Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2024, 03:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
693a82914b49b191643ad0f43eb9a900_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
693a82914b49b191643ad0f43eb9a900_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
693a82914b49b191643ad0f43eb9a900_NeikiAnalytics.exe
-
Size
66KB
-
MD5
693a82914b49b191643ad0f43eb9a900
-
SHA1
f6e7985eedd72da51862f9811f267c0d352e0e98
-
SHA256
74e293b7083f9c80faed2e1e53d5ed53e9b2c61a838d20a9375012990a6010d7
-
SHA512
62d0e9d4be417b95ac0eca9563e1e9725559127683522ea6103405e4c332ab2e7067330d4589c71efb5ebb615504aec2a7710afa7f8489dde3a5f0bd8e4febc1
-
SSDEEP
1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1swM:ulg35GTslA5t3UwM
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" utkoodim.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" utkoodim.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" utkoodim.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" utkoodim.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{52484154-5145-4451-5248-415451454451}\IsInstalled = "1" utkoodim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{52484154-5145-4451-5248-415451454451}\StubPath = "C:\\Windows\\system32\\olkinoon-atid.exe" utkoodim.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{52484154-5145-4451-5248-415451454451} utkoodim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{52484154-5145-4451-5248-415451454451}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" utkoodim.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe utkoodim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" utkoodim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\oucxooxen-eagur.exe" utkoodim.exe -
Executes dropped EXE 2 IoCs
pid Process 2028 utkoodim.exe 436 utkoodim.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" utkoodim.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" utkoodim.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" utkoodim.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" utkoodim.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} utkoodim.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify utkoodim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" utkoodim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\expeasov-tom.dll" utkoodim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" utkoodim.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\expeasov-tom.dll utkoodim.exe File opened for modification C:\Windows\SysWOW64\utkoodim.exe utkoodim.exe File created C:\Windows\SysWOW64\oucxooxen-eagur.exe utkoodim.exe File opened for modification C:\Windows\SysWOW64\olkinoon-atid.exe utkoodim.exe File opened for modification C:\Windows\SysWOW64\oucxooxen-eagur.exe utkoodim.exe File created C:\Windows\SysWOW64\olkinoon-atid.exe utkoodim.exe File opened for modification C:\Windows\SysWOW64\expeasov-tom.dll utkoodim.exe File opened for modification C:\Windows\SysWOW64\utkoodim.exe 693a82914b49b191643ad0f43eb9a900_NeikiAnalytics.exe File created C:\Windows\SysWOW64\utkoodim.exe 693a82914b49b191643ad0f43eb9a900_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 436 utkoodim.exe 436 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe 2028 utkoodim.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2032 693a82914b49b191643ad0f43eb9a900_NeikiAnalytics.exe Token: SeDebugPrivilege 2028 utkoodim.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2032 wrote to memory of 2028 2032 693a82914b49b191643ad0f43eb9a900_NeikiAnalytics.exe 84 PID 2032 wrote to memory of 2028 2032 693a82914b49b191643ad0f43eb9a900_NeikiAnalytics.exe 84 PID 2032 wrote to memory of 2028 2032 693a82914b49b191643ad0f43eb9a900_NeikiAnalytics.exe 84 PID 2028 wrote to memory of 436 2028 utkoodim.exe 87 PID 2028 wrote to memory of 436 2028 utkoodim.exe 87 PID 2028 wrote to memory of 436 2028 utkoodim.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\693a82914b49b191643ad0f43eb9a900_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\693a82914b49b191643ad0f43eb9a900_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\utkoodim.exe"C:\Windows\system32\utkoodim.exe"2⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\utkoodim.exeùù¿çç¤3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:436
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
Filesize
69KB
MD5862f3102e3f24466390d28f7f6d8e488
SHA1a3d14f7b57998a3b44b0f837fd786d26742cd233
SHA2567759b1a1ed7e4fe106da557ba7fd85ca2cf46e414ca370c5c3d77d4b2ac7ac70
SHA5122ff903bfb8c4c39b9ee452e1929fd6bde4a03613b74d5b6befa6bcd9acefa966dc64baf1b63daa515c4f527d358e9cb41b8da228f3957cc82948be9cc7840bf1
-
Filesize
70KB
MD57cde33d74dd2c92bd969c094bc733f04
SHA13e44fc848cb94d2e25cd86f54fba96044700c9aa
SHA2568e155d519d96c3bea23f82c128cd45fb49cc6b1d47f788c596968e1e3f5ea620
SHA512071d421f548ce8e9d77d881decf88611250c4243b19143e69276f01e91b2234769043440a5389234b11dec89255b7a94087658796a6026faeda7f21d2fc63fec
-
Filesize
66KB
MD5693a82914b49b191643ad0f43eb9a900
SHA1f6e7985eedd72da51862f9811f267c0d352e0e98
SHA25674e293b7083f9c80faed2e1e53d5ed53e9b2c61a838d20a9375012990a6010d7
SHA51262d0e9d4be417b95ac0eca9563e1e9725559127683522ea6103405e4c332ab2e7067330d4589c71efb5ebb615504aec2a7710afa7f8489dde3a5f0bd8e4febc1