9b0446f6fbf3759d691d1aa42999f3694d56df2db8ec88da5342060fb26a9e0f

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 21:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0f13f8a2c0325bcc4440f1f72eecd400_NeikiAnalytics.exe
Size

65KB
MD5

0f13f8a2c0325bcc4440f1f72eecd400
SHA1

91bb8e4a4eb05e125084903a8b57a0aa9728a73f
SHA256

9b0446f6fbf3759d691d1aa42999f3694d56df2db8ec88da5342060fb26a9e0f
SHA512

112c30eeb6dc7f97966f26c8242052baed5d41e0383c5a519b9470fa980846c2aef9c3240007bc00c72eb598786ed8b85fa29e996b9826e155fc0c02bb99e66a
SSDEEP

1536:ECq3yRuqrI01eArdW/O7JnI2e13XiLij40MkTUVqa/Oul:7WNqkOJWmo1HpM0MkTUmul

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
1196	explorer.exe
2360	spoolsv.exe
2536	svchost.exe
2736	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
1848	0f13f8a2c0325bcc4440f1f72eecd400_NeikiAnalytics.exe
1848	0f13f8a2c0325bcc4440f1f72eecd400_NeikiAnalytics.exe
1196	explorer.exe
1196	explorer.exe
2360	spoolsv.exe
2360	spoolsv.exe
2536	svchost.exe
2536	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	0f13f8a2c0325bcc4440f1f72eecd400_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1848	0f13f8a2c0325bcc4440f1f72eecd400_NeikiAnalytics.exe
1196	explorer.exe
1196	explorer.exe
1196	explorer.exe
2536	svchost.exe
2536	svchost.exe
1196	explorer.exe
2536	svchost.exe
1196	explorer.exe
2536	svchost.exe
1196	explorer.exe
2536	svchost.exe
1196	explorer.exe
2536	svchost.exe
1196	explorer.exe
2536	svchost.exe
1196	explorer.exe
2536	svchost.exe
1196	explorer.exe
2536	svchost.exe
1196	explorer.exe
2536	svchost.exe
1196	explorer.exe
2536	svchost.exe
1196	explorer.exe
2536	svchost.exe
1196	explorer.exe
2536	svchost.exe
1196	explorer.exe
2536	svchost.exe
1196	explorer.exe
2536	svchost.exe
1196	explorer.exe
2536	svchost.exe
1196	explorer.exe
2536	svchost.exe
1196	explorer.exe
2536	svchost.exe
1196	explorer.exe
2536	svchost.exe
1196	explorer.exe
2536	svchost.exe
1196	explorer.exe
2536	svchost.exe
1196	explorer.exe
2536	svchost.exe
1196	explorer.exe
2536	svchost.exe
1196	explorer.exe
2536	svchost.exe
1196	explorer.exe
2536	svchost.exe
1196	explorer.exe
2536	svchost.exe
1196	explorer.exe
2536	svchost.exe
1196	explorer.exe
2536	svchost.exe
1196	explorer.exe
2536	svchost.exe
1196	explorer.exe
2536	svchost.exe
1196	explorer.exe
2536	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1196	explorer.exe
2536	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1848	0f13f8a2c0325bcc4440f1f72eecd400_NeikiAnalytics.exe
1848	0f13f8a2c0325bcc4440f1f72eecd400_NeikiAnalytics.exe
1196	explorer.exe
1196	explorer.exe
2360	spoolsv.exe
2360	spoolsv.exe
2536	svchost.exe
2536	svchost.exe
2736	spoolsv.exe
2736	spoolsv.exe
1196	explorer.exe
1196	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 1196	1848	0f13f8a2c0325bcc4440f1f72eecd400_NeikiAnalytics.exe	28
PID 1848 wrote to memory of 1196	1848	0f13f8a2c0325bcc4440f1f72eecd400_NeikiAnalytics.exe	28
PID 1848 wrote to memory of 1196	1848	0f13f8a2c0325bcc4440f1f72eecd400_NeikiAnalytics.exe	28
PID 1848 wrote to memory of 1196	1848	0f13f8a2c0325bcc4440f1f72eecd400_NeikiAnalytics.exe	28
PID 1196 wrote to memory of 2360	1196	explorer.exe	29
PID 1196 wrote to memory of 2360	1196	explorer.exe	29
PID 1196 wrote to memory of 2360	1196	explorer.exe	29
PID 1196 wrote to memory of 2360	1196	explorer.exe	29
PID 2360 wrote to memory of 2536	2360	spoolsv.exe	30
PID 2360 wrote to memory of 2536	2360	spoolsv.exe	30
PID 2360 wrote to memory of 2536	2360	spoolsv.exe	30
PID 2360 wrote to memory of 2536	2360	spoolsv.exe	30
PID 2536 wrote to memory of 2736	2536	svchost.exe	31
PID 2536 wrote to memory of 2736	2536	svchost.exe	31
PID 2536 wrote to memory of 2736	2536	svchost.exe	31
PID 2536 wrote to memory of 2736	2536	svchost.exe	31
PID 2536 wrote to memory of 2480	2536	svchost.exe	32
PID 2536 wrote to memory of 2480	2536	svchost.exe	32
PID 2536 wrote to memory of 2480	2536	svchost.exe	32
PID 2536 wrote to memory of 2480	2536	svchost.exe	32
PID 2536 wrote to memory of 2612	2536	svchost.exe	36
PID 2536 wrote to memory of 2612	2536	svchost.exe	36
PID 2536 wrote to memory of 2612	2536	svchost.exe	36
PID 2536 wrote to memory of 2612	2536	svchost.exe	36
PID 2536 wrote to memory of 840	2536	svchost.exe	38
PID 2536 wrote to memory of 840	2536	svchost.exe	38
PID 2536 wrote to memory of 840	2536	svchost.exe	38
PID 2536 wrote to memory of 840	2536	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\0f13f8a2c0325bcc4440f1f72eecd400_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0f13f8a2c0325bcc4440f1f72eecd400_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1848
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1196
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2360
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2536
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2736
    - - C:\Windows\SysWOW64\at.exe
        
        at 21:50 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2480
    - - C:\Windows\SysWOW64\at.exe
        
        at 21:51 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:2612
    - - C:\Windows\SysWOW64\at.exe
        
        at 21:52 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
65KB

MD5
01ab45031929f5fad5bf12aa96a8d536

SHA1
fcd8534a5d9ade16e5912023fe30218834c805fe

SHA256
1eff65678d7bcdce9b6d565f27e5431122085da6a6bf162bd6bb56c4bfc91346

SHA512
e0a01cf045297a8a48f36284a3d8b627ebc1b63151f347d9d57b3f1fa83e08b7bca6ed5e5977610be7b1d269752f971d6716fdd12f750ce96415bf017cc5d4a6

Download Submit
\Windows\system\explorer.exe

Filesize
65KB

MD5
7630b09e44da6e2ea08396b5275d3663

SHA1
01547dcb1ad02f21e7d48d2d1cb95d7235fa75a6

SHA256
8f91c01325270946fd9d58f5422fd2acc308a3101ccb2ce4f85be1e6077a2390

SHA512
f4e154421857949ed33af55f805a12fb1e0db547ffef600a98297cbac3d82dfad08726fee68870218e795769a9d95529333e9d9f9489917f0f5991557303cebb

Download Submit
\Windows\system\spoolsv.exe

Filesize
65KB

MD5
7f1864134563235e72ee0bdb924a6770

SHA1
05f835f92003f37ddb33076be3b8caf6ead3da25

SHA256
2f024b5c9422f54e5c8a137989413c7cf1d4e3e5cd98b84422699c6072449955

SHA512
56ed13a18f4eb0df92191e504d386e9e622ebc5290df1b314991dcc29402b1060f8388d32db0bf7a2f267504d1222c7f60ab26abedbb1e561feaaf0afc685cfb

Download Submit
\Windows\system\svchost.exe

Filesize
65KB

MD5
50d6269094dee01eefd659f3be46ac97

SHA1
65109eb2671044a84d528df3ae645c67509d4efb

SHA256
783d28f3e18208092c469100524aaa2ef9cb55a66d6f7f9968f9e58cbe7066fe

SHA512
2aa7aefff8d830072e949f758d9080484244d27e5520104ef5faa240b8fbc0f5bff1aa10f7af9fb1288c7deeb0d5f466c6a64900e5b70b8b9d21a3d25d507f89

Download Submit
memory/1196-36-0x00000000024E0000-0x0000000002511000-memory.dmp

Filesize
196KB

Download
memory/1196-64-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1196-20-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/1196-19-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1196-82-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1196-22-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1196-92-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1848-18-0x0000000002B20000-0x0000000002B51000-memory.dmp

Filesize
196KB

Download
memory/1848-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/1848-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1848-80-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1848-1-0x0000000000020000-0x0000000000024000-memory.dmp

Filesize
16KB

Download
memory/1848-4-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1848-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1848-79-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1848-61-0x0000000000401000-0x000000000042E000-memory.dmp

Filesize
180KB

Download
memory/1848-17-0x0000000002B20000-0x0000000002B51000-memory.dmp

Filesize
196KB

Download
memory/2360-52-0x0000000003150000-0x0000000003181000-memory.dmp

Filesize
196KB

Download
memory/2360-77-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2360-42-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2360-37-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2536-62-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2536-55-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2536-54-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2536-83-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2736-73-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2736-67-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download