Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/05/2024, 13:40

General

  • Target

    4adb1bb8450c4af3c0552408ea1190a0_NeikiAnalytics.exe

  • Size

    91KB

  • MD5

    4adb1bb8450c4af3c0552408ea1190a0

  • SHA1

    e8d7c61a5a645d3356fd0d12a7a4bcae69cdf14e

  • SHA256

    1537b5b12d2b63a2b8ba799bd16d84a6a8284cedb3582eab3452c3d16786e493

  • SHA512

    d2b72d733925d68881bb2866d8095fb55dbbc274b647cd9cdb362242d683676af7677220c8ffc684be78a713f3e218aaaaa909b036ef04dfa5837d5702ebeff4

  • SSDEEP

    768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3Imuxg3gRYjXbUeHORIC40:uT3OA3+KQsxfS4hT3OA3+KQsxfS4u

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Disables RegEdit via registry modification 2 IoCs
  • Disables use of System Restore points 1 TTPs
  • Executes dropped EXE 7 IoCs
  • Modifies system executable filetype association 2 TTPs 13 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Drops file in System32 directory 6 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies Control Panel 4 IoCs
  • Modifies registry class 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • System policy modification 1 TTPs 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4adb1bb8450c4af3c0552408ea1190a0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\4adb1bb8450c4af3c0552408ea1190a0_NeikiAnalytics.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4136
    • C:\Windows\xk.exe
      C:\Windows\xk.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:2440
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:3176
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:2644
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:1032
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:5020
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:4544
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:4784

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE

    Filesize

    91KB

    MD5

    9ea9cb4cf8877069791b1aedc90c85f2

    SHA1

    8f8fa967e2e64824e57d8be62bc361017b893895

    SHA256

    74b81faeabea42d6b2e7de055f0343c2140435b32aa9b64b7f86058c80a7f86e

    SHA512

    2fb2f0b21799c050eac1a45242845addfde3595086ebbc8af18a4be8b2b9850184ba262c154930bffd5312ac813b7852a37d291f5df91b360c1e3c22dc6a67ba

  • C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE

    Filesize

    91KB

    MD5

    8b0f295687f11be167f0d0d1ad4b81da

    SHA1

    7dbacf0bd400f101ecb6895c9354c300bc06d0d7

    SHA256

    6aa60deed3028f1a386d4afa6f38c84a1d1413d8521d84e7f1f78f05ebb0cf75

    SHA512

    7e5f5183f36eb26ec175b986422c0360be524992cffcf52d3c2633772bc187b3b956724489da85c26c2a312bf4916830327514e5f1e09f5e438f92913688d6a8

  • C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

    Filesize

    91KB

    MD5

    b3505e233ccb6d2d2b2ea649ad433458

    SHA1

    cb7ae6129f89eb857d85c23d7a904c058679b1d5

    SHA256

    ff93b3ad4e8320fc6767e1f4996f7b3ac43803af8950618ca686baf1afc568d0

    SHA512

    c2243dfee19ad90cd7da46eaafad36f9cdc049dd1222a62a516006d690b22a053b1b144f968109a346c7c862dad66bf6bf3bdf69161ee972e7b6fa6f1c62525b

  • C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE

    Filesize

    91KB

    MD5

    fffebed9c07eaf2786c070a580458f55

    SHA1

    57e1cd744118fd39ac4feb48854321855b8a3ebf

    SHA256

    3784c36cb20a8601c49c7db3fab066b470679af9545e4fd33e53ce8ef998e01e

    SHA512

    0355d6de738781996918f548f8716d1aaebecc76e7ff781898264d995e983fded13b7ec6d4444963875534a73254a023db1a24eb04e5ccbdd7f5cbed27376b8d

  • C:\Users\Admin\AppData\Local\winlogon.exe

    Filesize

    91KB

    MD5

    4adb1bb8450c4af3c0552408ea1190a0

    SHA1

    e8d7c61a5a645d3356fd0d12a7a4bcae69cdf14e

    SHA256

    1537b5b12d2b63a2b8ba799bd16d84a6a8284cedb3582eab3452c3d16786e493

    SHA512

    d2b72d733925d68881bb2866d8095fb55dbbc274b647cd9cdb362242d683676af7677220c8ffc684be78a713f3e218aaaaa909b036ef04dfa5837d5702ebeff4

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE

    Filesize

    91KB

    MD5

    2d22694e260acf9ed787377eb6a8da76

    SHA1

    4314714de02d1694e0d2dfd34ffe40a0026e301c

    SHA256

    ea4c2edf62ec5a87c95f51b88044f7e4d3619dc06b1a17e3fa7b0725a00b558b

    SHA512

    366cf30837c76267404fbb7b26e939a0aca6164ec4f695c172d98f74a5c59c3904b18b02bf98617bbf0cc9f6e119a23de53c8ff032664227395cea9caf526aa7

  • C:\Windows\SysWOW64\IExplorer.exe

    Filesize

    91KB

    MD5

    45a76290cef8038006f383f95e1d24f2

    SHA1

    63838e5a0f23acbd8c120eef56b569a2d2e15078

    SHA256

    5e4531464a73b678411d39898d55d5e92acf9b7e938704ce03699a9935ead31b

    SHA512

    348b1fcb6a91061aace20759d161eb86feb2bf2d676b8b53b358f2131c4c0ccc90961da0e15fc0e037a42b4a12c3f7a507f4db9ff434c2e604e084bfd8ba5183

  • C:\Windows\xk.exe

    Filesize

    91KB

    MD5

    8a24fe68a61b69c992f8f2c95a3e5295

    SHA1

    00d68a243b92d3e50ddb301ab8f4572b8640e0aa

    SHA256

    81b2c87617c5fd14d640c63cc32f4a4c2ba1c754839741b6afb015416e74df06

    SHA512

    6fd779e870fd1f7b0475d8460e5baee243d4e556f78b3750356db2a22fea323cb2226a1fa08642f93a8668640811bf382c6cceca0feb6b7c26b7209ebb359771

  • memory/1032-146-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/1032-140-0x0000000075290000-0x00000000753ED000-memory.dmp

    Filesize

    1.4MB

  • memory/2440-114-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/2440-112-0x0000000075290000-0x00000000753ED000-memory.dmp

    Filesize

    1.4MB

  • memory/2440-120-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/2644-132-0x0000000075290000-0x00000000753ED000-memory.dmp

    Filesize

    1.4MB

  • memory/2644-137-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/3176-122-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/3176-123-0x0000000075290000-0x00000000753ED000-memory.dmp

    Filesize

    1.4MB

  • memory/3176-128-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/4136-142-0x0000000000401000-0x0000000000427000-memory.dmp

    Filesize

    152KB

  • memory/4136-5-0x0000000000401000-0x0000000000427000-memory.dmp

    Filesize

    152KB

  • memory/4136-0-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/4136-3-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/4136-2-0x0000000075290000-0x00000000753ED000-memory.dmp

    Filesize

    1.4MB

  • memory/4136-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

    Filesize

    16KB

  • memory/4136-175-0x0000000000401000-0x0000000000427000-memory.dmp

    Filesize

    152KB

  • memory/4136-174-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/4544-159-0x0000000075290000-0x00000000753ED000-memory.dmp

    Filesize

    1.4MB

  • memory/4544-165-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/4784-168-0x0000000075290000-0x00000000753ED000-memory.dmp

    Filesize

    1.4MB

  • memory/5020-150-0x0000000075290000-0x00000000753ED000-memory.dmp

    Filesize

    1.4MB

  • memory/5020-157-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB