Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
12/05/2024, 05:21
General
-
Target
6fed287a09bdd29f1935e1fc0ef50840_NeikiAnalytics.exe
-
Size
1.3MB
-
MD5
6fed287a09bdd29f1935e1fc0ef50840
-
SHA1
6f524e3acbf58c0daafc6bb67c5fcd4182e04dc8
-
SHA256
4faa0a94ee4cb1b9c9503783ca8da7fac14107f4f893be36ab931f26f8409594
-
SHA512
9a2699088635ebf3871315913aff56f280cacdc36853ec0ba218a736bf3dedfaadd75c7bce3ed27616426c18bffb00840158dcdeaa7877cfb8a16dfaff82e3b4
-
SSDEEP
12288:OHgn3FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:OHa1N3RUDHNmdPCAaq8Nozgi/rE0TOj
Malware Config
Signatures
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 24 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 35 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6fed287a09bdd29f1935e1fc0ef50840_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6fed287a09bdd29f1935e1fc0ef50840_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:81⤵
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD54ad943ac3e9d5fce8dab62296e6c6e69
SHA1194b1f8ada9298f7c09531a1562f8dbe6f2b8f33
SHA256eec0e97e95f284ca2eb4f56538a2a0535463ce9dd6a61bd450c3d75478136405
SHA5123126e530e7fd8d108ff642bfe2ad5bead132c4d0d9f92946f2fd7ae5c700e658472822623ed74baa199f6c3b931c0313aa1dd5c463ac73f03dae13600fc88c3a
-
Filesize
1.4MB
MD53470a731fb35b9753fb53bed37f26e05
SHA173c5f205dcabdc40e51b5a5d1cf8af5a449167a4
SHA2566647b508bbdd85d3443b29f2fba6ecddb437e82a820490883bdf5acc0a76b53f
SHA5120dde38443b4ad205b69832d9f157e2a669a6e0ec1c1880ef0a65d1afb88200900bed14e467120f6f8255ea732c93af60e3bdd2d17151e55b4843d26278463d4a
-
Filesize
1.4MB
MD5e77b356613d741bfd7369a4c9425c449
SHA1240dae61ed6417d36ecb25cae1bc0bd1988e79c3
SHA2564a0a46a1bd0c785b1e4e7184c325dfb6298022a7fcaeb0310104f42a5b104560
SHA5120e529bb94375a5a6ce18fb0b548f986f8ba620a8c4a46276ff50bc8f01fba2f455e50fbff21ac13e3cb9ffcc3e9e181271886c0e88a7161165940653e2a57ecb
-
Filesize
2.1MB
MD5a13c0c9fa80b7f9070b70c1bcfd6f070
SHA192b39674a2591ab1f4f20cc967ea9f0069a67366
SHA256aa3bbc334c2cb71e87eda153094cb04316938b330dcb7f33db6d82a6024fbdb2
SHA512f644e2ca457f1fc54e72eb8c8d349001df53d67c537a3adc7fad0fc5b01df92f82d82a8fa4bf8f09debf7dde52678fd8b158e59a3ad552a87e1a736c705cb4ad
-
Filesize
1.2MB
MD5697d6950365bc5580f7802164565420b
SHA129ca9da6d9c61552fc22e3272f406367a3f22bef
SHA2561e8fb73d5e1da3622f979b60e7e7021f0ddadf7ae13353c331c21b670f8b90ea
SHA512a8e63af23ccf1e68cfb9ed61916ff7af27780b50c9fad1efbc36b00b53f5cff9667f5c73c952a82f0b7e56becc4b26f87e55bae972748dd5f77678e4dde0aad5
-
Filesize
1.7MB
MD501cfa237bdb7bb142a2aa2231f3f4903
SHA167b29bff769eb8d86ae521e95dac85943be77761
SHA25665b6a9995ceb55e7c6f71868c588237cc5953af076dede967dd423134a430a62
SHA512254c4b67c337b6bfa2ebe8cde27e869a2be294ddd30b3b75daffb083725d45557d05357f7ba8c5228c2fb28d34db7732548e17ccce13374d15109213139268af
-
Filesize
1.3MB
MD5d576ce99365b318ba8f9f7d40e3b9a37
SHA11ec578ad61bb6ff0fb0687bc2b9308c135758e07
SHA256b23c3976bca6a7c26cfee4866a1e5276c248aa2225431f85dcfe42a06c71181c
SHA512cf85f770def49a088eca461d6024d9e787ede46ade076ac2c659f3393aaa7e9155f37e06f8628c794690c0c51486018a56b6aa138b40bb12fbcda5bd40d73e8b
-
Filesize
1.2MB
MD57d926aa8c3b7440ea4d73aebd0249f17
SHA18b2f66c34e1e1b7739dee5843d197e5a7cae5cba
SHA25650185bd3ed413a2504fbb15ca99cdd287239f8f4d478484aefa27e80ae6d538a
SHA512e295938d57aa36ce97adbe6c58718a97bbd715e082fc594d100087ea5773fee5bce59fa8434bc930e9c6cf0f23021a25638d3ad0121a35c3f3ba66ecf7e1840f
-
Filesize
1.2MB
MD55f2fc43a91d85d84e0f913965ce8580a
SHA135904bd3c63778fbc20d8a50c01681bbb4091049
SHA2564eeb846c20f71caa62850adc87c423c6b797e85b632535888d2bbc01671dd500
SHA512216f69a71477acfee0c78fb432282097405080808f0050434ce7b3fd8804174da2cfcf90e179b3910f63e8e35672fd8221ff7b787c68fdedf4e3cce05f1788e9
-
Filesize
1.5MB
MD51db125a5ab122eb0e5f1da75dd39fdd8
SHA13fecf26cd865cc217472ca45fc9313094dc55c1d
SHA256d9579ba52e4d2c03aec09827404cc6c9126afde93b55453d2b18cbfd7136b3dc
SHA5123023dcf610397ea6383f2f5c2be58b818abfced3c8a04374c530034efe6f770687b48057ab2da8a844ec1870cb08f1a35d98ac2101659ccfad4953fe79dde9f5
-
Filesize
1.3MB
MD5e5bdc59ad00884dcbada02c74cbfe917
SHA127b495e62daa28319fb7d0b5e20cec91a25d367c
SHA2567de1b2934ad62c7821fafa573ea3f6aa1f55604d8c058243653377fef6b68266
SHA512704e0401416e3a5e3904841c9d34f6d9549e92d1561652d16bc0a855ba90dc3bb7a5551c2800946608664cbbebd2e0e514d7f733b6389ee1a41d4c2348937e3d
-
Filesize
1.4MB
MD5cdbc91d04304392817da17318f061abe
SHA1e9c72aeb5d1fb3c804619e6da26942e900942282
SHA25605da2a5557b42c0030fe93d2d91f01c249bd7760cdf081c5b338e8d2fd310f1f
SHA512aac34e691c91c93075dcf06142cddc460e760c741f83ee8911ac85823a1a075953c9a4dd61416c4132b4c93182b425821155f4f8541630d47d054287245e8576
-
Filesize
1.8MB
MD5705cf6c3ebc3bcaff2008cbc0e574405
SHA1281eb2cdb1bb9016d537f12c4b42c5cebd5d8f09
SHA256ea93f00235693544a4b98d9af8d9a33e04b29e4a025ead122920f05d8cf66209
SHA51266b11463df011ffc33fbda5eb23af5f4cf984a58ecbdef06da981f86f7c81964d79831d3e43d73e9099b549610ecf5403936c24765a7fdce3df7500ff234b4f8
-
Filesize
1.4MB
MD5d0b4e366633a5ce75911f46c1d6a38bc
SHA1851a0a8ec5a7753290fd74c7333d0179ffc479f5
SHA256155c123be923269175574525b2fc83b416ae127b6eb36159aa49f9b39ecebeda
SHA5124c4564374a6aab0dba74a09d2aa120eeec3b371cfd6f44c511950d79cf2a51bfa2af21719423a24855093abd37df277caed6e58f60ad21430167acbee2afe83b
-
Filesize
1.5MB
MD581a684a03e3a7dac825d8aeef2a634ba
SHA1b5cfb65b09843ddd97dd788304a5e349c3fb69d8
SHA2560eb7cf4e086973314d973a11a3e675126cd24ddcd3593c590dbc9ec5fb6e1e01
SHA512762c20cd08fdf8f334a6e6a0ac175c3c7b325b802b3e831a10120012354c0b4afe2599dd0c3006851f66623246f5178f77172ac800765bd6a30e40693cb76270
-
Filesize
2.0MB
MD52d68f2f7ddc831cd5fabaa39d9cc598c
SHA118f569ece76800ea2b6b6d417949508cdccd31fe
SHA256c06888687c3702b6f19e86e5608bd43cd0d1b7dd4ab00865086a597c78716996
SHA512177ba5957212142cf7be4d6362fc4cb7d3d04e062399a8f5e34f395a21f34b82a9caffd4bf06f9a65374b1ad7475b3732a425e098b8d855450f78bb31fa168c7
-
Filesize
1.3MB
MD5f715eaa52357cc022dc73ae97204d73b
SHA17ea7aaa471aa724124fc63a8f01b1126828b444e
SHA2564213f0516ccb3647f4d8f8c7f0b4d154ec6879d14923e8771f96bddcc9822129
SHA512aaebfa779499704c7e87a2f9084b23956b777ac27cbea5c8d8bfce53b19c7a2098642bd1c85780c3c72a46c6cc82e441eddf0c8b5d360c4c0ccc9c8f2276d435
-
Filesize
1.3MB
MD5c404c6672431a46fa173c66ffa85c64c
SHA1131a69511f4885de1a01fffcfb215dfdc217ab8f
SHA2566343d09d060ad20956b4d25f410fe13a2b34aae3012b7517e7f21ce767b2d899
SHA512695aa0ca6dc14082973fd44a38a8e7e3d6bd5bc8ddf0ab7125a82c98eca52bfac96a2f1cf2c7edc5e5ade035fdcb95eebc8cff1fc484c79cba6e89a9c19f8d2a
-
Filesize
1.2MB
MD574efe9d77a22d0172861e92ad3c8d572
SHA1f754f828064ebe1f5849c280180834fc75b3274e
SHA256b0611bfc3186405fbdd4472d0de614455eee749b027a1aefea3f6cf435946883
SHA512d6eeb1b905ea1cd595bba3d32891d3963d07e8db1e47a33e98d4d1de56c656807df0e912c0ed82f9cc97fbd7e55d25ada418434d61f9ee58b8b13f3ce969ff7c
-
Filesize
1.3MB
MD506dd43d38fef7e8d6258d7bd16805043
SHA15a1a4bc0521a85345a7fb70abfb64089c218b748
SHA256451411db3244041a7b9034327f21929f8cb38dcdea7d532a1c27bd5522f71e97
SHA512142da5ec97385502938d9643e4475007cab81f7336cd1178b27c65372590abc962950594b6e7c133692aff5ee338e4664a8671b44c5cc05ceb652d9f835f1487
-
Filesize
1.4MB
MD5c620f9a4ff37db97e828b8767611dcff
SHA1a8518c31502c9ab30e1dcbcea0848bbffbdd7127
SHA25616d0129e61fb1a6805c22015aed8ab59858cd0262ca0711349b066aa0cbb25ae
SHA51297264016a3a7f59816e487ce48de84ea76d09ae793d214c2367ce279bfa5b23c9e779991e4b787bb249a47c03414959b817a80590553d2909856e56d38c67daa
-
Filesize
2.1MB
MD54ce9bab8813a35248357b6eea19154a5
SHA163416adba75eac284e5f1ba1b63110b598e64723
SHA256f2a99417fd2e3a1ab1c7674654b9d49adf21d404117e1afee0e0378b2d540bab
SHA5121fcee036ec4c7696fc79c974d15afb8d73c1ceb9b155588d14ec13f8ad0715d30b92fec2286d5b19945d0e982f4a31e547abef5ef879ecbc7698a6050b46f071
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.9MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB