Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/05/2024, 12:20

General

  • Target

    02294dac80cd4283c4ca58448fb40a90_NeikiAnalytics.exe

  • Size

    119KB

  • MD5

    02294dac80cd4283c4ca58448fb40a90

  • SHA1

    46cec03bc35363bd23388c522b7d9a803bea2ca5

  • SHA256

    9cac1d127e3c6e380f4d6fd817beacde0e1f211469dc84f560603d1662f55921

  • SHA512

    70130b3880ea7da8ae6c82257bb96fd005f5ed40b7754ee17b4a75acfa1c4b79295aa25023de622ad7f10a190b5b4948efccac2c4a36e3e9770f210dd7e6e459

  • SSDEEP

    3072:LHOjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPp:LHIs9OKofHfHTXQLzgvnzHPowYbvrjDc

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\02294dac80cd4283c4ca58448fb40a90_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\02294dac80cd4283c4ca58448fb40a90_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1404
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:724
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:372

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\ctfmen.exe

    Filesize

    4KB

    MD5

    ebf7a51596cc9e373c9e04c3142583e8

    SHA1

    b8e4dccac752c9ab14edbe71a801aa8fd9a420a1

    SHA256

    505f7db0fd16d0cda901b89467a9642bf5f9f124050c23049baebb360d7fb496

    SHA512

    a24dceb2d1ba3058e222f328ec87feea47083230bb3c6415ea9b5a88a48ec757c3626c5c2c010b267783aec9eabf59f219518fac728e4d2980baf02cc16b55c5

  • C:\Windows\SysWOW64\grcopy.dll

    Filesize

    119KB

    MD5

    cf541d909fb9fb96cbd2d14b849cece4

    SHA1

    135469d765f32024aa4143e2c7886ce28f44835f

    SHA256

    033099e4fdbd553622ffe9fb7b7744f50d366d76435abd92be99d42f43b7d927

    SHA512

    3c9b3f017f510e6d0de719be429771e965019d7337be9c03bdab75467b0dd953185c13a5c6e9ad8414494d7fba889dd33d443c4b98880b1bd7e234ba94953638

  • C:\Windows\SysWOW64\satornas.dll

    Filesize

    183B

    MD5

    92ab460f7faf0f0acded65ec5ebfc6af

    SHA1

    068e31f35fe8a616efbc6054b077bf867625d444

    SHA256

    e45099dd2a0e20fb4d771d985c82d5ff839b0323922df7a5ff0562d665e4c0f3

    SHA512

    5297095fb653abedf49ab2748b72adfa940c7b983797cb4dd33dabf8bd0b062beca16f81bc0f12e812063daef408addf386d7a2d6c6fcba892dbc20303e08e6e

  • C:\Windows\SysWOW64\shervans.dll

    Filesize

    8KB

    MD5

    ceab398052c7c43393e880b02c629d25

    SHA1

    df7859964bd20962aa32d96e3da65c11cbcd22ca

    SHA256

    db2078e3b998f7545b16319406e67b5f442159279d147b5c3a81c41afa96385e

    SHA512

    6a8609e0b86ba49166b47a4c9964851355209c46b3bc707ae58b5a3509b0de107274f8510bc64703d6d365e43c1fc9d607314fd91271bcc72028d6463ca69350

  • memory/372-28-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/372-37-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

  • memory/372-40-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/724-29-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/1404-0-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/1404-13-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

  • memory/1404-23-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

  • memory/1404-22-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB