Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/05/2024, 16:30

General

  • Target

    211561c9e8bdfe05098d6e5bf9e1ae40_NeikiAnalytics.exe

  • Size

    464KB

  • MD5

    211561c9e8bdfe05098d6e5bf9e1ae40

  • SHA1

    6065bffb3267e5c827d272e16393b6e8fc71d8ed

  • SHA256

    3cca823f1bbfca3d84488bc0d50340c33f882ee1c8cfb141d98283935bd5b457

  • SHA512

    e35c310414f308cf2914c96f36eeec7a9431f526acb53b20e2dd405a9da9f2f3f8ec918ef9cc718d42457138511633f0c9d1a544b7786db368e0f42d5883a177

  • SSDEEP

    12288:Rdlc87eqqV5e+wBV6O+Wl4b8zIM3WDDLXEZ6Yg733I:RdSqqHeVBx1N/GDDUJa34

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of UnmapMainImage
    PID:3476
    • C:\Users\Admin\AppData\Local\Temp\211561c9e8bdfe05098d6e5bf9e1ae40_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\211561c9e8bdfe05098d6e5bf9e1ae40_NeikiAnalytics.exe"
      2⤵
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:1580
      • C:\Users\Admin\AppData\Roaming\backeown\backexer.exe
        "C:\Users\Admin\AppData\Roaming\backeown"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4988
        • C:\Users\Admin\AppData\Local\Temp\~3C2E.tmp
          3476 475144 4988 1
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3196
  • C:\Windows\SysWOW64\gpupsync.exe
    C:\Windows\SysWOW64\gpupsync.exe -s
    1⤵
    • Executes dropped EXE
    PID:4284

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\~3C2E.tmp

    Filesize

    8KB

    MD5

    86dc243576cf5c7445451af37631eea9

    SHA1

    99a81c47c4c02f32c0ab456bfa23c306c7a09bf9

    SHA256

    25d2a671e1b5b5b95697ac0234ce4d46e0d0894919521b54aabebd9daecf994a

    SHA512

    c7310524f9b65f811146c1eb6ae944966351ac88a95fbc1ac422d8810730e5e212a7e28090ad758ea23c96ba38073e7fcf42460575e7f09dbc759a45c5d5a4a4

  • C:\Users\Admin\AppData\Roaming\backeown\backexer.exe

    Filesize

    464KB

    MD5

    2b64e0fa9cbd3518ab9c324969f878da

    SHA1

    93d37f9fa8e928f3226463dbde10944df17a8adb

    SHA256

    95b1ee6a9c93fca98e3047bbdf23b25bf0eb1037b128f92f53bf3509f4cda527

    SHA512

    20ca5be3f676e9503e81b9eaef00e2421f38745d85d8df1994e25653b1b1f569f7181d96b57d3e54535d7fbf58fbf020e20d1f8e9e55214aa99441d3490920de

  • memory/1580-1-0x0000000000550000-0x00000000005CD000-memory.dmp

    Filesize

    500KB

  • memory/1580-18-0x0000000000400000-0x000000000047A000-memory.dmp

    Filesize

    488KB

  • memory/1580-0-0x0000000000400000-0x000000000047A000-memory.dmp

    Filesize

    488KB

  • memory/3476-22-0x0000000000CA0000-0x0000000000CA6000-memory.dmp

    Filesize

    24KB

  • memory/3476-20-0x0000000003120000-0x00000000031A4000-memory.dmp

    Filesize

    528KB

  • memory/3476-19-0x0000000003120000-0x00000000031A4000-memory.dmp

    Filesize

    528KB

  • memory/3476-23-0x0000000002C40000-0x0000000002C4D000-memory.dmp

    Filesize

    52KB

  • memory/4284-15-0x0000000000480000-0x00000000004FD000-memory.dmp

    Filesize

    500KB

  • memory/4284-12-0x0000000000400000-0x000000000047A000-memory.dmp

    Filesize

    488KB

  • memory/4988-13-0x00000000005D0000-0x00000000005D5000-memory.dmp

    Filesize

    20KB

  • memory/4988-26-0x0000000000400000-0x000000000047A000-memory.dmp

    Filesize

    488KB

  • memory/4988-6-0x0000000000400000-0x000000000047A000-memory.dmp

    Filesize

    488KB

  • memory/4988-11-0x00000000006E0000-0x000000000075D000-memory.dmp

    Filesize

    500KB