Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 05:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a458b75d41681c76f985eaf8584ca350_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
a458b75d41681c76f985eaf8584ca350_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
a458b75d41681c76f985eaf8584ca350_NeikiAnalytics.exe
-
Size
139KB
-
MD5
a458b75d41681c76f985eaf8584ca350
-
SHA1
bc6049d1b44c7461683f198e789a718830e9f86d
-
SHA256
5ecf2a075eb9f5c28425a599313e810bcc85dcff7ac21f1b8a1fdcbf37117c03
-
SHA512
c78256ed35f71440762d344c25a3220d5eb0a29111b8b37c9e72f4db0044ecace75500fe53f852179814e66c5ad4b12b71b9f667da2289d8e70a6b8c95fe9039
-
SSDEEP
1536:ofsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbCwwkG:oVqoCl/YgjxEufVU0TbTyDDalfG
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
Executes dropped EXE 4 IoCs
pid Process 3036 explorer.exe 2816 spoolsv.exe 3004 svchost.exe 2660 spoolsv.exe -
Loads dropped DLL 4 IoCs
pid Process 2936 a458b75d41681c76f985eaf8584ca350_NeikiAnalytics.exe 3036 explorer.exe 2816 spoolsv.exe 3004 svchost.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\themes\explorer.exe a458b75d41681c76f985eaf8584ca350_NeikiAnalytics.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2564 schtasks.exe 2180 schtasks.exe 2292 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2936 a458b75d41681c76f985eaf8584ca350_NeikiAnalytics.exe 2936 a458b75d41681c76f985eaf8584ca350_NeikiAnalytics.exe 2936 a458b75d41681c76f985eaf8584ca350_NeikiAnalytics.exe 2936 a458b75d41681c76f985eaf8584ca350_NeikiAnalytics.exe 2936 a458b75d41681c76f985eaf8584ca350_NeikiAnalytics.exe 2936 a458b75d41681c76f985eaf8584ca350_NeikiAnalytics.exe 2936 a458b75d41681c76f985eaf8584ca350_NeikiAnalytics.exe 2936 a458b75d41681c76f985eaf8584ca350_NeikiAnalytics.exe 2936 a458b75d41681c76f985eaf8584ca350_NeikiAnalytics.exe 2936 a458b75d41681c76f985eaf8584ca350_NeikiAnalytics.exe 2936 a458b75d41681c76f985eaf8584ca350_NeikiAnalytics.exe 2936 a458b75d41681c76f985eaf8584ca350_NeikiAnalytics.exe 2936 a458b75d41681c76f985eaf8584ca350_NeikiAnalytics.exe 2936 a458b75d41681c76f985eaf8584ca350_NeikiAnalytics.exe 2936 a458b75d41681c76f985eaf8584ca350_NeikiAnalytics.exe 2936 a458b75d41681c76f985eaf8584ca350_NeikiAnalytics.exe 2936 a458b75d41681c76f985eaf8584ca350_NeikiAnalytics.exe 3036 explorer.exe 3036 explorer.exe 3036 explorer.exe 3036 explorer.exe 3036 explorer.exe 3036 explorer.exe 3036 explorer.exe 3036 explorer.exe 3036 explorer.exe 3036 explorer.exe 3036 explorer.exe 3036 explorer.exe 3036 explorer.exe 3036 explorer.exe 3036 explorer.exe 3036 explorer.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3036 explorer.exe 3036 explorer.exe 3036 explorer.exe 3036 explorer.exe 3004 svchost.exe 3004 svchost.exe 3036 explorer.exe 3004 svchost.exe 3036 explorer.exe 3004 svchost.exe 3036 explorer.exe 3004 svchost.exe 3036 explorer.exe 3004 svchost.exe 3036 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 3036 explorer.exe 3004 svchost.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 2936 a458b75d41681c76f985eaf8584ca350_NeikiAnalytics.exe 2936 a458b75d41681c76f985eaf8584ca350_NeikiAnalytics.exe 3036 explorer.exe 3036 explorer.exe 2816 spoolsv.exe 2816 spoolsv.exe 3004 svchost.exe 3004 svchost.exe 2660 spoolsv.exe 2660 spoolsv.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2936 wrote to memory of 3036 2936 a458b75d41681c76f985eaf8584ca350_NeikiAnalytics.exe 28 PID 2936 wrote to memory of 3036 2936 a458b75d41681c76f985eaf8584ca350_NeikiAnalytics.exe 28 PID 2936 wrote to memory of 3036 2936 a458b75d41681c76f985eaf8584ca350_NeikiAnalytics.exe 28 PID 2936 wrote to memory of 3036 2936 a458b75d41681c76f985eaf8584ca350_NeikiAnalytics.exe 28 PID 3036 wrote to memory of 2816 3036 explorer.exe 29 PID 3036 wrote to memory of 2816 3036 explorer.exe 29 PID 3036 wrote to memory of 2816 3036 explorer.exe 29 PID 3036 wrote to memory of 2816 3036 explorer.exe 29 PID 2816 wrote to memory of 3004 2816 spoolsv.exe 30 PID 2816 wrote to memory of 3004 2816 spoolsv.exe 30 PID 2816 wrote to memory of 3004 2816 spoolsv.exe 30 PID 2816 wrote to memory of 3004 2816 spoolsv.exe 30 PID 3004 wrote to memory of 2660 3004 svchost.exe 31 PID 3004 wrote to memory of 2660 3004 svchost.exe 31 PID 3004 wrote to memory of 2660 3004 svchost.exe 31 PID 3004 wrote to memory of 2660 3004 svchost.exe 31 PID 3036 wrote to memory of 2724 3036 explorer.exe 32 PID 3036 wrote to memory of 2724 3036 explorer.exe 32 PID 3036 wrote to memory of 2724 3036 explorer.exe 32 PID 3036 wrote to memory of 2724 3036 explorer.exe 32 PID 3004 wrote to memory of 2564 3004 svchost.exe 33 PID 3004 wrote to memory of 2564 3004 svchost.exe 33 PID 3004 wrote to memory of 2564 3004 svchost.exe 33 PID 3004 wrote to memory of 2564 3004 svchost.exe 33 PID 3004 wrote to memory of 2180 3004 svchost.exe 38 PID 3004 wrote to memory of 2180 3004 svchost.exe 38 PID 3004 wrote to memory of 2180 3004 svchost.exe 38 PID 3004 wrote to memory of 2180 3004 svchost.exe 38 PID 3004 wrote to memory of 2292 3004 svchost.exe 40 PID 3004 wrote to memory of 2292 3004 svchost.exe 40 PID 3004 wrote to memory of 2292 3004 svchost.exe 40 PID 3004 wrote to memory of 2292 3004 svchost.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\a458b75d41681c76f985eaf8584ca350_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a458b75d41681c76f985eaf8584ca350_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2660
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 05:28 /f5⤵
- Creates scheduled task(s)
PID:2564
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 05:29 /f5⤵
- Creates scheduled task(s)
PID:2180
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 05:30 /f5⤵
- Creates scheduled task(s)
PID:2292
-
-
-
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe3⤵PID:2724
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
139KB
MD5eebe94d61bde08cd15984c17a8c0605a
SHA13e902540f26fd05c602b3421a1317b65867ec7e7
SHA2561c77e867cdb4492d258267e32a01a895e820275927bd8369244e199d7d73f3dd
SHA5120b788ca85f9c56067129d803b631f95c454633802d81aafa89e98b98a25201412d7837ba16e6c4d2d8920b8674dd1d43a545cb2c42c1b99783f2a855b3d45638
-
Filesize
139KB
MD54536a4d82d40a904c1855c54d1200adc
SHA1696c99c608de601eaf69f27f28d94ac4b1de193a
SHA256bf6edfce77718eec3406399fe10a724c86fe85cd249c195cfed96a16f24352c8
SHA51209e1af4d307bbdc5a139eedf40a8a8b9826ceb5132f2ac9d7e4cbf82e39a13ae2c049649bb85ebc62cf5c10119f3f2fe15ed3c1746006e78a2b8a06e14750edc
-
Filesize
139KB
MD587d4be0741d2cf3ac63be35c6025c4b3
SHA1931637dcb93f9ba41c6c281b067c7fbef7434433
SHA256a27c052656b88d22079e5e5494ab25d10d4d92435cd1d90869aed8c1af0cdecc
SHA512fdf61d241e8d2293ff7730b8cec2ff73edc615d8050061026f410786bbeeafc45634aaa0fc2246e61e24b529b0f5204025abb85c84c40d4cb4951f452abc7933