Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
29-06-2024 13:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ad827a5cf1127f1cfb3af8ba55cc4de570404ee0a81edb74789788761c5e1f81_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
ad827a5cf1127f1cfb3af8ba55cc4de570404ee0a81edb74789788761c5e1f81_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
ad827a5cf1127f1cfb3af8ba55cc4de570404ee0a81edb74789788761c5e1f81_NeikiAnalytics.exe
-
Size
3.1MB
-
MD5
559392040209af04b36cb0c79cbaed20
-
SHA1
74ba5cc83f04f1752ae1068310d5a00a99e43741
-
SHA256
ad827a5cf1127f1cfb3af8ba55cc4de570404ee0a81edb74789788761c5e1f81
-
SHA512
a29fb8e075bbe03e390a85172245fa356c5a9f4228e28357d4af98756c5ab419a80e6f437aac33ff33c4d99416ad8cf2161dd4bd90dd18ed3e37c15c0034dc62
-
SSDEEP
49152:ZUuBTOjZwS1Ihk+hy7iHuaRZnt+NTNLiG97d:ZXRO0hkr2Rxt+eE
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" wininit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe, cmd.exe /c start c:\\windows\\wininit.exe" wininit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe, cmd.exe /c start c:\\windows\\wininit.exe" svchost.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" wininit.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" ad827a5cf1127f1cfb3af8ba55cc4de570404ee0a81edb74789788761c5e1f81_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" ad827a5cf1127f1cfb3af8ba55cc4de570404ee0a81edb74789788761c5e1f81_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ad827a5cf1127f1cfb3af8ba55cc4de570404ee0a81edb74789788761c5e1f81_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" wininit.exe -
Executes dropped EXE 2 IoCs
pid Process 2540 wininit.exe 1268 svchost.exe -
Loads dropped DLL 1 IoCs
pid Process 2036 ad827a5cf1127f1cfb3af8ba55cc4de570404ee0a81edb74789788761c5e1f81_NeikiAnalytics.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ad827a5cf1127f1cfb3af8ba55cc4de570404ee0a81edb74789788761c5e1f81_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ad827a5cf1127f1cfb3af8ba55cc4de570404ee0a81edb74789788761c5e1f81_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wininit.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\RCX17F4.tmp ad827a5cf1127f1cfb3af8ba55cc4de570404ee0a81edb74789788761c5e1f81_NeikiAnalytics.exe File opened for modification \??\c:\windows\wininit.exe wininit.exe File created \??\c:\windows\wininit.exe ad827a5cf1127f1cfb3af8ba55cc4de570404ee0a81edb74789788761c5e1f81_NeikiAnalytics.exe File opened for modification \??\c:\windows\wininit.exe ad827a5cf1127f1cfb3af8ba55cc4de570404ee0a81edb74789788761c5e1f81_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2036 ad827a5cf1127f1cfb3af8ba55cc4de570404ee0a81edb74789788761c5e1f81_NeikiAnalytics.exe 2036 ad827a5cf1127f1cfb3af8ba55cc4de570404ee0a81edb74789788761c5e1f81_NeikiAnalytics.exe 2540 wininit.exe 2540 wininit.exe 2540 wininit.exe 1268 svchost.exe 2540 wininit.exe 1268 svchost.exe 2540 wininit.exe 1268 svchost.exe 2540 wininit.exe 1268 svchost.exe 2540 wininit.exe 1268 svchost.exe 2540 wininit.exe 1268 svchost.exe 2540 wininit.exe 1268 svchost.exe 2540 wininit.exe 1268 svchost.exe 2540 wininit.exe 1268 svchost.exe 2540 wininit.exe 1268 svchost.exe 2540 wininit.exe 1268 svchost.exe 2540 wininit.exe 1268 svchost.exe 2540 wininit.exe 1268 svchost.exe 2540 wininit.exe 1268 svchost.exe 2540 wininit.exe 1268 svchost.exe 2540 wininit.exe 1268 svchost.exe 2540 wininit.exe 1268 svchost.exe 2540 wininit.exe 1268 svchost.exe 2540 wininit.exe 1268 svchost.exe 2540 wininit.exe 1268 svchost.exe 2540 wininit.exe 1268 svchost.exe 2540 wininit.exe 1268 svchost.exe 2540 wininit.exe 1268 svchost.exe 2540 wininit.exe 1268 svchost.exe 2540 wininit.exe 1268 svchost.exe 2540 wininit.exe 1268 svchost.exe 2540 wininit.exe 1268 svchost.exe 2540 wininit.exe 1268 svchost.exe 2540 wininit.exe 1268 svchost.exe 2540 wininit.exe 1268 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2540 wininit.exe 1268 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2540 wininit.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2036 wrote to memory of 2540 2036 ad827a5cf1127f1cfb3af8ba55cc4de570404ee0a81edb74789788761c5e1f81_NeikiAnalytics.exe 28 PID 2036 wrote to memory of 2540 2036 ad827a5cf1127f1cfb3af8ba55cc4de570404ee0a81edb74789788761c5e1f81_NeikiAnalytics.exe 28 PID 2036 wrote to memory of 2540 2036 ad827a5cf1127f1cfb3af8ba55cc4de570404ee0a81edb74789788761c5e1f81_NeikiAnalytics.exe 28 PID 2036 wrote to memory of 2540 2036 ad827a5cf1127f1cfb3af8ba55cc4de570404ee0a81edb74789788761c5e1f81_NeikiAnalytics.exe 28 PID 2036 wrote to memory of 1268 2036 ad827a5cf1127f1cfb3af8ba55cc4de570404ee0a81edb74789788761c5e1f81_NeikiAnalytics.exe 29 PID 2036 wrote to memory of 1268 2036 ad827a5cf1127f1cfb3af8ba55cc4de570404ee0a81edb74789788761c5e1f81_NeikiAnalytics.exe 29 PID 2036 wrote to memory of 1268 2036 ad827a5cf1127f1cfb3af8ba55cc4de570404ee0a81edb74789788761c5e1f81_NeikiAnalytics.exe 29 PID 2036 wrote to memory of 1268 2036 ad827a5cf1127f1cfb3af8ba55cc4de570404ee0a81edb74789788761c5e1f81_NeikiAnalytics.exe 29 -
System policy modification 1 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ad827a5cf1127f1cfb3af8ba55cc4de570404ee0a81edb74789788761c5e1f81_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" ad827a5cf1127f1cfb3af8ba55cc4de570404ee0a81edb74789788761c5e1f81_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" ad827a5cf1127f1cfb3af8ba55cc4de570404ee0a81edb74789788761c5e1f81_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wininit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" wininit.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad827a5cf1127f1cfb3af8ba55cc4de570404ee0a81edb74789788761c5e1f81_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ad827a5cf1127f1cfb3af8ba55cc4de570404ee0a81edb74789788761c5e1f81_NeikiAnalytics.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2036 -
\??\c:\windows\wininit.exec:\windows\wininit.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2540
-
-
\??\c:\users\admin\appdata\local\svchost.exec:\users\admin\appdata\local\svchost.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- System policy modification
PID:1268
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD5d246c44f8b8f4ad23b849bd68df1d8ba
SHA125013faddc2c160f32a9fae5c8118a9254b8c27a
SHA2564a57bc3dbaf040162b009a324a0718eb06a8fc7365aa86fb6b2d9118b584d9fe
SHA51299f3e96c14fc3be41cf9ac822d5cb6192fe3cc0e4ae26f95d9826817cba9796cb0a699abee73601bcbfbc6545734212ff294ddbae1a178a50a156511164c04e7
-
Filesize
3.1MB
MD5559392040209af04b36cb0c79cbaed20
SHA174ba5cc83f04f1752ae1068310d5a00a99e43741
SHA256ad827a5cf1127f1cfb3af8ba55cc4de570404ee0a81edb74789788761c5e1f81
SHA512a29fb8e075bbe03e390a85172245fa356c5a9f4228e28357d4af98756c5ab419a80e6f437aac33ff33c4d99416ad8cf2161dd4bd90dd18ed3e37c15c0034dc62