Analysis
- max time kernel
150s - max time network
52s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 04:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a0fdc8e23499a7b7e6725a0b36c340c0_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
a0fdc8e23499a7b7e6725a0b36c340c0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target a0fdc8e23499a7b7e6725a0b36c340c0_NeikiAnalytics.exe
- Size 206KB
- Sample240614-en9draycml
- SHA256 f4318e3504a7e5fac6f4baf1fb311e4aa5ac319bcb836cc1effb5d2ca47b8c4d
- MD5 a0fdc8e23499a7b7e6725a0b36c340c0
- SHA1 738664a3fea7d92bd17166b291bf99838c5eb6c7
- SHA512 bfd3ec4b7a1477a08843883811410efeb8ff9ab64320e18e94d8e9b739341008f6888a030dc465aeb605514b03efab7fa63fe56a20b0cf8ce0d2d51f7a05d106
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unLC:5vEN2U+T6i5LirrllHy4HUcMQY6KC
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Modifies Installed Components in the registry 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe - Executes dropped EXE 4 IoCs
pid Process 1964 explorer.exe 1088 spoolsv.exe 4460 svchost.exe 4244 spoolsv.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe a0fdc8e23499a7b7e6725a0b36c340c0_NeikiAnalytics.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4140 a0fdc8e23499a7b7e6725a0b36c340c0_NeikiAnalytics.exe 4140 a0fdc8e23499a7b7e6725a0b36c340c0_NeikiAnalytics.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 1964 explorer.exe 4460 svchost.exe 4460 svchost.exe 4460 svchost.exe 4460 svchost.exe 1964 explorer.exe 1964 explorer.exe 4460 svchost.exe 4460 svchost.exe 1964 explorer.exe 1964 explorer.exe 4460 svchost.exe 4460 svchost.exe 1964 explorer.exe 1964 explorer.exe 4460 svchost.exe 4460 svchost.exe 1964 explorer.exe 1964 explorer.exe 4460 svchost.exe 4460 svchost.exe 1964 explorer.exe 1964 explorer.exe 4460 svchost.exe 4460 svchost.exe 1964 explorer.exe 1964 explorer.exe 4460 svchost.exe 4460 svchost.exe 1964 explorer.exe 1964 explorer.exe 4460 svchost.exe 4460 svchost.exe 1964 explorer.exe 1964 explorer.exe 4460 svchost.exe 4460 svchost.exe 1964 explorer.exe 1964 explorer.exe 4460 svchost.exe 4460 svchost.exe 1964 explorer.exe 1964 explorer.exe 4460 svchost.exe 4460 svchost.exe 1964 explorer.exe 1964 explorer.exe 4460 svchost.exe 4460 svchost.exe 1964 explorer.exe 1964 explorer.exe 4460 svchost.exe 4460 svchost.exe 1964 explorer.exe 1964 explorer.exe 4460 svchost.exe 4460 svchost.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1964 explorer.exe 4460 svchost.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4140 a0fdc8e23499a7b7e6725a0b36c340c0_NeikiAnalytics.exe 4140 a0fdc8e23499a7b7e6725a0b36c340c0_NeikiAnalytics.exe 1964 explorer.exe 1964 explorer.exe 1088 spoolsv.exe 1088 spoolsv.exe 4460 svchost.exe 4460 svchost.exe 4244 spoolsv.exe 4244 spoolsv.exe 1964 explorer.exe 1964 explorer.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 4140 wrote to memory of 1964 4140 a0fdc8e23499a7b7e6725a0b36c340c0_NeikiAnalytics.exe 81 PID 4140 wrote to memory of 1964 4140 a0fdc8e23499a7b7e6725a0b36c340c0_NeikiAnalytics.exe 81 PID 4140 wrote to memory of 1964 4140 a0fdc8e23499a7b7e6725a0b36c340c0_NeikiAnalytics.exe 81 PID 1964 wrote to memory of 1088 1964 explorer.exe 82 PID 1964 wrote to memory of 1088 1964 explorer.exe 82 PID 1964 wrote to memory of 1088 1964 explorer.exe 82 PID 1088 wrote to memory of 4460 1088 spoolsv.exe 84 PID 1088 wrote to memory of 4460 1088 spoolsv.exe 84 PID 1088 wrote to memory of 4460 1088 spoolsv.exe 84 PID 4460 wrote to memory of 4244 4460 svchost.exe 86 PID 4460 wrote to memory of 4244 4460 svchost.exe 86 PID 4460 wrote to memory of 4244 4460 svchost.exe 86 PID 4460 wrote to memory of 4816 4460 svchost.exe 87 PID 4460 wrote to memory of 4816 4460 svchost.exe 87 PID 4460 wrote to memory of 4816 4460 svchost.exe 87 PID 4460 wrote to memory of 4960 4460 svchost.exe 97 PID 4460 wrote to memory of 4960 4460 svchost.exe 97 PID 4460 wrote to memory of 4960 4460 svchost.exe 97 PID 4460 wrote to memory of 64 4460 svchost.exe 99 PID 4460 wrote to memory of 64 4460 svchost.exe 99 PID 4460 wrote to memory of 64 4460 svchost.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0fdc8e23499a7b7e6725a0b36c340c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a0fdc8e23499a7b7e6725a0b36c340c0_NeikiAnalytics.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4140 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4244
-
-
C:\Windows\SysWOW64\at.exeat 04:08 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:4816
-
-
C:\Windows\SysWOW64\at.exeat 04:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:4960
-
-
C:\Windows\SysWOW64\at.exeat 04:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:64
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\mrsys.exe
- Size 206KB
- SHA256 63ac9cf94a2ab702ef6a3efd49271d3a97aa093b76b3d93bc70da8efcf9cc420
- MD5 a6f62df88ea701d60debe75d89182494
- SHA1 d621219ee4335f877082e914f6bf392e46e62d22
- SHA512 50d0b2ab0a4f200be6d7dba0dadb545bcda40efa4513beab1ee4e56442e8514898f5e9edca3d5a04d9b3c7955eb647bd4dced78fa2849cb0ebb33703ada32a50
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unL2:5vEN2U+T6i5LirrllHy4HUcMQY6K2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\explorer.exe
- Size 206KB
- SHA256 a859cfcae2017d7216eb56235011e601717f35a0e1d4c4a640f74a7f7c413297
- MD5 d297ee178c69551756a9cc94903fde1f
- SHA1 a888d99f7864e9a955abe8fa3a446779a50b4a63
- SHA512 848b7ef9322e344e7d258576783a2d28039e3ea12ac41ae418a40963fa97f558c16d414b69ce5438df01757b86fd5cbf839b60d0c1b2493053ffc0f78eb4a1e3
- SSDEEP 6144:5vEN2U+T6i5LirrllHy4HUcMQY6K41111111111111111111111111111111111p:RENN+T5xYrllrU7QY6KG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\spoolsv.exe
- Size 206KB
- SHA256 91d0aca412cc07f05b298001675915c0c7d4a0700e2a7383fa4adc5f5a9634d5
- MD5 d35640c47af7021a9e42843cace29863
- SHA1 81e0e96af6b06396e3989ec87df66012ba554118
- SHA512 a663f09dded242027fc9fa4fc1aa3ede290e2569b41cf4aa30b7c68cff45ca0fc4124e479f4d59309e80f1499a9d7b07a315e681ad5b6b4429c306f8660c759e
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unL/:5vEN2U+T6i5LirrllHy4HUcMQY6K/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\svchost.exe
- Size 206KB
- SHA256 7d2b299b372d3486e4daa12d8b9b103fb5a186ff9ff12ad707deb4c30cbb2d44
- MD5 95bfa3353cc5f0304f41fec7c0a9475e
- SHA1 72c9039127db69c7d07ee8e9f870576312bac44b
- SHA512 6712f8172ff653c5c961d67eeef9de7244593433c2d8800f5b9be24bcb3dc195a979304b7aaf34e0711f96a6968cd8f107c8a3c7152d1c85d3b8411a915c8698
- SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unLR:5vEN2U+T6i5LirrllHy4HUcMQY6KR
- MD5 SHA1 SHA512 SSDEEP