Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

420f9d0978...cs.exe

windows7-x64

7

420f9d0978...cs.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/05/2024, 23:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    420f9d09781da5efa88c07bc6464c350_NeikiAnalytics.exe

  • Size

    170KB

  • MD5

    420f9d09781da5efa88c07bc6464c350

  • SHA1

    e484e30648fd498b28128ed8145e5164c80a1b8f

  • SHA256

    7e14114a882e13f10fc3dba19d4f70f4c804f34584fcd816e92ff54764b44fee

  • SHA512

    ed1dcced5a5db08e0037570fd27482685c3e832383cf07a5bf80bd0bd703d0a82c4f5a60198324d477a7eb0445b9f474493b074fcbbfce9dd83d27aede6c37a9

  • SSDEEP

    3072:s/JpOm5axh63laEo+pXX1pQD2UCohD8mxLCj+5cmeDye42L712xrpdJ8xLeb7Ux:sBAm5oh63laEo+pXX1pkF8mxeq5+4m7D

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 6 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 14 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 5 IoCs
  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 62 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\420f9d09781da5efa88c07bc6464c350_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\420f9d09781da5efa88c07bc6464c350_NeikiAnalytics.exe"
    1⤵
    • Enumerates connected drives
    • Maps connected drives based on registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3484
    • C:\ProgramData\SysEXT\ntuser.exe
      "C:\ProgramData\SysEXT\ntuser.exe" 1
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Maps connected drives based on registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:388
      • C:\Users\Admin\AppData\Roaming\SysEXT\ntuser.exe
        "C:\Users\Admin\AppData\Roaming\SysEXT\ntuser.exe" 1
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:3152
    • C:\ProgramData\SysEXT\ntuser.exe
      "C:\ProgramData\SysEXT\ntuser.exe"
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Maps connected drives based on registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2436
      • C:\ProgramData\SysEXT\ntuser.exe
        "C:\ProgramData\SysEXT\ntuser.exe" 1
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Suspicious behavior: EnumeratesProcesses
        PID:1256
  • C:\ProgramData\SysEXT\ntuser.exe
    C:\ProgramData\SysEXT\ntuser.exe
    1⤵
    • Executes dropped EXE
    • Enumerates connected drives
    • Maps connected drives based on registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1392
    • C:\ProgramData\SysEXT0\ntuser.exe
      "C:\ProgramData\SysEXT0\ntuser.exe"
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Maps connected drives based on registry
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      PID:1612

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\SysEXT0\obeterguf.dmp
    Filesize

    5KB

    MD5

    c158f8faa00ea866b9fcde4280cf36e2

    SHA1

    572653f2eed2ca2cccfbb92349710b2fa6032114

    SHA256

    7fe7f772f5748a72cbfbde60f51429d6977ea7e07160a36c4c7fbb891d192011

    SHA512

    d9045c4ead52f19023ec18cd11d9601afef4a18b4f15efb3068ed6c34447cb9f2d5e2027fcf98adf05ca34b62a96468011c27ab973a7202f4ca51b233ade563c

    Download Submit

  • C:\ProgramData\SysEXT\ntuser.exe
    Filesize

    170KB

    MD5

    60eef945d13c8f560f9ec2c9e7d4a09b

    SHA1

    cef1d95980515b88d220d4126ed1f651973b06db

    SHA256

    457b198c831e45bdbff044e60b2e1dcb139547d88e006dd491c5582557f667fb

    SHA512

    b88368116569d61063318b55c130d34d006cc83360314e6e376c733bfc86407e52648a38a43291f57ab40ab93b41435fb5085b50d3a615593ab11bbddcf1296d

    Download Submit

  • C:\Users\Admin\AppData\Roaming\SysEXT\ntuser.exe
    Filesize

    170KB

    MD5

    72ea59074c570d6c257cc89db2fecee8

    SHA1

    12265244ae0cc18699b3ce997cf38fa594329645

    SHA256

    fb831b7b2c641d208390f285f35f6229006ee946492ed967759a92fb01f09714

    SHA512

    1aed2d509d83af9873b15a29042f4dbb817b0ed0896e65c76727b898f53ce91dafbd3798109bcbb2fed8f58dbc9ce8b1dd26bf10d0702b4ce8ac5c45cd4f6638

    Download Submit

  • memory/3152-23-0x0000000074570000-0x00000000745A9000-memory.dmp

    Filesize

    228KB

    Download