Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

02294dac80...cs.exe

windows7-x64

8

02294dac80...cs.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    11/05/2024, 12:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    02294dac80cd4283c4ca58448fb40a90_NeikiAnalytics.exe

  • Size

    119KB

  • MD5

    02294dac80cd4283c4ca58448fb40a90

  • SHA1

    46cec03bc35363bd23388c522b7d9a803bea2ca5

  • SHA256

    9cac1d127e3c6e380f4d6fd817beacde0e1f211469dc84f560603d1662f55921

  • SHA512

    70130b3880ea7da8ae6c82257bb96fd005f5ed40b7754ee17b4a75acfa1c4b79295aa25023de622ad7f10a190b5b4948efccac2c4a36e3e9770f210dd7e6e459

  • SSDEEP

    3072:LHOjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPp:LHIs9OKofHfHTXQLzgvnzHPowYbvrjDc

Score
8/10
persistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\02294dac80cd4283c4ca58448fb40a90_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\02294dac80cd4283c4ca58448fb40a90_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2984
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2232
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:2532

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\satornas.dll
    Filesize

    183B

    MD5

    d6e08139cd1c167ea4ec3faf933a5a17

    SHA1

    320263727609798c8f0665834531092eb43e0674

    SHA256

    83e9b1f317309a905bf51ae6ee7a15caedec95b39807d5a7db1233a4cad38dbb

    SHA512

    6a5470003fce7d9ce7eada7a0e5858cebd5f6e474f020d52b4a050ae5bee6dd90dae72e75f6fa5f1fc0b9765a6f5ddb778724342b7448e722afbdc6e555d1a7a

    Download Submit

  • \Windows\SysWOW64\ctfmen.exe
    Filesize

    4KB

    MD5

    950a2b6d4fd6808455aaa0ca3388e69f

    SHA1

    bdb8e1ff798bf199294d7c083375ce6ec9318d56

    SHA256

    309ffec7f7a5a664ee307dada3ce40ead6b15e289480ac7524183f305db7e0ce

    SHA512

    da184107054d385200e570a05d9cc584fb1f91d7541abd86109c8bb638b20a02f89e0fbe58a926a303edabfeb0de7f640dd81da69bfaea953ed04e7751482e2d

    Download Submit

  • \Windows\SysWOW64\shervans.dll
    Filesize

    8KB

    MD5

    f17bc65f8cc79e73a0b83f59fe987d4e

    SHA1

    c18dd07a3877d72192dcb2ae0668a2eb66f800de

    SHA256

    2f7cf8536d55e6660cf2e71624e25b344bf962df5ecf900a99e99ce9836d7e82

    SHA512

    1661162a704b81dc30cc67dd720d0135e6450f9998d0a17afe4c55401a164194b3b9b47ea1623be1ec40740d8259bd52e5c90afdfedce4114b6d9e2e16f97fcc

    Download Submit

  • \Windows\SysWOW64\smnss.exe
    Filesize

    119KB

    MD5

    a5235f0ed8240ad3d24305e6a30aadd1

    SHA1

    b31d30f6b4f3bd074794557f39402b46a74b832c

    SHA256

    c4526fa334e9f525039e9c250ed7681b71b4c7624c96e118ee4c20b203841c3d

    SHA512

    868db168e181a464e4364e4df13e7014799b098b1da3c701dfec38269a77a8fea69f74013a808603f1a9120954cf832fad69eee7e49e90501feb3d817ddeeaa8

    Download Submit

  • memory/2232-32-0x0000000000320000-0x0000000000340000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2232-28-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/2532-39-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2532-42-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2532-45-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2984-26-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2984-27-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2984-19-0x0000000000340000-0x0000000000349000-memory.dmp

    Filesize

    36KB

    Download

  • memory/2984-0-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2984-16-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download