Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

23497637e6...cs.exe

windows7-x64

8

23497637e6...cs.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    10/05/2024, 16:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    23497637e6c889aad0d90c6a33cc3fa0_NeikiAnalytics.exe

  • Size

    119KB

  • MD5

    23497637e6c889aad0d90c6a33cc3fa0

  • SHA1

    476bd686657fad6139630bfb22b82663a187b652

  • SHA256

    c037f391bb609514b2a1c501adc82fdcc0f5cbfd0571656d1d3083d3dd8af374

  • SHA512

    7268070a3e13f2d19e197725af2273459f16f8f0a7b8a4fd1182778ddcb4926eb3c6d9418cd7d22789a5a29596258f1de78e3d9fdece509869dfcc79994c23ec

  • SSDEEP

    3072:mOjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPh:mIs9OKofHfHTXQLzgvnzHPowYbvrjD/E

Score
8/10
persistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\23497637e6c889aad0d90c6a33cc3fa0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\23497637e6c889aad0d90c6a33cc3fa0_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1636
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2560
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:2732

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\satornas.dll
    Filesize

    183B

    MD5

    41f179c32c6bf7db3429d592268778a6

    SHA1

    4d5de1be4d036a2e7ac97bed4f86d11779e897af

    SHA256

    ba1bf77bf6aedad6a37b59ceb4b4b9c886822012c5a774f80df9ffe8621b245b

    SHA512

    875f089b1491303a8b9671d75f83e02e08d00d82247480f25c5623d155f9a7d009601c5982f4c45304554b806056ef2d181f5a18f4e2b7c2a5fca786d578de1d

    Download Submit

  • \Windows\SysWOW64\ctfmen.exe
    Filesize

    4KB

    MD5

    ecf397e023e412972ffe6364abecc144

    SHA1

    6316f6cbe58cf9fa1da95e14561a3120d0e62898

    SHA256

    cc7cc664d8f5bd468c27c2208582ab7319e56ed68b0af1e8c5fda5a1e811a9b2

    SHA512

    948cac8af606a0eadc018712b7beeed6ad6e690229eb0580d4b1e95a6bfe54631b203ae1e75864b0175995f6de95bcea41f5f26fb89cdeb3e00f486e4c479d4e

    Download Submit

  • \Windows\SysWOW64\shervans.dll
    Filesize

    8KB

    MD5

    3888d03628119e1dc7578bda801aa465

    SHA1

    33ddc30ea763f7d43e1f86ae8f36ffe80261ae7f

    SHA256

    1302c4b8e7d4a46da9391eef7ccd1799df2cc05c2b79ce977de9c15560665458

    SHA512

    788a346de7493403bad643d73fa1a36953f06c0701751002c74000a9f6867cf2b5d8441acdc3443fe9eb76e07889cbafd3e60f12597a144a9a150a2d02e723de

    Download Submit

  • \Windows\SysWOW64\smnss.exe
    Filesize

    119KB

    MD5

    ec88ade9d6663b13156abeaf9f2611ac

    SHA1

    641bc61e6ef3c91a7fa17c5e8d3d2bed063a204d

    SHA256

    08a6b6d5aea9fd8489ba31da7c6ad39479999e2c8c11897c59003b4abb37b6bd

    SHA512

    536bc766df5daddf97d00a27a746210185c3bea7ba182c92150d2e6a93c4afd57998a9d419706c38ce40f13649c112dbdf32969e9718f76ea3dd3667c0d1071a

    Download Submit

  • memory/1636-25-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1636-26-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/1636-0-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1636-18-0x0000000000340000-0x0000000000349000-memory.dmp

    Filesize

    36KB

    Download

  • memory/1636-16-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2560-29-0x0000000000320000-0x0000000000340000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2560-33-0x0000000000320000-0x0000000000340000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2560-35-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/2732-42-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2732-45-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

    Download