Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/05/2024, 14:14

General

  • Target

    57ec49d438753f3bdfec6a616258b370_NeikiAnalytics.exe

  • Size

    8.7MB

  • MD5

    57ec49d438753f3bdfec6a616258b370

  • SHA1

    a34f757f5f2bd4763f04206c0d0cd32ab4491117

  • SHA256

    872a2f4decf76a5c8cf44a9b017a780847d8b3c50571433232e398ab0931c638

  • SHA512

    88bdae1b6a45efa83c4a9ff28a4549c33db28ba2bb1d1911d028090e9dc3831ef57f6577388844a4cfccc60dbca70315a7f9d7311f6638bcf00da97110e1c64a

  • SSDEEP

    196608:ITAJDpNk+Rl4/Xi/yRvyCyKuhBfldGdrmVLaY1rHgu:oAlzJ7yRvyCx+xpgu

Malware Config

Signatures

  • Detect ZGRat V1 3 IoCs
  • Modifies WinLogon for persistence 2 TTPs 6 IoCs
  • Process spawned unexpected child process 18 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 12 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 18 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\57ec49d438753f3bdfec6a616258b370_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\57ec49d438753f3bdfec6a616258b370_NeikiAnalytics.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4816
    • C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe
      "C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe"
      2⤵
      • Executes dropped EXE
      PID:2916
    • C:\Users\Admin\AppData\Local\Temp\leetcrack.exe
      "C:\Users\Admin\AppData\Local\Temp\leetcrack.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4336
      • C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe
        "C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe"
        3⤵
        • Executes dropped EXE
        PID:1032
      • C:\Users\Admin\AppData\Local\Temp\portmonitor.exe
        "C:\Users\Admin\AppData\Local\Temp\portmonitor.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:936
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe"
          4⤵
          • Checks computer location settings
          • Suspicious use of WriteProcessMemory
          PID:3972
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Webnet\x9qTsv13UFeYw.bat" "
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4732
            • C:\Webnet\portmonitor.exe
              "C:\Webnet/portmonitor.exe"
              6⤵
              • Modifies WinLogon for persistence
              • Checks computer location settings
              • Executes dropped EXE
              • Adds Run key to start application
              • Drops file in Program Files directory
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:4556
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\trcuwpu1\trcuwpu1.cmdline"
                7⤵
                • Drops file in System32 directory
                • Suspicious use of WriteProcessMemory
                PID:2748
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9EE0.tmp" "c:\Windows\System32\CSC56DC0060DE534FD4B15B31062D3D8C8.TMP"
                  8⤵
                    PID:3184
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HOiE1HiitJ.bat"
                  7⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4012
                  • C:\Windows\system32\chcp.com
                    chcp 65001
                    8⤵
                      PID:3952
                    • C:\Windows\system32\w32tm.exe
                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                      8⤵
                        PID:1684
                      • C:\Recovery\WindowsRE\explorer.exe
                        "C:\Recovery\WindowsRE\explorer.exe"
                        8⤵
                        • Executes dropped EXE
                        • Suspicious behavior: GetForegroundWindowSpam
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4464
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Program Files\Common Files\Idle.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:3636
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Common Files\Idle.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:4000
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Program Files\Common Files\Idle.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:1744
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:4388
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:4156
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:2424
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Webnet\services.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:4944
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Webnet\services.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:1452
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Webnet\services.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:1096
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "portmonitorp" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\portmonitor.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:4660
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "portmonitor" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\portmonitor.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:2756
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "portmonitorp" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\portmonitor.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:2936
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Users\Default\SendTo\smss.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:4524
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default\SendTo\smss.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:3648
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Users\Default\SendTo\smss.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:4728
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "portmonitorp" /sc MINUTE /mo 13 /tr "'C:\Webnet\portmonitor.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:4380
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "portmonitor" /sc ONLOGON /tr "'C:\Webnet\portmonitor.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:4168
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "portmonitorp" /sc MINUTE /mo 8 /tr "'C:\Webnet\portmonitor.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:2792

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\3b73a6fa2092a350d795.exe

          Filesize

          5.2MB

          MD5

          b86bbb42b26e72a601087f68cda89208

          SHA1

          baca49e35da3b83cd56ba579d61f98e9b137debe

          SHA256

          320eff01b2a5b520853cd9b0c7486b3d9992dce2f9308f267069a60f88f8deb0

          SHA512

          e98dfeb55d6053d6e2ec323f4665b4ea8cdb5bae0807ac70ac5dbb6cf7f3e8e1ba6a2ad099f8232b0e0ca9a738a9baf7d132957fb5d503c78283b229e35ed974

        • C:\Users\Admin\AppData\Local\Temp\HOiE1HiitJ.bat

          Filesize

          210B

          MD5

          4d619ab5b5aa4b0ee2de15ab5152b668

          SHA1

          6208f09053b4680450c809c6141a22c9eb7bef5d

          SHA256

          fc3a72d8e3e2eae10389f94752e203834b47ca66deab46de88a8ba3a9730e818

          SHA512

          1370b290293642c4e45cd6342fd8561c916110070203d9477cf2171a8804889cb12f4a5526a69cbe41cc4a7998e48bf924172229958ffe0fe61a183a92141d2a

        • C:\Users\Admin\AppData\Local\Temp\Nursultan 1.16.5 Crack.exe

          Filesize

          8KB

          MD5

          068a3a015a2821ab745a03dbae612233

          SHA1

          91c358a556d51466918c76c01ead079a484ce35a

          SHA256

          d87f2189c12aa65a1bd52c1a39d1f14d58753dd76d291eebba32d5a0dde74d67

          SHA512

          d18d483af543ac72a204b076f897fe62284a0479fdb5a407ef69d51588ccc9589465d94f5a4dce6fc3d36ce6667a42d6513e4a05ce2fde7b0794e1745aa0bb9e

        • C:\Users\Admin\AppData\Local\Temp\RES9EE0.tmp

          Filesize

          1KB

          MD5

          36b04e7271580900164e7df46f48f2b9

          SHA1

          341e7455edb24a31fb78334bdadd3ab50ea90183

          SHA256

          ac4c4c4b775fd56046330c06d5b3715053a69f0496dd567493725de4212ddc73

          SHA512

          fb67cd4d9c6a9eb3da9d284869c287a2a4111699f8e8b55507bd68abc8a1c8af9d674a577a07feae0c389bba8bc67adeae4ab884e0ced4a6939d9d952c2e3b30

        • C:\Users\Admin\AppData\Local\Temp\leetcrack.exe

          Filesize

          8.7MB

          MD5

          93144ffd83e528ff8651605be2d2c1a4

          SHA1

          6c661ce690ecd3ecd21c8953e410543fcf8a69ad

          SHA256

          4ded33a5b292e88739e50c25c4db2ec8a4b444b21431f3daba87a2573965bd60

          SHA512

          5236edcac0e56126c0f83eccc930a96548788694e1505ee0f74e77ed41582b1c92573de2fef0bf1e69fa3e9bc355f45f4671a67da66612e1a24b8eb849ea668c

        • C:\Users\Admin\AppData\Local\Temp\portmonitor.exe

          Filesize

          3.8MB

          MD5

          3d686dda8f890bef092779bc682dec10

          SHA1

          2e6f12de7a5d4febe798a63b2f8914458741bf7f

          SHA256

          af9b7828f0661720eeaac5931f160f7db17dbf6c1ddcd7020a0c06a4deb2b7d4

          SHA512

          cb32222a74d01de5c99e5096e1e00f86ab54af0db9e6b560b5952de2ab1c654ebde7331e80302dedb387acc7ad7c98eae3748cf3bf2bb78c1d0a5088db881f58

        • C:\Webnet\portmonitor.exe

          Filesize

          3.5MB

          MD5

          aa6c98cd853bf585a410394fd10817dc

          SHA1

          ceab1865997ae2c6e070a9c6adf6b129cf2ad383

          SHA256

          fc45eebea5ae88160a2ac49fe7e027baeee028c4f4b021794726a04ecea8c90b

          SHA512

          2ada05425dce38fd9fe48c9ceb6a21c59c5e7088274c4445dfde054974f14f8feba5012909c5a75d7932a6bcbb488e38d34d9c970cd61c636ee13abc59e06562

        • C:\Webnet\x9qTsv13UFeYw.bat

          Filesize

          84B

          MD5

          5bcb417bd38f4db1936b88b262c0f7ad

          SHA1

          d724fa06c67a7740497576d08b2c9b5b77c7eca4

          SHA256

          f4374316bbc474ade932922a7ae28b6ded46b26a39ec4f3d1042b342a9bb9f07

          SHA512

          9706324f2d9ad3e617987927e63a8a1372c18139a465c17ad5ff8a45d21c09b17571f1de7ae98714310d4a7e0a6f8e40d9148c87c93324c9eacd99f0ab2a2e6c

        • C:\Webnet\xEX0MYAV03ULsqYY87UbhI7XqesjrcJfyK7h.vbe

          Filesize

          209B

          MD5

          1fefc5b72cd89c9f83dcf8a47b254f58

          SHA1

          909c965e493baab2203bac16be714cfb88a75f0d

          SHA256

          7f03a5563b7186e6c6efa09392c843783b9a3375bcfbe29e4b9c8fc6f3032c3c

          SHA512

          5bada5c497c306276c348569995cb254b3e6dcf2a8c10e48eadded26b69e7d5690503b8d9610f46b91a28effbe4be8d7345938d8c59d9f5343186f4d60e526ca

        • \??\c:\Users\Admin\AppData\Local\Temp\trcuwpu1\trcuwpu1.0.cs

          Filesize

          370B

          MD5

          8c5b1616a62830a03d0ccbf5e0b6a830

          SHA1

          5680ed78fbd5f01851c5cb0f9d388a64af31fcd0

          SHA256

          3542eed68e8757e5788695c298f37ef0ab5d2d68a189db9be656b324984ae323

          SHA512

          dec357c297b82313f095c6869a84cf070a2d7b3b6add909d39a5ebd977beb0d7bd8a6fd534f50f75f5613b2d96c4702a10aca0590f2f4015efc61a6f545f3d05

        • \??\c:\Users\Admin\AppData\Local\Temp\trcuwpu1\trcuwpu1.cmdline

          Filesize

          235B

          MD5

          7ced408a5908343e1541aef6d0fd3edc

          SHA1

          7c88a91478d6f3fccb48b3cd693578ba4f6f1fdb

          SHA256

          09b63d5c3206af5570c0dc8fc1918096ef53dcb6a3087e13cdd1dd3b2d5bf0df

          SHA512

          0dad6e6974f0fecf63f9fd9838983153f113ca477ea4af991d80d439b01e5bc34d981a7de138c548cf306528de6e183a75163bff3aca49f5c011042286bd9ef2

        • \??\c:\Windows\System32\CSC56DC0060DE534FD4B15B31062D3D8C8.TMP

          Filesize

          1KB

          MD5

          ee02e61712b278a663aabf6c9cd9c14a

          SHA1

          ce82ed14abd6953b216a9939320a70329212905d

          SHA256

          65299c0a98dc9afed5cc30f0ba894c76e44aff475873108c6a4d29ce08e94888

          SHA512

          b8fb886ed346b5eef8136094cb5627194f7ab552e5c62d5d76de05b69ec1bc3379d28695b2733e2c250a65d066c60000a3f538d0b681d7be44e2ce5e3d34a7a4

        • memory/1032-35-0x00007FF7BBD20000-0x00007FF7BC94A000-memory.dmp

          Filesize

          12.2MB

        • memory/4556-68-0x000000001B2C0000-0x000000001B2D2000-memory.dmp

          Filesize

          72KB

        • memory/4556-83-0x000000001B790000-0x000000001B7EA000-memory.dmp

          Filesize

          360KB

        • memory/4556-62-0x0000000000EF0000-0x0000000000F00000-memory.dmp

          Filesize

          64KB

        • memory/4556-64-0x00000000027E0000-0x00000000027F0000-memory.dmp

          Filesize

          64KB

        • memory/4556-66-0x000000001B0F0000-0x000000001B0FE000-memory.dmp

          Filesize

          56KB

        • memory/4556-58-0x0000000000EE0000-0x0000000000EF0000-memory.dmp

          Filesize

          64KB

        • memory/4556-70-0x000000001B100000-0x000000001B110000-memory.dmp

          Filesize

          64KB

        • memory/4556-72-0x000000001B2E0000-0x000000001B2F6000-memory.dmp

          Filesize

          88KB

        • memory/4556-74-0x000000001B300000-0x000000001B312000-memory.dmp

          Filesize

          72KB

        • memory/4556-75-0x000000001BCC0000-0x000000001C1E8000-memory.dmp

          Filesize

          5.2MB

        • memory/4556-77-0x000000001B130000-0x000000001B13E000-memory.dmp

          Filesize

          56KB

        • memory/4556-79-0x000000001B190000-0x000000001B1A0000-memory.dmp

          Filesize

          64KB

        • memory/4556-81-0x000000001B1A0000-0x000000001B1B0000-memory.dmp

          Filesize

          64KB

        • memory/4556-60-0x000000001B110000-0x000000001B128000-memory.dmp

          Filesize

          96KB

        • memory/4556-85-0x000000001B320000-0x000000001B32E000-memory.dmp

          Filesize

          56KB

        • memory/4556-87-0x000000001B330000-0x000000001B340000-memory.dmp

          Filesize

          64KB

        • memory/4556-89-0x000000001B340000-0x000000001B34E000-memory.dmp

          Filesize

          56KB

        • memory/4556-91-0x000000001B9F0000-0x000000001BA08000-memory.dmp

          Filesize

          96KB

        • memory/4556-93-0x000000001B350000-0x000000001B35C000-memory.dmp

          Filesize

          48KB

        • memory/4556-95-0x000000001BA60000-0x000000001BAAE000-memory.dmp

          Filesize

          312KB

        • memory/4556-56-0x000000001B140000-0x000000001B190000-memory.dmp

          Filesize

          320KB

        • memory/4556-55-0x000000001B0D0000-0x000000001B0EC000-memory.dmp

          Filesize

          112KB

        • memory/4556-53-0x0000000000ED0000-0x0000000000EDE000-memory.dmp

          Filesize

          56KB

        • memory/4556-51-0x0000000002760000-0x0000000002786000-memory.dmp

          Filesize

          152KB

        • memory/4556-49-0x00000000001E0000-0x000000000056E000-memory.dmp

          Filesize

          3.6MB