Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/05/2024, 06:36

General

  • Target

    989fd0fecf41082be0bc25212a75df60_NeikiAnalytics.exe

  • Size

    70KB

  • MD5

    989fd0fecf41082be0bc25212a75df60

  • SHA1

    6b8acab7534d300aa556924727b60a01fcfe6040

  • SHA256

    09bcd9ecea937d2453fec8a467ab0b661de87c201f88a90e03b765db262a054d

  • SHA512

    994068fa1f3de8ad9d471b54cf26b0bcfecca32ad5954d72a8ef826690ba467f543de084aca7cc0d9072ce50fd1079a7049a1b414a83ad7caaeda6be59941e78

  • SSDEEP

    1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8D:Olg35GTslA5t3/w8D

Malware Config

Signatures

  • Windows security bypass 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Sets file execution options in registry 2 TTPs 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Windows security modification 2 TTPs 4 IoCs
  • Modifies WinLogon 2 TTPs 5 IoCs
  • Drops file in System32 directory 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:628
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
        PID:3420
        • C:\Users\Admin\AppData\Local\Temp\989fd0fecf41082be0bc25212a75df60_NeikiAnalytics.exe
          "C:\Users\Admin\AppData\Local\Temp\989fd0fecf41082be0bc25212a75df60_NeikiAnalytics.exe"
          2⤵
          • Drops file in System32 directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:380
          • C:\Windows\SysWOW64\ougfoateat-eamoot.exe
            "C:\Windows\system32\ougfoateat-eamoot.exe"
            3⤵
            • Windows security bypass
            • Modifies Installed Components in the registry
            • Sets file execution options in registry
            • Executes dropped EXE
            • Windows security modification
            • Modifies WinLogon
            • Drops file in System32 directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:348
            • C:\Windows\SysWOW64\ougfoateat-eamoot.exe
              --k33p
              4⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              PID:3380

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Windows\SysWOW64\edfegear.exe

        Filesize

        74KB

        MD5

        f7329a8098813ae7a516fd20d7a6eb23

        SHA1

        9d06d6704eb3d519a1516041c776b7a9e3815c44

        SHA256

        01b922e0edf6176b70c336c198746f8acf3e8ce30464a6862b6ee19c7d7702b8

        SHA512

        754eca001cc453f57088dae79b09e4a8785a72b05a598b8ce4f264cce0b2cc85b4424c00052708a74d603accd3c5222a54fd437b5baa200d071d515f28789395

      • C:\Windows\SysWOW64\ilxenoak.dll

        Filesize

        5KB

        MD5

        f37b21c00fd81bd93c89ce741a88f183

        SHA1

        b2796500597c68e2f5638e1101b46eaf32676c1c

        SHA256

        76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

        SHA512

        252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

      • C:\Windows\SysWOW64\ougfoateat-eamoot.exe

        Filesize

        70KB

        MD5

        989fd0fecf41082be0bc25212a75df60

        SHA1

        6b8acab7534d300aa556924727b60a01fcfe6040

        SHA256

        09bcd9ecea937d2453fec8a467ab0b661de87c201f88a90e03b765db262a054d

        SHA512

        994068fa1f3de8ad9d471b54cf26b0bcfecca32ad5954d72a8ef826690ba467f543de084aca7cc0d9072ce50fd1079a7049a1b414a83ad7caaeda6be59941e78

      • C:\Windows\SysWOW64\ubgoapik-ouxom.exe

        Filesize

        73KB

        MD5

        9436c6caddf484def87d4c149bd9bc53

        SHA1

        ea9568806cfb766a03d4a810f4b53d27c7bb225e

        SHA256

        d95e702bfe4b8d55850975b14c0fd7c9476e579f49c7e89490ff0e2757defa64

        SHA512

        c47a1d67d5bf5f7b14adc39eae4232046bec2dff9373fa370cf6bfaf91412b8d194149b531271790aacf8d746bf87115ace3868e242ac24e11ce284ef8b62711

      • memory/348-49-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

      • memory/380-5-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

      • memory/3380-50-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB