Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 01:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6b0c30b4ee33491f5bc576dbe2bfd1c0_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
6b0c30b4ee33491f5bc576dbe2bfd1c0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
6b0c30b4ee33491f5bc576dbe2bfd1c0_NeikiAnalytics.exe
-
Size
130KB
-
MD5
6b0c30b4ee33491f5bc576dbe2bfd1c0
-
SHA1
c1a0b4bfce169ed0cbbfe6ce6ddd2edb5e73d155
-
SHA256
1f9615353a45cbd37fe0088014a7bb0a5f1512eb3a33e8581244435c93919d68
-
SHA512
fe33dd821ed1953c529bee4ac3b2b2c66dcda37c0b5bc90edca1643697067b316766b83cf0693350289c782a27e379e3f979be7fd441fccf53fe5ab7c4e09ec5
-
SSDEEP
3072:rqoCl/YgjxEufVU0TbTyDDal270FnJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJt:uLqdufVUNDalJJJJJJJJJJJJJJJJJJJb
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Executes dropped EXE 4 IoCs
pid Process 2372 explorer.exe 1420 spoolsv.exe 2580 svchost.exe 2608 spoolsv.exe -
Loads dropped DLL 8 IoCs
pid Process 2380 6b0c30b4ee33491f5bc576dbe2bfd1c0_NeikiAnalytics.exe 2380 6b0c30b4ee33491f5bc576dbe2bfd1c0_NeikiAnalytics.exe 2372 explorer.exe 2372 explorer.exe 1420 spoolsv.exe 1420 spoolsv.exe 2580 svchost.exe 2580 svchost.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\themes\explorer.exe 6b0c30b4ee33491f5bc576dbe2bfd1c0_NeikiAnalytics.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 696 schtasks.exe 2588 schtasks.exe 2804 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2380 6b0c30b4ee33491f5bc576dbe2bfd1c0_NeikiAnalytics.exe 2380 6b0c30b4ee33491f5bc576dbe2bfd1c0_NeikiAnalytics.exe 2380 6b0c30b4ee33491f5bc576dbe2bfd1c0_NeikiAnalytics.exe 2380 6b0c30b4ee33491f5bc576dbe2bfd1c0_NeikiAnalytics.exe 2380 6b0c30b4ee33491f5bc576dbe2bfd1c0_NeikiAnalytics.exe 2380 6b0c30b4ee33491f5bc576dbe2bfd1c0_NeikiAnalytics.exe 2380 6b0c30b4ee33491f5bc576dbe2bfd1c0_NeikiAnalytics.exe 2380 6b0c30b4ee33491f5bc576dbe2bfd1c0_NeikiAnalytics.exe 2380 6b0c30b4ee33491f5bc576dbe2bfd1c0_NeikiAnalytics.exe 2380 6b0c30b4ee33491f5bc576dbe2bfd1c0_NeikiAnalytics.exe 2380 6b0c30b4ee33491f5bc576dbe2bfd1c0_NeikiAnalytics.exe 2380 6b0c30b4ee33491f5bc576dbe2bfd1c0_NeikiAnalytics.exe 2380 6b0c30b4ee33491f5bc576dbe2bfd1c0_NeikiAnalytics.exe 2380 6b0c30b4ee33491f5bc576dbe2bfd1c0_NeikiAnalytics.exe 2380 6b0c30b4ee33491f5bc576dbe2bfd1c0_NeikiAnalytics.exe 2380 6b0c30b4ee33491f5bc576dbe2bfd1c0_NeikiAnalytics.exe 2380 6b0c30b4ee33491f5bc576dbe2bfd1c0_NeikiAnalytics.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2580 svchost.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2372 explorer.exe 2580 svchost.exe 2580 svchost.exe 2372 explorer.exe 2580 svchost.exe 2372 explorer.exe 2580 svchost.exe 2372 explorer.exe 2580 svchost.exe 2372 explorer.exe 2580 svchost.exe 2372 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2372 explorer.exe 2580 svchost.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 2380 6b0c30b4ee33491f5bc576dbe2bfd1c0_NeikiAnalytics.exe 2380 6b0c30b4ee33491f5bc576dbe2bfd1c0_NeikiAnalytics.exe 2372 explorer.exe 2372 explorer.exe 1420 spoolsv.exe 1420 spoolsv.exe 2580 svchost.exe 2580 svchost.exe 2608 spoolsv.exe 2608 spoolsv.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2380 wrote to memory of 2372 2380 6b0c30b4ee33491f5bc576dbe2bfd1c0_NeikiAnalytics.exe 28 PID 2380 wrote to memory of 2372 2380 6b0c30b4ee33491f5bc576dbe2bfd1c0_NeikiAnalytics.exe 28 PID 2380 wrote to memory of 2372 2380 6b0c30b4ee33491f5bc576dbe2bfd1c0_NeikiAnalytics.exe 28 PID 2380 wrote to memory of 2372 2380 6b0c30b4ee33491f5bc576dbe2bfd1c0_NeikiAnalytics.exe 28 PID 2372 wrote to memory of 1420 2372 explorer.exe 29 PID 2372 wrote to memory of 1420 2372 explorer.exe 29 PID 2372 wrote to memory of 1420 2372 explorer.exe 29 PID 2372 wrote to memory of 1420 2372 explorer.exe 29 PID 1420 wrote to memory of 2580 1420 spoolsv.exe 30 PID 1420 wrote to memory of 2580 1420 spoolsv.exe 30 PID 1420 wrote to memory of 2580 1420 spoolsv.exe 30 PID 1420 wrote to memory of 2580 1420 spoolsv.exe 30 PID 2580 wrote to memory of 2608 2580 svchost.exe 31 PID 2580 wrote to memory of 2608 2580 svchost.exe 31 PID 2580 wrote to memory of 2608 2580 svchost.exe 31 PID 2580 wrote to memory of 2608 2580 svchost.exe 31 PID 2372 wrote to memory of 2724 2372 explorer.exe 32 PID 2372 wrote to memory of 2724 2372 explorer.exe 32 PID 2372 wrote to memory of 2724 2372 explorer.exe 32 PID 2372 wrote to memory of 2724 2372 explorer.exe 32 PID 2580 wrote to memory of 2588 2580 svchost.exe 33 PID 2580 wrote to memory of 2588 2580 svchost.exe 33 PID 2580 wrote to memory of 2588 2580 svchost.exe 33 PID 2580 wrote to memory of 2588 2580 svchost.exe 33 PID 2580 wrote to memory of 2804 2580 svchost.exe 38 PID 2580 wrote to memory of 2804 2580 svchost.exe 38 PID 2580 wrote to memory of 2804 2580 svchost.exe 38 PID 2580 wrote to memory of 2804 2580 svchost.exe 38 PID 2580 wrote to memory of 696 2580 svchost.exe 40 PID 2580 wrote to memory of 696 2580 svchost.exe 40 PID 2580 wrote to memory of 696 2580 svchost.exe 40 PID 2580 wrote to memory of 696 2580 svchost.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b0c30b4ee33491f5bc576dbe2bfd1c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6b0c30b4ee33491f5bc576dbe2bfd1c0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1420 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2608
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 01:02 /f5⤵
- Creates scheduled task(s)
PID:2588
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 01:03 /f5⤵
- Creates scheduled task(s)
PID:2804
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 01:04 /f5⤵
- Creates scheduled task(s)
PID:696
-
-
-
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe3⤵PID:2724
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
130KB
MD5f7168e8ebef82f199a6ac54b5925a685
SHA1108d18ef012fbcaf82ba043c599b01590d8f616e
SHA256256894cb131f59606306db478f497d85a8527295f378173f432f979529be15a5
SHA512fd2f3f8ddedcf8c338b8de78d1231d5aa1b36eaf1650170eacdbe783d89497e05ca151f2cdd82b8547d7ab601c5a79a19106e03d487a4f9bc1013ee98427d96a
-
Filesize
130KB
MD580c333fb544152ca614c0505505f2454
SHA166cf0915b9c2f37ce31421714126907d6b525a2d
SHA25652cb9b0b7aebc1f4de0c0dcf0f7d42e683e71adef6fdc55ab1cedfb09a3eb9fc
SHA51257461cf102a361ee38e8ec8be97e00c2a05d5ebb37487ef86ff451511ee13e75a2db21d90ca831316ba8f17a5edd040cc506df71c155a0b2852b929fbe22e487
-
Filesize
130KB
MD565489fa8141f11e51020bb6520d47167
SHA1dd5e766d387ae0ce6ad2e1cf6875de9d1474502f
SHA256f5675f41f9d4040cd5bc2d82979e59ab2cedc72146873634ec8f082917bd796a
SHA512ee658d4ada137484b0e6d84794f429841a3f59aeaa2ca596a718fb208741740e2e5cdf0d97ff06598c0f5051dd46aa4cd50ce436d8625f6d9772e332d1042801