Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 21:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3fb0eedcdb68eacd5480ad026245c4f0_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
3fb0eedcdb68eacd5480ad026245c4f0_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
3fb0eedcdb68eacd5480ad026245c4f0_NeikiAnalytics.exe
-
Size
70KB
-
MD5
3fb0eedcdb68eacd5480ad026245c4f0
-
SHA1
93f983ef3cf3f9627976a8709b2f3edb31f34bc9
-
SHA256
0cd171ea8890ec5bcf722fff0e71d07501c06896f9f75a28a8d9ceb856fc7354
-
SHA512
27c892ea21bd27fa7fd73d2cc13ddbc68038d3508fb84c6cf47b560fea51b679a37d7c829894f250fbd68dea55ea07eeefd4c0f3069bd21351b8febfcd743bc4
-
SSDEEP
1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8x:Olg35GTslA5t3/w8x
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" oubtebeaf-uxor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" oubtebeaf-uxor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" oubtebeaf-uxor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" oubtebeaf-uxor.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4249534D-495a-4858-4249-534D495A4858}\StubPath = "C:\\Windows\\system32\\ulronoob.exe" oubtebeaf-uxor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4249534D-495a-4858-4249-534D495A4858} oubtebeaf-uxor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4249534D-495a-4858-4249-534D495A4858}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" oubtebeaf-uxor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4249534D-495a-4858-4249-534D495A4858}\IsInstalled = "1" oubtebeaf-uxor.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe oubtebeaf-uxor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" oubtebeaf-uxor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\afcebag.exe" oubtebeaf-uxor.exe -
Executes dropped EXE 2 IoCs
pid Process 2308 oubtebeaf-uxor.exe 1208 oubtebeaf-uxor.exe -
Loads dropped DLL 3 IoCs
pid Process 1684 3fb0eedcdb68eacd5480ad026245c4f0_NeikiAnalytics.exe 1684 3fb0eedcdb68eacd5480ad026245c4f0_NeikiAnalytics.exe 2308 oubtebeaf-uxor.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" oubtebeaf-uxor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" oubtebeaf-uxor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" oubtebeaf-uxor.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" oubtebeaf-uxor.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} oubtebeaf-uxor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify oubtebeaf-uxor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" oubtebeaf-uxor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\endosek.dll" oubtebeaf-uxor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" oubtebeaf-uxor.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\afcebag.exe oubtebeaf-uxor.exe File opened for modification C:\Windows\SysWOW64\ulronoob.exe oubtebeaf-uxor.exe File created C:\Windows\SysWOW64\ulronoob.exe oubtebeaf-uxor.exe File opened for modification C:\Windows\SysWOW64\endosek.dll oubtebeaf-uxor.exe File opened for modification C:\Windows\SysWOW64\oubtebeaf-uxor.exe 3fb0eedcdb68eacd5480ad026245c4f0_NeikiAnalytics.exe File created C:\Windows\SysWOW64\oubtebeaf-uxor.exe 3fb0eedcdb68eacd5480ad026245c4f0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\oubtebeaf-uxor.exe oubtebeaf-uxor.exe File created C:\Windows\SysWOW64\afcebag.exe oubtebeaf-uxor.exe File created C:\Windows\SysWOW64\endosek.dll oubtebeaf-uxor.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 1208 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe 2308 oubtebeaf-uxor.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1684 3fb0eedcdb68eacd5480ad026245c4f0_NeikiAnalytics.exe Token: SeDebugPrivilege 2308 oubtebeaf-uxor.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1684 wrote to memory of 2308 1684 3fb0eedcdb68eacd5480ad026245c4f0_NeikiAnalytics.exe 28 PID 1684 wrote to memory of 2308 1684 3fb0eedcdb68eacd5480ad026245c4f0_NeikiAnalytics.exe 28 PID 1684 wrote to memory of 2308 1684 3fb0eedcdb68eacd5480ad026245c4f0_NeikiAnalytics.exe 28 PID 1684 wrote to memory of 2308 1684 3fb0eedcdb68eacd5480ad026245c4f0_NeikiAnalytics.exe 28 PID 2308 wrote to memory of 436 2308 oubtebeaf-uxor.exe 5 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1208 2308 oubtebeaf-uxor.exe 29 PID 2308 wrote to memory of 1208 2308 oubtebeaf-uxor.exe 29 PID 2308 wrote to memory of 1208 2308 oubtebeaf-uxor.exe 29 PID 2308 wrote to memory of 1208 2308 oubtebeaf-uxor.exe 29 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21 PID 2308 wrote to memory of 1220 2308 oubtebeaf-uxor.exe 21
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:436
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\3fb0eedcdb68eacd5480ad026245c4f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3fb0eedcdb68eacd5480ad026245c4f0_NeikiAnalytics.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\SysWOW64\oubtebeaf-uxor.exe"C:\Windows\system32\oubtebeaf-uxor.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\SysWOW64\oubtebeaf-uxor.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1208
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
73KB
MD56ca7352cdf6197348d30109224a62c0a
SHA16b0d902c51a8077b7c3122eb534df83d623048bf
SHA256d5581f4bf4bc76eb38264c60942471ee86ffd662ea292c6022e08b993ead027f
SHA512a5754f2ff74df7f5f5877b93aa71e6a7b7fd69235794c763ba4c980608ccb66798d8abaeecbdac111e5740d7d63c43607dbf45086dbbec1898f3dc9ff1986b22
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
Filesize
72KB
MD50355b72f2ba565aaac88a6bd92d8a2bd
SHA113a0c9a391386fea4f880685dda80a5fd3e16dcf
SHA256696b79e91dc19f0f899f50e588c13f8d4a31f95c13e61e15640f9c7eec4ed46c
SHA512b54989a9aa97807f93d5a7a92f8f44e0b555f099a17ca1b7209c5fcfc028d11f308a5c1c5a5c7645ec5010b8b08613a61de4552290a23e9bd6ffe8598b2515fe
-
Filesize
70KB
MD53fb0eedcdb68eacd5480ad026245c4f0
SHA193f983ef3cf3f9627976a8709b2f3edb31f34bc9
SHA2560cd171ea8890ec5bcf722fff0e71d07501c06896f9f75a28a8d9ceb856fc7354
SHA51227c892ea21bd27fa7fd73d2cc13ddbc68038d3508fb84c6cf47b560fea51b679a37d7c829894f250fbd68dea55ea07eeefd4c0f3069bd21351b8febfcd743bc4