Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    14/05/2024, 05:34

General

  • Target

    871d8d5d4addac81c7be2dbd6b662b20_NeikiAnalytics.exe

  • Size

    67KB

  • MD5

    871d8d5d4addac81c7be2dbd6b662b20

  • SHA1

    2ae818b232ff26c6dc2f6b12152969d0dd3d9732

  • SHA256

    0030d938ac4c6832485c3dd59635ac4dc5b03396cfa22aaaa4a36a3edd74890a

  • SHA512

    5a2533610c2e0ce0c669c5fc503acc76ab190a424086004e171185c9b065220019c04212114311fa5bbe693a43a2dfaa7d5e4c8a629ed40892c6b338071794c7

  • SSDEEP

    1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1RewYL:ulg35GTslA5t3pewYL

Malware Config

Signatures

  • Windows security bypass 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Sets file execution options in registry 2 TTPs 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Windows security modification 2 TTPs 4 IoCs
  • Modifies WinLogon 2 TTPs 5 IoCs
  • Drops file in System32 directory 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\871d8d5d4addac81c7be2dbd6b662b20_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\871d8d5d4addac81c7be2dbd6b662b20_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1900
    • C:\Windows\SysWOW64\tbesoof-upeas.exe
      "C:\Windows\system32\tbesoof-upeas.exe"
      2⤵
      • Windows security bypass
      • Modifies Installed Components in the registry
      • Sets file execution options in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Modifies WinLogon
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2388
      • C:\Windows\SysWOW64\tbesoof-upeas.exe
        ùù¿çç¤
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:3036

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\acbumum.exe

    Filesize

    70KB

    MD5

    bfd58cdce0105d936ce0e050aeea7d2a

    SHA1

    19938e3d1292425b1b92452da8a8e967662d0ec8

    SHA256

    7c312db9ae7cb50e07f2343bac6f6ff995e894fa702bee15a9252cde08d42daa

    SHA512

    45f9a47c2c13dce18c6c7258c94ee975cb4c82f02690758bfdcb958241be4c624e12ec13d49042d121a92611e51c02cc1a9c57c24af6ab907414f601fd278a9b

  • C:\Windows\SysWOW64\bnugut-ouxor.exe

    Filesize

    71KB

    MD5

    9364e03d5f43889d7d542b3c94a3e604

    SHA1

    92f9a3c7038622f7c3917800949c4536ceafdd94

    SHA256

    7739bffb706ad76abd9ab104e4ac9aaae2d5ddcaf2964e917f5a720053cc30cd

    SHA512

    2d2412a9a611e9ca75d0d3e35658db1e20750dab672772bb7b872753bc5f3de10591e204a87ac1a1bf7bd95acd63758a4f1bc4aa091ce379679343eafa3241be

  • C:\Windows\SysWOW64\outcoboog-feab.dll

    Filesize

    5KB

    MD5

    f37b21c00fd81bd93c89ce741a88f183

    SHA1

    b2796500597c68e2f5638e1101b46eaf32676c1c

    SHA256

    76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

    SHA512

    252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

  • C:\Windows\SysWOW64\tbesoof-upeas.exe

    Filesize

    67KB

    MD5

    871d8d5d4addac81c7be2dbd6b662b20

    SHA1

    2ae818b232ff26c6dc2f6b12152969d0dd3d9732

    SHA256

    0030d938ac4c6832485c3dd59635ac4dc5b03396cfa22aaaa4a36a3edd74890a

    SHA512

    5a2533610c2e0ce0c669c5fc503acc76ab190a424086004e171185c9b065220019c04212114311fa5bbe693a43a2dfaa7d5e4c8a629ed40892c6b338071794c7

  • memory/1900-9-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2388-55-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/3036-56-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB