Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
13/05/2024, 21:37
Static task
static1
Behavioral task
behavioral1
Sample
208cc46a095afe8c984556cec3097ec0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
208cc46a095afe8c984556cec3097ec0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
208cc46a095afe8c984556cec3097ec0_NeikiAnalytics.exe
-
Size
211KB
-
MD5
208cc46a095afe8c984556cec3097ec0
-
SHA1
91d38e6348fabd7c1c901f9c871f1a94a4cdb1c4
-
SHA256
dc744862f33f7a231e99f67613748cf475337ab8cbc8a7b6cc02ce14c27e01a1
-
SHA512
c00287d33a39fc7ead37c3672fbd05943db37ac189b9eeaf39c35a1e701d9f9058559796ba098077a48b62eff396adbe869bb53ce471c233ced4d145ae8d246e
-
SSDEEP
3072:JD6Xtx68yygRBE52mxkEOHLRMpZ4deth8PEAjAfIbAYGPhz6sPJBInxZqOi:Jh8cBzHLRMpZ4d1Zi
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\userinit.exe" userinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\userinit.exe" swchost.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" userinit.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" swchost.exe -
Modifies Installed Components in the registry 2 TTPs 8 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} swchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} swchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\mrsys.exe MR" swchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} swchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} userinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\mrsys.exe MR" userinit.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} swchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\mrsys.exe MR" swchost.exe -
Executes dropped EXE 4 IoCs
pid Process 2876 userinit.exe 2484 spoolsw.exe 2648 swchost.exe 2472 spoolsw.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Swchost = "c:\\windows\\swchost.exe RO" swchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\userinit = "c:\\windows\\userinit.exe RO" userinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Swchost = "c:\\windows\\swchost.exe RO" userinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\userinit = "c:\\windows\\userinit.exe RO" swchost.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\system\udsys.exe userinit.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification \??\c:\windows\userinit.exe userinit.exe File opened for modification \??\c:\windows\swchost.exe swchost.exe File opened for modification \??\c:\windows\userinit.exe 208cc46a095afe8c984556cec3097ec0_NeikiAnalytics.exe File opened for modification \??\c:\windows\spoolsw.exe userinit.exe File opened for modification \??\c:\windows\swchost.exe spoolsw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2196 208cc46a095afe8c984556cec3097ec0_NeikiAnalytics.exe 2876 userinit.exe 2876 userinit.exe 2876 userinit.exe 2648 swchost.exe 2648 swchost.exe 2876 userinit.exe 2648 swchost.exe 2876 userinit.exe 2648 swchost.exe 2876 userinit.exe 2648 swchost.exe 2876 userinit.exe 2648 swchost.exe 2876 userinit.exe 2648 swchost.exe 2876 userinit.exe 2648 swchost.exe 2876 userinit.exe 2648 swchost.exe 2876 userinit.exe 2648 swchost.exe 2876 userinit.exe 2648 swchost.exe 2876 userinit.exe 2648 swchost.exe 2876 userinit.exe 2648 swchost.exe 2876 userinit.exe 2648 swchost.exe 2876 userinit.exe 2648 swchost.exe 2876 userinit.exe 2648 swchost.exe 2876 userinit.exe 2648 swchost.exe 2876 userinit.exe 2648 swchost.exe 2876 userinit.exe 2648 swchost.exe 2876 userinit.exe 2648 swchost.exe 2876 userinit.exe 2648 swchost.exe 2876 userinit.exe 2648 swchost.exe 2876 userinit.exe 2648 swchost.exe 2876 userinit.exe 2648 swchost.exe 2876 userinit.exe 2648 swchost.exe 2876 userinit.exe 2648 swchost.exe 2876 userinit.exe 2648 swchost.exe 2876 userinit.exe 2648 swchost.exe 2876 userinit.exe 2648 swchost.exe 2876 userinit.exe 2648 swchost.exe 2876 userinit.exe 2648 swchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2876 userinit.exe 2648 swchost.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2196 208cc46a095afe8c984556cec3097ec0_NeikiAnalytics.exe 2196 208cc46a095afe8c984556cec3097ec0_NeikiAnalytics.exe 2876 userinit.exe 2876 userinit.exe 2484 spoolsw.exe 2484 spoolsw.exe 2648 swchost.exe 2648 swchost.exe 2472 spoolsw.exe 2472 spoolsw.exe 2876 userinit.exe 2876 userinit.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2196 wrote to memory of 2876 2196 208cc46a095afe8c984556cec3097ec0_NeikiAnalytics.exe 29 PID 2196 wrote to memory of 2876 2196 208cc46a095afe8c984556cec3097ec0_NeikiAnalytics.exe 29 PID 2196 wrote to memory of 2876 2196 208cc46a095afe8c984556cec3097ec0_NeikiAnalytics.exe 29 PID 2196 wrote to memory of 2876 2196 208cc46a095afe8c984556cec3097ec0_NeikiAnalytics.exe 29 PID 2876 wrote to memory of 2484 2876 userinit.exe 30 PID 2876 wrote to memory of 2484 2876 userinit.exe 30 PID 2876 wrote to memory of 2484 2876 userinit.exe 30 PID 2876 wrote to memory of 2484 2876 userinit.exe 30 PID 2484 wrote to memory of 2648 2484 spoolsw.exe 31 PID 2484 wrote to memory of 2648 2484 spoolsw.exe 31 PID 2484 wrote to memory of 2648 2484 spoolsw.exe 31 PID 2484 wrote to memory of 2648 2484 spoolsw.exe 31 PID 2648 wrote to memory of 2472 2648 swchost.exe 32 PID 2648 wrote to memory of 2472 2648 swchost.exe 32 PID 2648 wrote to memory of 2472 2648 swchost.exe 32 PID 2648 wrote to memory of 2472 2648 swchost.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\208cc46a095afe8c984556cec3097ec0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\208cc46a095afe8c984556cec3097ec0_NeikiAnalytics.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\windows\userinit.exec:\windows\userinit.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\windows\spoolsw.exec:\windows\spoolsw.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\windows\swchost.exec:\windows\swchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\windows\spoolsw.exec:\windows\spoolsw.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2472
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
211KB
MD596136c46bf3d92654fc1150fda3ab790
SHA14332e0feb6dd02c030816b52b711f111acbda3ac
SHA25604427da1f7ca046475a4b3b1d9cad859101c0ab9181b371a578375b35932be3f
SHA5126fb703172373b0255f2adeacaeb7d6236c6c525bf1aa7dc30274d238e48f33b4f8a31ee2ac96028608b898784b1e1015a8dda7a59050632a58ec1c01f44395eb
-
Filesize
211KB
MD51a201872c87a6b933ee0002758ae5ea2
SHA187b15e427f34fda6c60d642f156e810278b4b244
SHA2563efb06d11fe6f25d3ed5b47aabd665ff5ac6f457068c98b0fe3b6dcb44d519a8
SHA5128826c626ea0d9a17c5aa14021c53e499a0edb700429161391a7f003c69cb7783637e1d248d27366a13bd68a1ee2662d63a2aeb3b3d68f22236df187905eb5fdf
-
Filesize
211KB
MD55baae77e6cc20029d4524b346f3101d6
SHA1999b5fca061a470bd6ad2694624663133afa5366
SHA25685a4cae8038cfe9617585cfd13104f356062169843f5d6945900caede8cdaa33
SHA512c3c55e6961fcd54dafffe6e9b4194b0a3f0edc74942c1562e0335adf01aabdcd0665016c121cb5acab156fff6d84e99064edf68f11eef093167853ec8676885d
-
Filesize
211KB
MD554889cea02cbf6e572f2c848bbdcf442
SHA1f2a8e5bda3c2c7d3bcd93ceb50b8e00bca440c29
SHA2569194fbfb47ee3176559e97f691dc7da35f440e9996bac44649dc0554291200f6
SHA5126937600ce93bb1e9e71bfa4b714308c0b944c99d3f22ab2459baff1cae6f0b107baa8513199da5af07591fef33eb5cb1a21df22a5510d377f915506f00a93cb6