Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/05/2024, 05:34

General

  • Target

    871d8d5d4addac81c7be2dbd6b662b20_NeikiAnalytics.exe

  • Size

    67KB

  • MD5

    871d8d5d4addac81c7be2dbd6b662b20

  • SHA1

    2ae818b232ff26c6dc2f6b12152969d0dd3d9732

  • SHA256

    0030d938ac4c6832485c3dd59635ac4dc5b03396cfa22aaaa4a36a3edd74890a

  • SHA512

    5a2533610c2e0ce0c669c5fc503acc76ab190a424086004e171185c9b065220019c04212114311fa5bbe693a43a2dfaa7d5e4c8a629ed40892c6b338071794c7

  • SSDEEP

    1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1RewYL:ulg35GTslA5t3pewYL

Malware Config

Signatures

  • Windows security bypass 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Sets file execution options in registry 2 TTPs 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Windows security modification 2 TTPs 4 IoCs
  • Modifies WinLogon 2 TTPs 5 IoCs
  • Drops file in System32 directory 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\871d8d5d4addac81c7be2dbd6b662b20_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\871d8d5d4addac81c7be2dbd6b662b20_NeikiAnalytics.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3016
    • C:\Windows\SysWOW64\tbesoof-upeas.exe
      "C:\Windows\system32\tbesoof-upeas.exe"
      2⤵
      • Windows security bypass
      • Modifies Installed Components in the registry
      • Sets file execution options in registry
      • Executes dropped EXE
      • Windows security modification
      • Modifies WinLogon
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1912
      • C:\Windows\SysWOW64\tbesoof-upeas.exe
        ùù¿çç¤
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:5088

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\acbumum.exe

    Filesize

    70KB

    MD5

    f0f162e04a735dc92b3efb84082c75f1

    SHA1

    59f3c3dfd82dab44f0c7f139f2c70c5c4911a3f9

    SHA256

    908ff28ecfc4fcd7c664dc3740c9c7c06b656e66bd8ddac475e12f8bd383dd53

    SHA512

    bc0ee53545ec54f7bcc39cfd2e5c29783c5a7887d8d28ebaa2d265d899bf8b606bc97c6574b7e9181e34d24761cc890323d4e099a37dd357c88b07954c273b0d

  • C:\Windows\SysWOW64\bnugut-ouxor.exe

    Filesize

    71KB

    MD5

    1fc232d8cb074f0160be1c141aff4a76

    SHA1

    3b9be44c4aa853ace9f4e12984a732446c784ae9

    SHA256

    fbb1e65d8384354accbbbe016dbd029fb6a244bc91d26d8182e373dad75540f8

    SHA512

    e541010f20be9e85d183abd2a298c3ca9892326bb935ad1b29612fe7c613d6448d38d6de170bfe2b7136d879a7e33aa5aaa5dc20d8dcd629d32f55ae4bef3446

  • C:\Windows\SysWOW64\outcoboog-feab.dll

    Filesize

    5KB

    MD5

    f37b21c00fd81bd93c89ce741a88f183

    SHA1

    b2796500597c68e2f5638e1101b46eaf32676c1c

    SHA256

    76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

    SHA512

    252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

  • C:\Windows\SysWOW64\tbesoof-upeas.exe

    Filesize

    67KB

    MD5

    871d8d5d4addac81c7be2dbd6b662b20

    SHA1

    2ae818b232ff26c6dc2f6b12152969d0dd3d9732

    SHA256

    0030d938ac4c6832485c3dd59635ac4dc5b03396cfa22aaaa4a36a3edd74890a

    SHA512

    5a2533610c2e0ce0c669c5fc503acc76ab190a424086004e171185c9b065220019c04212114311fa5bbe693a43a2dfaa7d5e4c8a629ed40892c6b338071794c7

  • memory/1912-49-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/3016-5-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/5088-50-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB