Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 23:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5a2db0c377cd2a0d8d67d63f2a8388b0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
5a2db0c377cd2a0d8d67d63f2a8388b0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
5a2db0c377cd2a0d8d67d63f2a8388b0_NeikiAnalytics.exe
-
Size
71KB
-
MD5
5a2db0c377cd2a0d8d67d63f2a8388b0
-
SHA1
efccc713013b75c53992c49ae2743247a035cac3
-
SHA256
4c3c39c91c024c483f954173b1a9549f5475a010fb5e4078855d80f0ce43ca06
-
SHA512
8010b013678091dc5e64c16ada7108f9e3fdcc90ad6a7d685a2a3a2f657999374df70eddbeab4f509d0bd38066eaf03ba731280d70add21d6a227374bc68bbdb
-
SSDEEP
1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8sl1pRv:Olg35GTslA5t3/w8wp
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" udmoobev.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" udmoobev.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" udmoobev.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" udmoobev.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{465A4258-4458-5541-465A-425844585541} udmoobev.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{465A4258-4458-5541-465A-425844585541}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" udmoobev.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{465A4258-4458-5541-465A-425844585541}\IsInstalled = "1" udmoobev.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{465A4258-4458-5541-465A-425844585541}\StubPath = "C:\\Windows\\system32\\arboapat-udoas.exe" udmoobev.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe udmoobev.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" udmoobev.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\axxatip-idor.exe" udmoobev.exe -
Executes dropped EXE 2 IoCs
pid Process 2244 udmoobev.exe 1296 udmoobev.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" udmoobev.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" udmoobev.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" udmoobev.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" udmoobev.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} udmoobev.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify udmoobev.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" udmoobev.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\edbeatur.dll" udmoobev.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" udmoobev.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\axxatip-idor.exe udmoobev.exe File opened for modification C:\Windows\SysWOW64\arboapat-udoas.exe udmoobev.exe File created C:\Windows\SysWOW64\edbeatur.dll udmoobev.exe File opened for modification C:\Windows\SysWOW64\udmoobev.exe udmoobev.exe File opened for modification C:\Windows\SysWOW64\udmoobev.exe 5a2db0c377cd2a0d8d67d63f2a8388b0_NeikiAnalytics.exe File created C:\Windows\SysWOW64\udmoobev.exe 5a2db0c377cd2a0d8d67d63f2a8388b0_NeikiAnalytics.exe File created C:\Windows\SysWOW64\axxatip-idor.exe udmoobev.exe File created C:\Windows\SysWOW64\arboapat-udoas.exe udmoobev.exe File opened for modification C:\Windows\SysWOW64\edbeatur.dll udmoobev.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 1296 udmoobev.exe 1296 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe 2244 udmoobev.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1112 5a2db0c377cd2a0d8d67d63f2a8388b0_NeikiAnalytics.exe Token: SeDebugPrivilege 2244 udmoobev.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1112 wrote to memory of 2244 1112 5a2db0c377cd2a0d8d67d63f2a8388b0_NeikiAnalytics.exe 84 PID 1112 wrote to memory of 2244 1112 5a2db0c377cd2a0d8d67d63f2a8388b0_NeikiAnalytics.exe 84 PID 1112 wrote to memory of 2244 1112 5a2db0c377cd2a0d8d67d63f2a8388b0_NeikiAnalytics.exe 84 PID 2244 wrote to memory of 612 2244 udmoobev.exe 5 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 1296 2244 udmoobev.exe 85 PID 2244 wrote to memory of 1296 2244 udmoobev.exe 85 PID 2244 wrote to memory of 1296 2244 udmoobev.exe 85 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56 PID 2244 wrote to memory of 3544 2244 udmoobev.exe 56
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:612
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\5a2db0c377cd2a0d8d67d63f2a8388b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5a2db0c377cd2a0d8d67d63f2a8388b0_NeikiAnalytics.exe"2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\SysWOW64\udmoobev.exe"C:\Windows\system32\udmoobev.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\SysWOW64\udmoobev.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1296
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
73KB
MD5ed954c17d8df92b251fb7c1e74ce3e4f
SHA19f39ecbf191310b079699e087bf5de2c8a276a52
SHA2565c47048a98d75cb6f4b71f7bda971565ff9cb8873ed7dae53ede9b7e3045fd28
SHA51253bac7f07128b8daff7be9447048eb8624be4af052153a3016ae2f3fd00ea098220f57fbbe14dd07cb340ade52e0746fff3a5f34c5e7eb5e9305607573620313
-
Filesize
74KB
MD59f7206a98e83bf3b5c2c11361adbcb5d
SHA1d299897f12b31021a29d1b10e11e783d7b139e1e
SHA2567c82d5ebf272e7c798618899b35abb4b218cd329c90fba1f3195092862ac181c
SHA5126c0265fb5a1007bfd8966d0d25844a408d92a2d560bc1aae6974ae063d70229cfabaa6d781d21444581ca5a990e913bca5e55da8cc98de14845556508bc67878
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
Filesize
71KB
MD55a2db0c377cd2a0d8d67d63f2a8388b0
SHA1efccc713013b75c53992c49ae2743247a035cac3
SHA2564c3c39c91c024c483f954173b1a9549f5475a010fb5e4078855d80f0ce43ca06
SHA5128010b013678091dc5e64c16ada7108f9e3fdcc90ad6a7d685a2a3a2f657999374df70eddbeab4f509d0bd38066eaf03ba731280d70add21d6a227374bc68bbdb