Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    131s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    10/05/2024, 11:02

General

  • Target

    cbe5fa3a04fd6ee4e0e7069fd36fa9d0_NeikiAnalytics.exe

  • Size

    5.9MB

  • MD5

    cbe5fa3a04fd6ee4e0e7069fd36fa9d0

  • SHA1

    842d7420d17904429bf3f18728e50574c73e3e24

  • SHA256

    46f0cd3b93a0ffa8178abee398a2e010a47472d2f8115e0b359c438ea1900367

  • SHA512

    6e3673ec717ab159e1f77a71db867012a21ae31a02513d5413e528ea4f94d605526dbf809bc83c4cb7c1a813bd259a86bdaedc98de60fe261bc2a62afe1d9b4c

  • SSDEEP

    98304:/WQ2mvllRQYxuflUhINZ3HWmzXwN211JsG6dcxX8r5dbD8aiUCUS:ul+nRbxm3NZXWmzgC1J/6y2rb/5S

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 10 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Program Files directory 9 IoCs
  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 37 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cbe5fa3a04fd6ee4e0e7069fd36fa9d0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\cbe5fa3a04fd6ee4e0e7069fd36fa9d0_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2140
    • \??\c:\users\admin\appdata\local\temp\wmpscfgs.exe
      c:\users\admin\appdata\local\temp\\wmpscfgs.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3016
      • \??\c:\users\admin\appdata\local\temp\wmpscfgs.exe
        c:\users\admin\appdata\local\temp\\wmpscfgs.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1240
      • C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe
        C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:400
    • C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe
      C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2560
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 88
        3⤵
        • Loads dropped DLL
        • Program crash
        PID:2696
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1464
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1464 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2780
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1464 CREDAT:406535 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1468

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe

    Filesize

    5.9MB

    MD5

    5bf8fe471277b976d697c4f6b964ee8a

    SHA1

    b51bfae4df951010192dc5318b9a4a279a6ba18c

    SHA256

    a49a346b13b894194cbc0d4673d30ce46b13c2cb9f8e92f8e6320852def2af70

    SHA512

    1266f227290736350a6d60c7b19ca68dedbb2a96cf2c1862fafe9823d7449a1f819bb2d80bfeced8778789e87693b1cb43443cdc5095393d2a318e17020e5c2e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b266848a58c97ea7b771c895eada8ae5

    SHA1

    9ef5341d2bc294900e9111a3f7950fcf48432677

    SHA256

    807d51deded7999c381ba86f28822c533846c81ea91ebcf574cab78e873ca7f1

    SHA512

    7fea58cf4309aa856cac423dc5f2c7893fa496a1b1b87354833ee3d0ede70fc7fb236a5879ef38d5137efd3720a90b72ab1b5bb0fbfde17ef8ed894fcf08a3ef

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    a7747ea29e758795a1508d33680d7de6

    SHA1

    e7bcb820b2152f74f421b0636c081f3de1637c84

    SHA256

    52f7f8c4bef8c7e8ea3ec1ac7e07b641c6e202e11cf85fa395db7e6ba42681a7

    SHA512

    de30f9f49ce54e7b23038fd411e48e9e52573759b484d20cc08040cfdb0dd067c2a0c39abe81d5adc2079785d934568d0a2b9c9e89362fc8900c4f00baa17e3f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    65d5abfa1f7369a4ae2c71aaab484fd6

    SHA1

    4222c1294e1d24fc962949b197278328a264832c

    SHA256

    7524259f2a213c56081b6adeb8a86cd1135d45dcb3bc2b212ec99efe88db8ce1

    SHA512

    ecb672f8c0de982eca394aaabc784765804bd3b2c4a90f6058f5a51df538d7575c328620536bcbe6ed6f7f75f30bd211fc1f48bd37cf84190d10231b1d130b0f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    819fd3c26210e7d52235fe12846f6a8e

    SHA1

    2bfeef709b4fa3a7aa189d36ca939bcc4ca00e09

    SHA256

    ac47fbc2f54df345b2aa3bc1761ef852c05d4ed766f3cd776c65848662ec9e66

    SHA512

    1875d499203c25f8eb814869ab28f8c26821f061dabd050633e2fd22558c5f5b241cc94fe7466653da479729946105a541975d1e13114953d3053012c00f8051

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    51efc97f27aa5e7d990ae9c667d629c9

    SHA1

    f7be58098658f843ddc69e82ef1dcb9d10d5e916

    SHA256

    aa437c1a131032464ece7e99ba449c50e0563c51d1eb15b731a477ff9ba74fde

    SHA512

    9f429c692e52e7048065315a08eb9b9530b704950e6b0d94512ce75bc44618dd293ceb6a2418ee425f523c9b034e04a066745a92f492fe7fcb85a90178bbaa79

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    a90b516801b70b143f0623ba6bff1d4a

    SHA1

    ffe0cd25df1353de062ee6c39e989b6d2f3dadb3

    SHA256

    50c2e5a3b11ce42611de27451eccb8f97bdaf6a0097ad9384ad280406a6463e0

    SHA512

    ead2d4992057538583b3160aa8bc4a7980800c0157f086d5481ace2db3ed45f25aa48f4920f520f519cce9646bf7faf7de96b75992c1167a3513d4b19dacc94f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    d14071d430a13b52ffee899e834c407e

    SHA1

    34f2d87ec5aba15689992a66db6e2ac8f8f21fe9

    SHA256

    a8e4f2886f1ee9b698840bf64c21b4e77a2ccf993feccb33121d47928f5a67e3

    SHA512

    cbb7fe09c33f779ec7a1d959e4cf72593a45a46a86c30618984c3c9090120093b6b012d33b64b692fcb7fd3de8582d55ba7dabf8bda0b628e009bc5834a1f036

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    4b3b78e42eb0961ab379ec4d09d10f9a

    SHA1

    6fe77c8845facb610972a2e49f349d43f7d58470

    SHA256

    d433a83f8f068c5180cd8f8063abf7abceb0b7001a1d4582a0ffd77b9d71c944

    SHA512

    1ae9c99d6b7e3dd2b2a54dd68e2e5748b7df9b7bf37061fb9e487e4bbef600a51845e9bf64c1b80893d7e36b553c3d2ff1191b8bdf8b676b901506df77a764fb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    357c93a970cc537efc9604c6553350f6

    SHA1

    f65a3e5d42d5936551003cc25226a5a8507c2ddc

    SHA256

    27800a163ad8ae486bdef6417997cc5e246e33bb61db6e0bb40ddd22307b4831

    SHA512

    81199b99126d00cda6ed5bb24bd0ba2ee828074bdaa7c648dd4da98d0f6c251a191a9057b316740d28238a3c384169b1674ae48e545f90ad2ab6786638fe6471

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    cc8b619095eb8f3bd96c48658e55201b

    SHA1

    000197c587f2ffaabde14fc212659d4f54ee7967

    SHA256

    54e5f8147ab241bb168d368d26d4da22c52c1cf85a54d5165c5b7612e5f0d540

    SHA512

    c77e7c7ae9d5aedf3fb7f16fdff39cef940a1ddc281e0084ce270d09e0b4478adf32a99da2dcedff94262127b40da6939cca97e244b128e8f3f343efd360a809

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    9f2b592435d506e7a3ebc3498c4df882

    SHA1

    575b9b8d3af7d5e9f04b928ee4d65b805117d6b6

    SHA256

    2a956b119fdcf21117ba2a2fe6d3b78cdcfef14eac063ba3f3b0bbc60582ca71

    SHA512

    dca80839dcc99361a17c55235684947dfb5a4939f4a04f3517f15ca643151a83992c5181ca77831dce682d43362a2e725be415e4444670b85594860d7f024bdb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    4e44113189227c69cfde49f88d7453e8

    SHA1

    194d7228f8bc76a6d72913f8f0dff4a4cef1a63d

    SHA256

    a06e7c05645e31ed21b6ba011b6cb006e003d1211ea1bac1ca52165874a7978d

    SHA512

    f65d26468b8550847472fef12e099fcf4b39c0f0b17117f496b8aa644d8efa934d157a2625904ecbf4719714f7fbc117e9b7d566256c4384018153ad4f04671e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    8800e5c9102e62a2f4e5ced9030b2bac

    SHA1

    9c6b422dd7812540428cb1da09ef8539f2037c25

    SHA256

    5a91683c3b13140ef2522342874187280d9cd90c409d4a2c7bc5ea8604db90d2

    SHA512

    c39c3c9053d0627499140606e08c2f6475650e4cf13ea1c800064cb67bbab748f7dcd04321b7c74a8af9e7c0e7d989438ad44d7ced3c456b9ae96cad3706a5d6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    1321733532b9336a9463032b2fcf3cd0

    SHA1

    dedea5e2f3665c6442404a91714b6ed00c44cf8c

    SHA256

    e279e4530824c0a6f1fb1e2e55a475ca52b2f368b0348330b38ddbb85eadd4a9

    SHA512

    7c47ae95f137da85a8ec2255fdf72fa9b320e5ee1feb8cc7256b04060db36d7a433632ae10fefaae5afaf9ecbd56dd5abcd65723e65d1fdd7e3851ec86b4581c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    56e80789cf9c71b6f977785428452f03

    SHA1

    c52635ff29364d513e039549be9c25918adb3819

    SHA256

    c4eb44de0038861c8384a36723a2bf0dfb1ad3bd8fb2aabc9a7a410ff7108f5e

    SHA512

    7b2cd52e97639d566985421567f305d654a769dd2dee78fbd673377e9dc9d587fc588e5954475365543fb9d3591834749307ddbe448d67c8f78a10eeb8f5f58d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    77c4a466f692ebd5f0d7600c0401552b

    SHA1

    5c24e25fd53443523e761ac8fe6f407005804c1a

    SHA256

    b968e64ec585323e8764b84e64d9c209f63ac75108cc7d75621917f69f04b35d

    SHA512

    f08195e08b7ca3fdb3c56e5f0394bf490431e29bc08d6a6ec1810f9a98ac98b79faea4464bc9ff55a917e3d6acfe5da38fe41826b4cf13f8f75776c439b3e180

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    493e110e593633e75ff8238e2654d947

    SHA1

    1ec26d41f4125c6a5da60c9b2abdc24d30695d6c

    SHA256

    844b5fd06fe977c2f3489faf5ef383940e10b134502bc22db7b35bfde148ca24

    SHA512

    995792aa6e1cf420d723bf79ff4b7dfdb6bb218dc2494c551c39ef4fdbd62186ba54624d14f133933dfeaf74e6fa8f3a974d7f1d0b34e2776e867468a16d6094

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    45f26260aa8e0f6cb3a4aabce473c355

    SHA1

    5a8489d4449ba348be84716ed0105d8141f7fb6a

    SHA256

    be0515e095d275668efd88c665b7c02d5821741c0dcb589ac011d56ee8918437

    SHA512

    685d5dc04cafe18814a0bc568d0202b9e278bda017674c35ca70e5e6995aff3231858d1f43c1cb6566d53a495f4f5e3a27718998ecba8df990fb1ffc74281f33

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    7d36fd4141b1fedc18405080be8fbed6

    SHA1

    a9dd9b8c4f3a80bc78e2ef433e412949c8631c43

    SHA256

    9d9354b35d4d4bc34fb8a1301c0f0a703ed9b0de4ff6fa62f2c52fd6fb21cef5

    SHA512

    373cdf59886d3b0cd01d555433ffc18652b90b412416febc8823fd21dfe2702784dda469090e10c9da3d119e598d83d3ece5b09e9105e85170743b0d752a1128

  • C:\Users\Admin\AppData\Local\Temp\CabA749.tmp

    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

  • C:\Users\Admin\AppData\Local\Temp\TarA79B.tmp

    Filesize

    177KB

    MD5

    435a9ac180383f9fa094131b173a2f7b

    SHA1

    76944ea657a9db94f9a4bef38f88c46ed4166983

    SHA256

    67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

    SHA512

    1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

  • C:\Users\Admin\AppData\Local\Temp\wmpscfgs.exe

    Filesize

    6.0MB

    MD5

    c04990fd6ac0d647c0654953abf72144

    SHA1

    cb02e41c7f99709595f8d692b0eb95f147a3ee7e

    SHA256

    cb9f87d6ea5a21a01bc9e53e8885bd4fe743178d4a0c7ed51f6142e2ff7daffd

    SHA512

    3b1c566bcbc59762dc7553126db34f40704cdae8bf47c13f5712007f623d6c7fb0b03efb90509e5570e9d3f553e0215eb8a158f84f35370aae218ddced6d634d

  • \??\c:\program files (x86)\microsoft office\office14\bcssync.exe

    Filesize

    5.9MB

    MD5

    2075c4167d13b031b911674fe31933c7

    SHA1

    ed604dc2d259d05e5920a60f4119eb7329a3ece3

    SHA256

    ca49ffd4854b90df2e00546d453e4dab08ef9a41a7de922f28006f816e69b585

    SHA512

    0299a1ce17bbf9ae12e2b28fd54e63ea8685bbce6722b6869cbb6b2616b7851909b8e4ec7cc383933f16233c39eae196a92b113364c3f94e1102a01ad49c1c98

  • memory/400-95-0x0000000000400000-0x0000000000CB5000-memory.dmp

    Filesize

    8.7MB

  • memory/400-104-0x0000000000400000-0x0000000000CB5000-memory.dmp

    Filesize

    8.7MB

  • memory/400-82-0x0000000000400000-0x0000000000CB5000-memory.dmp

    Filesize

    8.7MB

  • memory/1240-88-0x0000000000400000-0x0000000000CB5000-memory.dmp

    Filesize

    8.7MB

  • memory/1240-87-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/1240-85-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2140-1-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2140-38-0x0000000004CC0000-0x0000000005575000-memory.dmp

    Filesize

    8.7MB

  • memory/2140-3-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2140-5-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2140-0-0x0000000000400000-0x0000000000CB5000-memory.dmp

    Filesize

    8.7MB

  • memory/2140-6-0x0000000000400000-0x0000000000CB5000-memory.dmp

    Filesize

    8.7MB

  • memory/2140-8-0x0000000000422000-0x0000000000725000-memory.dmp

    Filesize

    3.0MB

  • memory/2140-9-0x0000000000400000-0x0000000000CB5000-memory.dmp

    Filesize

    8.7MB

  • memory/2140-10-0x0000000010000000-0x0000000010010000-memory.dmp

    Filesize

    64KB

  • memory/2140-31-0x0000000000400000-0x0000000000CB5000-memory.dmp

    Filesize

    8.7MB

  • memory/2140-30-0x0000000004CC0000-0x0000000005575000-memory.dmp

    Filesize

    8.7MB

  • memory/2140-40-0x0000000000422000-0x0000000000725000-memory.dmp

    Filesize

    3.0MB

  • memory/2140-34-0x0000000004CC0000-0x0000000005575000-memory.dmp

    Filesize

    8.7MB

  • memory/2560-64-0x0000000000400000-0x0000000000CB5000-memory.dmp

    Filesize

    8.7MB

  • memory/2560-35-0x0000000000400000-0x0000000000CB5000-memory.dmp

    Filesize

    8.7MB

  • memory/2560-46-0x0000000000400000-0x0000000000CB5000-memory.dmp

    Filesize

    8.7MB

  • memory/2560-48-0x0000000000400000-0x0000000000CB5000-memory.dmp

    Filesize

    8.7MB

  • memory/3016-536-0x00000000040E0000-0x0000000004995000-memory.dmp

    Filesize

    8.7MB

  • memory/3016-39-0x0000000000400000-0x0000000000CB5000-memory.dmp

    Filesize

    8.7MB

  • memory/3016-54-0x0000000000400000-0x0000000000CB5000-memory.dmp

    Filesize

    8.7MB

  • memory/3016-56-0x0000000000400000-0x0000000000CB5000-memory.dmp

    Filesize

    8.7MB

  • memory/3016-61-0x0000000010000000-0x0000000010010000-memory.dmp

    Filesize

    64KB

  • memory/3016-65-0x0000000000400000-0x0000000000CB5000-memory.dmp

    Filesize

    8.7MB

  • memory/3016-81-0x00000000040E0000-0x0000000004995000-memory.dmp

    Filesize

    8.7MB

  • memory/3016-100-0x0000000000360000-0x0000000000362000-memory.dmp

    Filesize

    8KB