Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 02:54
Static task
static1
Behavioral task
behavioral1
Sample
d64c03581bd942826c1985dabb1b86c0_NEIKI.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d64c03581bd942826c1985dabb1b86c0_NEIKI.exe
Resource
win10v2004-20240426-en
General
-
Target
d64c03581bd942826c1985dabb1b86c0_NEIKI.exe
-
Size
459KB
-
MD5
d64c03581bd942826c1985dabb1b86c0
-
SHA1
e5f7bc9daa641c5df80baff5272a5b08d1c1cedd
-
SHA256
4ef68bc48aa8976b2e31f1331958032aa4fed083cc09de30291f50425619fe12
-
SHA512
764bb706996f3fa4b42f5cf1e3ac88b900404082979b36438ee5d690ccfdc0621bc6fe5979c9e07f428bf9efe045c7a47cdf9d68863f4ec4bc28ef68dd500ca7
-
SSDEEP
6144:l7s/MwGsmLrZNs/VKi/MwGsmLr5+Nod/MwGsmLrZNs/VKi/MwGsmLrRo68lS:lSMmmpNs/VXMmmg8MmmpNs/VXMmm
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 14 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hellne32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hodpgjha.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ioijbj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" d64c03581bd942826c1985dabb1b86c0_NEIKI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hmlnoc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hckcmjep.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hckcmjep.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad d64c03581bd942826c1985dabb1b86c0_NEIKI.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hmlnoc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hhjhkq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ioijbj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hodpgjha.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hellne32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hhjhkq32.exe -
Executes dropped EXE 7 IoCs
pid Process 2200 Hmlnoc32.exe 3036 Hckcmjep.exe 2552 Hellne32.exe 2724 Hhjhkq32.exe 2564 Hodpgjha.exe 2432 Ioijbj32.exe 1092 Iagfoe32.exe -
Loads dropped DLL 18 IoCs
pid Process 1928 d64c03581bd942826c1985dabb1b86c0_NEIKI.exe 1928 d64c03581bd942826c1985dabb1b86c0_NEIKI.exe 2200 Hmlnoc32.exe 2200 Hmlnoc32.exe 3036 Hckcmjep.exe 3036 Hckcmjep.exe 2552 Hellne32.exe 2552 Hellne32.exe 2724 Hhjhkq32.exe 2724 Hhjhkq32.exe 2564 Hodpgjha.exe 2564 Hodpgjha.exe 2432 Ioijbj32.exe 2432 Ioijbj32.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe -
Drops file in System32 directory 21 IoCs
description ioc Process File created C:\Windows\SysWOW64\Iagfoe32.exe Ioijbj32.exe File opened for modification C:\Windows\SysWOW64\Iagfoe32.exe Ioijbj32.exe File opened for modification C:\Windows\SysWOW64\Hellne32.exe Hckcmjep.exe File created C:\Windows\SysWOW64\Hhjhkq32.exe Hellne32.exe File created C:\Windows\SysWOW64\Liqebf32.dll Hhjhkq32.exe File created C:\Windows\SysWOW64\Ioijbj32.exe Hodpgjha.exe File created C:\Windows\SysWOW64\Gjenmobn.dll Ioijbj32.exe File opened for modification C:\Windows\SysWOW64\Hckcmjep.exe Hmlnoc32.exe File created C:\Windows\SysWOW64\Cabknqko.dll Hmlnoc32.exe File created C:\Windows\SysWOW64\Hellne32.exe Hckcmjep.exe File created C:\Windows\SysWOW64\Ncolgf32.dll d64c03581bd942826c1985dabb1b86c0_NEIKI.exe File created C:\Windows\SysWOW64\Pljpdpao.dll Hckcmjep.exe File created C:\Windows\SysWOW64\Hodpgjha.exe Hhjhkq32.exe File opened for modification C:\Windows\SysWOW64\Hhjhkq32.exe Hellne32.exe File created C:\Windows\SysWOW64\Hojopmqk.dll Hellne32.exe File opened for modification C:\Windows\SysWOW64\Hodpgjha.exe Hhjhkq32.exe File opened for modification C:\Windows\SysWOW64\Ioijbj32.exe Hodpgjha.exe File created C:\Windows\SysWOW64\Dgnijonn.dll Hodpgjha.exe File created C:\Windows\SysWOW64\Hmlnoc32.exe d64c03581bd942826c1985dabb1b86c0_NEIKI.exe File opened for modification C:\Windows\SysWOW64\Hmlnoc32.exe d64c03581bd942826c1985dabb1b86c0_NEIKI.exe File created C:\Windows\SysWOW64\Hckcmjep.exe Hmlnoc32.exe -
Program crash 1 IoCs
pid pid_target Process 2736 1092 WerFault.exe -
Modifies registry class 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 d64c03581bd942826c1985dabb1b86c0_NEIKI.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hmlnoc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hellne32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hojopmqk.dll" Hellne32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Liqebf32.dll" Hhjhkq32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hhjhkq32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ioijbj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjenmobn.dll" Ioijbj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node d64c03581bd942826c1985dabb1b86c0_NEIKI.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID d64c03581bd942826c1985dabb1b86c0_NEIKI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" d64c03581bd942826c1985dabb1b86c0_NEIKI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hmlnoc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hckcmjep.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pljpdpao.dll" Hckcmjep.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Hodpgjha.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgnijonn.dll" Hodpgjha.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ioijbj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738} d64c03581bd942826c1985dabb1b86c0_NEIKI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncolgf32.dll" d64c03581bd942826c1985dabb1b86c0_NEIKI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cabknqko.dll" Hmlnoc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hckcmjep.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hellne32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hhjhkq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hodpgjha.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1928 wrote to memory of 2200 1928 d64c03581bd942826c1985dabb1b86c0_NEIKI.exe 28 PID 1928 wrote to memory of 2200 1928 d64c03581bd942826c1985dabb1b86c0_NEIKI.exe 28 PID 1928 wrote to memory of 2200 1928 d64c03581bd942826c1985dabb1b86c0_NEIKI.exe 28 PID 1928 wrote to memory of 2200 1928 d64c03581bd942826c1985dabb1b86c0_NEIKI.exe 28 PID 2200 wrote to memory of 3036 2200 Hmlnoc32.exe 29 PID 2200 wrote to memory of 3036 2200 Hmlnoc32.exe 29 PID 2200 wrote to memory of 3036 2200 Hmlnoc32.exe 29 PID 2200 wrote to memory of 3036 2200 Hmlnoc32.exe 29 PID 3036 wrote to memory of 2552 3036 Hckcmjep.exe 30 PID 3036 wrote to memory of 2552 3036 Hckcmjep.exe 30 PID 3036 wrote to memory of 2552 3036 Hckcmjep.exe 30 PID 3036 wrote to memory of 2552 3036 Hckcmjep.exe 30 PID 2552 wrote to memory of 2724 2552 Hellne32.exe 31 PID 2552 wrote to memory of 2724 2552 Hellne32.exe 31 PID 2552 wrote to memory of 2724 2552 Hellne32.exe 31 PID 2552 wrote to memory of 2724 2552 Hellne32.exe 31 PID 2724 wrote to memory of 2564 2724 Hhjhkq32.exe 32 PID 2724 wrote to memory of 2564 2724 Hhjhkq32.exe 32 PID 2724 wrote to memory of 2564 2724 Hhjhkq32.exe 32 PID 2724 wrote to memory of 2564 2724 Hhjhkq32.exe 32 PID 2564 wrote to memory of 2432 2564 Hodpgjha.exe 33 PID 2564 wrote to memory of 2432 2564 Hodpgjha.exe 33 PID 2564 wrote to memory of 2432 2564 Hodpgjha.exe 33 PID 2564 wrote to memory of 2432 2564 Hodpgjha.exe 33 PID 2432 wrote to memory of 1092 2432 Ioijbj32.exe 34 PID 2432 wrote to memory of 1092 2432 Ioijbj32.exe 34 PID 2432 wrote to memory of 1092 2432 Ioijbj32.exe 34 PID 2432 wrote to memory of 1092 2432 Ioijbj32.exe 34 PID 1092 wrote to memory of 2736 1092 Iagfoe32.exe 35 PID 1092 wrote to memory of 2736 1092 Iagfoe32.exe 35 PID 1092 wrote to memory of 2736 1092 Iagfoe32.exe 35 PID 1092 wrote to memory of 2736 1092 Iagfoe32.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\d64c03581bd942826c1985dabb1b86c0_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\d64c03581bd942826c1985dabb1b86c0_NEIKI.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\SysWOW64\Hmlnoc32.exeC:\Windows\system32\Hmlnoc32.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\SysWOW64\Hckcmjep.exeC:\Windows\system32\Hckcmjep.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\Hellne32.exeC:\Windows\system32\Hellne32.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\Hhjhkq32.exeC:\Windows\system32\Hhjhkq32.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SysWOW64\Hodpgjha.exeC:\Windows\system32\Hodpgjha.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\SysWOW64\Ioijbj32.exeC:\Windows\system32\Ioijbj32.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\Iagfoe32.exeC:\Windows\system32\Iagfoe32.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 1409⤵
- Loads dropped DLL
- Program crash
PID:2736
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
459KB
MD547b4059f7b13438c65446b15484a7b76
SHA162f149bb432786999ee48a73f5de3a7cfcd1103e
SHA256500c41eec27b239f07f6045ba40b28f12872b16e87a59902c0cd475b261cb127
SHA5128240876ebfba2e82e806f1497595c4a08133aed244087049d040f517117a78313504dc4f997419a165dbbd53b6a30d4ca4daa96d267e8dc1d528fc6f0f12de1b
-
Filesize
459KB
MD5f978b05896729ec294e831d77ec34c71
SHA14ed44403a6a08717ac18ab064fa45e0c4d92fd7a
SHA256de7aa79226f54b436da661ffef41089caeb81a0e699d3dfbfcc360fd84c79c61
SHA512066e7983b6ab59a37cea9041b2a7a8ad7cfda5cdb8c28b4d6ccf723bb27e2832b1dd060bca75d743613c6f8f9e23c39134ddf63c65e63306c9ba12c975fbb39e
-
Filesize
459KB
MD5f075ec2a07a6b3cce6e2ab3a9c53566b
SHA1002f1bb8ed934f09156ddf7ec854970c3664eacd
SHA2560526db7b7e4580cfc85f563b2aa357f6118b35e58d82677d6b8832c31a2f287b
SHA5128966a4bf438c03aeb232fe42c34c6a89ef93bafc1bcbdd0364ceba87c8b6dc74087379c326d50c587abce87b4355f8a8c133f552833f1dfc9fe971e2c6e4b712
-
Filesize
459KB
MD54e75ba88aed6c6fd20e72d96312024d2
SHA155653ebc4f3bb8c9697a1351c7abc178e09fabb6
SHA256801971bec4a6dc6973588fe04c0245b9ddf50ff93108ddb462ce1a982ffbad53
SHA512eadd7f55eee81db038c21c7851df39e8ba2f4d8abbc7b4f8587c05d4a0d332970a11a7fd05b5f36ad7ef74387fe4c95fc5a1d72ba9082d69884e36069eea9685
-
Filesize
459KB
MD5e1c73eb8a6e1665f8cbe1123b382a14c
SHA10da3348fda6747161403bff2467f2d13e614a6dd
SHA2566ec12a18aa948f3909f7d298b5458e53b44b74293e6c49c3d0dac4622398503c
SHA5120f92d6f820cca31bc7d663159686123f4731d4d68389a6569e3fe41cd12c647bd69fd7b564afea4eb82fccf03ee85762017db37f08aeaefe74d03ef119e3abe2
-
Filesize
459KB
MD5c9f2c908d73ae0e78cc305ef79822c28
SHA19f85b64b2440c4fb1ee3bc1271e1bc2ccb29fbc1
SHA25657b5fd38cc87ce817313106e06b540b7494a2fcebcda4b38657481f972c901be
SHA51211c858da1217be951a7233fdd04d7545a31cddb0e37f73f20f1736e57e12af01ef6a42e85fc2c48d59620a689a9a9c8df08cbec80857b961934067f5b1cd9f56
-
Filesize
459KB
MD54a7c0de7a3d0bf662fd406bbca70bc09
SHA1ab42534a23bf7a55e5c277febb6e2cc39e90767d
SHA25669c6969fcdef882d1bb81ce7ef871b559c6570f53cb247f9aa576bd428c95c85
SHA51274189ba0b392c29469428d297bdc15f2c7522630a5090a5ab9454070c448eb10ebd3e6d09ab48206ccc7313c6403d8d922912be022c505198a5ebf73f639e17e