of 2688 2660 svchost.exe 32 PID 2660 wrote to memory of 2688 2660 svchost.exe 32 PID 2660 wrote to memory of 964 2660 svchost.exe 36 PID 2660 wrote to memory of 964 2660 svchost.exe 36 PID 2660 wrote to memory of 964 2660 svchost.exe 36 PID 2660 wrote to memory of 964 2660 svchost.exe 36 PID 2660 wrote to memory of 1884 2660 svchost.exe 38 PID 2660 wrote to memory of 1884 2660 svchost.exe 38 PID 2660 wrote to memory of 1884 2660 svchost.exe 38 PID 2660 wrote to memory of 1884 2660 svchost.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0fdc8e23499a7b7e6725a0b36c340c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a0fdc8e23499a7b7e6725a0b36c340c0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2712
-
-
C:\Windows\SysWOW64\at.exeat 04:08 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:2688
-
-
C:\Windows\SysWOW64\at.exeat 04:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:964
-
-
C:\Windows\SysWOW64\at.exeat 04:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:1884
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\mrsys.exe
- Size 206KB
- SHA256 de29f506cb98dfef3d8bb6ece1ab4d23b61f281251e67aee51dea3824fc3be4d
- MD5 c6aa70d32b932630d11e7d7939664aba
- SHA1 dcee8090887ad93157d970d19d784f8e74f4a51e
- SHA512 0e55abd87a245ad08475418899f8cb2e1ba798ab5604fa8f671f0175cf7d2921a3e64451d8b7da61c0741d48d49b6780e08b4a9cc094a7973736cc05166bed40
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unLQ:5vEN2U+T6i5LirrllHy4HUcMQY6KQ
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\system\explorer.exe
- Size 206KB
- SHA256 aa73fad8ec906ea239c3eb023f58d856871d7d2bcd3228300bef21606bb0fb4b
- MD5 55fe670d7aee2f4982a5289647bc332d
- SHA1 8434379dcf835a25681f1ef80c4a91f1086e19cb
- SHA512 cb90c62ca8fedb6ec1682df061cba766a0d440f1fa5987e9789dce858210242b6a2c72a06cf0d3515450f2d44e51580df737561d7805d75d1b8648945a30328f
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unL8:5vEN2U+T6i5LirrllHy4HUcMQY6K8
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\system\spoolsv.exe
- Size 206KB
- SHA256 06d55e806d4159b5af21563b65b5f258fe59917d49fb7f5b9d04ed05890c9ae2
- MD5 a3d4b83c3bd8f47932d769f7693260bf
- SHA1 c72319c765b2138ba2419387b4a06555b943943a
- SHA512 1af6e93bb0ba991de533126072e7246d7f57e4d7c2aa948d844b59628d606d8c44636dffe33d15f1b279d698168e85a503dc849a0b78c327c0d5d3a6cba927a9
- SSDEEP 6144:5vEN2U+T6i5LirrllHy4HUcMQY6KjEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE9:RENN+T5xYrllrU7QY6KjEEEEEEEEEEEM
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\system\svchost.exe
- Size 206KB
- SHA256 83e41d2b7aa85c9ea8b714f4ced4076dc00da63aad519b4cf068b2e205637b1c
- MD5 43521ab04f6b658e16aecb90574ba681
- SHA1 a71d9b7b7230fc3f348ca963b492350b72d1a2ea
- SHA512 1b201419fe134eb1abe8a22bed9f1be048c811b6317832640f1657a127de102577daf24806264297ac4b3efbe3af1cbccb71435321a07418a066d0182cc859a8
- SSDEEP 6144:5vEN2U+T6i5LirrllHy4HUcMQY6KUttttttttttttttttttttttttttttttttttd:RENN+T5xYrllrU7QY6Kg
- MD5 SHA1 SHA512 SSDEEP