Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 12:41
Behavioral task
behavioral1
Sample
f2c5835996b347d8db9621bd4e5de4d1_NEIKI.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f2c5835996b347d8db9621bd4e5de4d1_NEIKI.exe
Resource
win10v2004-20240508-en
General
-
Target
f2c5835996b347d8db9621bd4e5de4d1_NEIKI.exe
-
Size
63KB
-
MD5
f2c5835996b347d8db9621bd4e5de4d1
-
SHA1
16e6f96e032425aab38b009c3539e8e408910264
-
SHA256
9b134817c6265a60d82c47277cf06b3c1cb495f6f75faade94e437032f2a5b97
-
SHA512
8889a66d02e88160385b767cac8d882ca0897dc1ec204789ba6a48579bbb8719f43dd1c07689e553a0d105f6a3c086e06865054af0172ed32a984f37bdb6f42f
-
SSDEEP
768:rAUJmQCcmLCXQq6fsKiJYsIkjJVzqsVG5kuGKQLddOW/Y4Wv0eKIs88:sUNHFKQbIkHvGMdOP4wC
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "5120" rmass.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts rmass.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{534E4656-4751-4c55-534E-465647514c55}\StubPath = "C:\\Windows\\system32\\ahuy.exe" rmass.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{534E4656-4751-4c55-534E-465647514c55} rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{534E4656-4751-4c55-534E-465647514c55}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{534E4656-4751-4c55-534E-465647514c55}\IsInstalled = "1" rmass.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ntdbg.exe" rmass.exe -
Executes dropped EXE 2 IoCs
pid Process 3876 rmass.exe 1800 rmass.exe -
resource yara_rule behavioral2/memory/4788-0-0x0000000000400000-0x0000000000412000-memory.dmp upx behavioral2/files/0x0007000000023276-5.dat upx behavioral2/memory/4788-7-0x0000000000400000-0x0000000000412000-memory.dmp upx behavioral2/memory/3876-8-0x0000000000400000-0x0000000000412000-memory.dmp upx behavioral2/memory/1800-18-0x0000000000400000-0x0000000000412000-memory.dmp upx behavioral2/memory/3876-52-0x0000000000400000-0x0000000000412000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "5120" rmass.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} rmass.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\RECOVER32.DLL" rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" rmass.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\idbg32.exe rmass.exe File created C:\Windows\SysWOW64\ntdbg.exe rmass.exe File opened for modification C:\Windows\SysWOW64\ahuy.exe rmass.exe File created C:\Windows\SysWOW64\ahuy.exe rmass.exe File created C:\Windows\SysWOW64\RECOVER32.DLL rmass.exe File opened for modification C:\Windows\SysWOW64\winrnt.exe rmass.exe File opened for modification C:\Windows\SysWOW64\rmass.exe rmass.exe File opened for modification C:\Windows\SysWOW64\rmass.exe f2c5835996b347d8db9621bd4e5de4d1_NEIKI.exe File created C:\Windows\SysWOW64\rmass.exe f2c5835996b347d8db9621bd4e5de4d1_NEIKI.exe File opened for modification C:\Windows\SysWOW64\ntdbg.exe rmass.exe File opened for modification C:\Windows\SysWOW64\RECOVER32.DLL rmass.exe File opened for modification C:\Windows\SysWOW64\aset32.exe rmass.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\System\winrnt.exe rmass.exe File opened for modification C:\Program Files (x86)\Common Files\System\aset32.exe rmass.exe File opened for modification C:\Program Files (x86)\Common Files\System\idbg32.exe rmass.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3876 rmass.exe 3876 rmass.exe 3876 rmass.exe 3876 rmass.exe 3876 rmass.exe 3876 rmass.exe 1800 rmass.exe 1800 rmass.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4788 f2c5835996b347d8db9621bd4e5de4d1_NEIKI.exe Token: SeDebugPrivilege 3876 rmass.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4788 wrote to memory of 3876 4788 f2c5835996b347d8db9621bd4e5de4d1_NEIKI.exe 81 PID 4788 wrote to memory of 3876 4788 f2c5835996b347d8db9621bd4e5de4d1_NEIKI.exe 81 PID 4788 wrote to memory of 3876 4788 f2c5835996b347d8db9621bd4e5de4d1_NEIKI.exe 81 PID 3876 wrote to memory of 616 3876 rmass.exe 5 PID 3876 wrote to memory of 3520 3876 rmass.exe 56 PID 3876 wrote to memory of 1800 3876 rmass.exe 82 PID 3876 wrote to memory of 1800 3876 rmass.exe 82 PID 3876 wrote to memory of 1800 3876 rmass.exe 82
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:616
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\f2c5835996b347d8db9621bd4e5de4d1_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\f2c5835996b347d8db9621bd4e5de4d1_NEIKI.exe"2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Windows\SysWOW64\rmass.exe"C:\Windows\system32\rmass.exe"3⤵
- Windows security bypass
- Drops file in Drivers directory
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Windows\SysWOW64\rmass.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1800
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD52b2c28a7a01f9584fe220ef84003427f
SHA15fc023df0b5064045eb8de7f2dbe26f07f6fec70
SHA2569e00af53b1d0c0f5270d94a666d95aa7b4dcb9fea49487c210c055c9dcfcc9eb
SHA51239192a8a91dec1abff25af8dac0cf39da4dfd51b3fb4f1ef0b4e776185d4280fbe8387c2ea778da7bbf2ce288b0bce4d23cbe8d9e87bbd250159044f5adbac78
-
Filesize
65KB
MD549934a04249987aca13366677e45d11c
SHA1b6ed33b3b7b3012c442883fbe17f5584c2c8e81d
SHA256eaee5839e49f71b0f5ff12863a08410e423e0af1b594724cae75241d5755da14
SHA512979b60b380ddefc2ea9a5038f99ea134ea4dbe094add21eaab1777fe9e728e6d3a1721d1dc1452e59a0a6b9838d698c713d0efd27cd0ea44f6dbce81bfb93994
-
Filesize
66KB
MD5a5ca2b6f53dc54634e85524af3dcd2b5
SHA18303ec5eb7e9bcbff7e6d0062da10255eddea2c0
SHA256b09e42971543ae3483cd42983c291f6d4940e57d3dbedd635bc8d0b0eb1ff798
SHA512dd0ba37b2d68647e389d47a49efd36eebcbae2a560c0ba6346d36e5710af6073df6fd886e3fedb5bfdbbc01950a474f55b48ae071195573bdd3f3077d24e13d7
-
Filesize
63KB
MD5f2c5835996b347d8db9621bd4e5de4d1
SHA116e6f96e032425aab38b009c3539e8e408910264
SHA2569b134817c6265a60d82c47277cf06b3c1cb495f6f75faade94e437032f2a5b97
SHA5128889a66d02e88160385b767cac8d882ca0897dc1ec204789ba6a48579bbb8719f43dd1c07689e553a0d105f6a3c086e06865054af0172ed32a984f37bdb6f42f
-
Filesize
1KB
MD56f47b62de25d1745e296a06b3f98ed19
SHA1a688bb35a4c8a5cc198985d624a1b5a6ac5b9f6f
SHA25615c7218eb9cef5fa0573db657b15ce3a5f0e0609f1166df8098ca7152df505b4
SHA512dea26fff8060f44bf20fe4fff2ecbacf428727f10c0f5886fb4813e28fce9cbc3d088337c84edd9857b18514c83f1bb1cf0f51518aaecef09f30e921f4d758d7