Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 14:34
Behavioral task
behavioral1
Sample
cac19898a5729ab707ba743724b3f8d0_NeikiAnalytics.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
cac19898a5729ab707ba743724b3f8d0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
cac19898a5729ab707ba743724b3f8d0_NeikiAnalytics.exe
-
Size
510KB
-
MD5
cac19898a5729ab707ba743724b3f8d0
-
SHA1
481c18f83669307242f049decfe22e0bf00ef5ce
-
SHA256
afca54256d528d462830a9d90c2f3532625f0b7f7a9e9e0f95c0e439c6081d1b
-
SHA512
026f8de68599288cda0fd810714f41517aea15727ca9c8e2dd7c2ddcf499f58ec49b399a655311043d9989389d879c0276153c96bcfaaeb4dfcd1c6f54ac04ec
-
SSDEEP
12288:KkheH6hZYOYrInJ0JvQNy0+wcXP46sBmbvsTlgGrLfhtjQci:KkheahZnnJsvQNy0+wcXPkB9TbfhtS
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2636 jrun32.exe 2316 jrun32.exe 2504 jrun32.exe -
Loads dropped DLL 2 IoCs
pid Process 2860 cac19898a5729ab707ba743724b3f8d0_NeikiAnalytics.exe 2860 cac19898a5729ab707ba743724b3f8d0_NeikiAnalytics.exe -
resource yara_rule behavioral1/memory/2140-1-0x0000000000400000-0x0000000000496000-memory.dmp upx behavioral1/memory/2140-3-0x0000000000400000-0x0000000000496000-memory.dmp upx behavioral1/memory/2140-4-0x0000000000400000-0x0000000000496000-memory.dmp upx behavioral1/memory/2140-25-0x0000000000400000-0x0000000000496000-memory.dmp upx behavioral1/files/0x0009000000015018-28.dat upx behavioral1/memory/2636-35-0x0000000000400000-0x0000000000496000-memory.dmp upx behavioral1/memory/2636-40-0x0000000000400000-0x0000000000496000-memory.dmp upx behavioral1/memory/2636-42-0x0000000000400000-0x0000000000496000-memory.dmp upx behavioral1/memory/2636-91-0x0000000000400000-0x0000000000496000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrun32 = "C:\\Users\\Admin\\AppData\\Roaming\\AppData\\jrun32.exe -notray" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2140 set thread context of 2860 2140 cac19898a5729ab707ba743724b3f8d0_NeikiAnalytics.exe 28 PID 2636 set thread context of 2316 2636 jrun32.exe 30 PID 2636 set thread context of 2504 2636 jrun32.exe 31 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 2184 ipconfig.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 1200 reg.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2140 cac19898a5729ab707ba743724b3f8d0_NeikiAnalytics.exe 2860 cac19898a5729ab707ba743724b3f8d0_NeikiAnalytics.exe 2636 jrun32.exe 2316 jrun32.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 2140 wrote to memory of 2860 2140 cac19898a5729ab707ba743724b3f8d0_NeikiAnalytics.exe 28 PID 2140 wrote to memory of 2860 2140 cac19898a5729ab707ba743724b3f8d0_NeikiAnalytics.exe 28 PID 2140 wrote to memory of 2860 2140 cac19898a5729ab707ba743724b3f8d0_NeikiAnalytics.exe 28 PID 2140 wrote to memory of 2860 2140 cac19898a5729ab707ba743724b3f8d0_NeikiAnalytics.exe 28 PID 2140 wrote to memory of 2860 2140 cac19898a5729ab707ba743724b3f8d0_NeikiAnalytics.exe 28 PID 2140 wrote to memory of 2860 2140 cac19898a5729ab707ba743724b3f8d0_NeikiAnalytics.exe 28 PID 2140 wrote to memory of 2860 2140 cac19898a5729ab707ba743724b3f8d0_NeikiAnalytics.exe 28 PID 2140 wrote to memory of 2860 2140 cac19898a5729ab707ba743724b3f8d0_NeikiAnalytics.exe 28 PID 2140 wrote to memory of 2860 2140 cac19898a5729ab707ba743724b3f8d0_NeikiAnalytics.exe 28 PID 2860 wrote to memory of 2636 2860 cac19898a5729ab707ba743724b3f8d0_NeikiAnalytics.exe 29 PID 2860 wrote to memory of 2636 2860 cac19898a5729ab707ba743724b3f8d0_NeikiAnalytics.exe 29 PID 2860 wrote to memory of 2636 2860 cac19898a5729ab707ba743724b3f8d0_NeikiAnalytics.exe 29 PID 2860 wrote to memory of 2636 2860 cac19898a5729ab707ba743724b3f8d0_NeikiAnalytics.exe 29 PID 2636 wrote to memory of 2316 2636 jrun32.exe 30 PID 2636 wrote to memory of 2316 2636 jrun32.exe 30 PID 2636 wrote to memory of 2316 2636 jrun32.exe 30 PID 2636 wrote to memory of 2316 2636 jrun32.exe 30 PID 2636 wrote to memory of 2316 2636 jrun32.exe 30 PID 2636 wrote to memory of 2316 2636 jrun32.exe 30 PID 2636 wrote to memory of 2316 2636 jrun32.exe 30 PID 2636 wrote to memory of 2316 2636 jrun32.exe 30 PID 2636 wrote to memory of 2316 2636 jrun32.exe 30 PID 2636 wrote to memory of 2504 2636 jrun32.exe 31 PID 2636 wrote to memory of 2504 2636 jrun32.exe 31 PID 2636 wrote to memory of 2504 2636 jrun32.exe 31 PID 2636 wrote to memory of 2504 2636 jrun32.exe 31 PID 2636 wrote to memory of 2504 2636 jrun32.exe 31 PID 2636 wrote to memory of 2504 2636 jrun32.exe 31 PID 2636 wrote to memory of 2504 2636 jrun32.exe 31 PID 2636 wrote to memory of 2504 2636 jrun32.exe 31 PID 2636 wrote to memory of 2504 2636 jrun32.exe 31 PID 2636 wrote to memory of 2504 2636 jrun32.exe 31 PID 2636 wrote to memory of 2504 2636 jrun32.exe 31 PID 2636 wrote to memory of 2504 2636 jrun32.exe 31 PID 2316 wrote to memory of 2184 2316 jrun32.exe 32 PID 2316 wrote to memory of 2184 2316 jrun32.exe 32 PID 2316 wrote to memory of 2184 2316 jrun32.exe 32 PID 2316 wrote to memory of 2184 2316 jrun32.exe 32 PID 2316 wrote to memory of 2184 2316 jrun32.exe 32 PID 2316 wrote to memory of 2184 2316 jrun32.exe 32 PID 2184 wrote to memory of 2208 2184 ipconfig.exe 34 PID 2184 wrote to memory of 2208 2184 ipconfig.exe 34 PID 2184 wrote to memory of 2208 2184 ipconfig.exe 34 PID 2184 wrote to memory of 2208 2184 ipconfig.exe 34 PID 2208 wrote to memory of 1200 2208 cmd.exe 36 PID 2208 wrote to memory of 1200 2208 cmd.exe 36 PID 2208 wrote to memory of 1200 2208 cmd.exe 36 PID 2208 wrote to memory of 1200 2208 cmd.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\cac19898a5729ab707ba743724b3f8d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\cac19898a5729ab707ba743724b3f8d0_NeikiAnalytics.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\cac19898a5729ab707ba743724b3f8d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\cac19898a5729ab707ba743724b3f8d0_NeikiAnalytics.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Roaming\AppData\jrun32.exeC:\Users\Admin\AppData\Roaming\AppData\jrun32.exe -notray3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Roaming\AppData\jrun32.exe"C:\Users\Admin\AppData\Roaming\AppData\jrun32.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\system32\ipconfig.exe"5⤵
- Gathers network information
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\EOXFCQUG.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v jrun32 /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\AppData\jrun32.exe -notray" /f7⤵
- Adds Run key to start application
- Modifies registry key
PID:1200
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\AppData\jrun32.exe"C:\Users\Admin\AppData\Roaming\AppData\jrun32.exe"4⤵
- Executes dropped EXE
PID:2504
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
146B
MD5f43ed9d2c73208eded7959a9b78c7814
SHA1d8f0db46acffd54bd87051ad8e46f73b8dd47961
SHA256707c5b61af860c851e76c8173f36a852089f68985a25356b1e47711265cea7f6
SHA512b06f43d4029e372a53b36df2fc3091b7b546c65074770da3adb88be3c96c4288cc0247fb7408804f96ddbb6df305f230f288aa30355bf7b22865216130671d0d
-
Filesize
510KB
MD5232b13feb0ce0508291921a35e615404
SHA1cb314d5d2d0d21978affafaebf848b131169b064
SHA2565faafb46e2b35fb7857b7965054a6bdf0b0b5d2ccfc1369f8ef7054d0cae6ffb
SHA512117600df10f6c9601d6f3e84837491b08202e91ad7cba67edb830a2c6970c6c1cc7e7aea359eff749f8471b05c5e5be6f69ad28a24129a617389e85cdf88a1a7