Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 12:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ddf68eb8b43083d5c73cb4bf83588010_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
ddf68eb8b43083d5c73cb4bf83588010_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
ddf68eb8b43083d5c73cb4bf83588010_NeikiAnalytics.exe
-
Size
73KB
-
MD5
ddf68eb8b43083d5c73cb4bf83588010
-
SHA1
229506706f725c0321953c965506a5858d770d89
-
SHA256
a7a9058af09c47c5396bec8f7b51c90d82c0882f64ec4a8be3b785637fd21f9e
-
SHA512
6bfb96246f0bc88c69d3713fe1232360c92c8b0549b719d1db556c09ae51ba51f85f40a53488407c731730a5cfbe82f18a5c48f48544e1e84b18714b8113c26d
-
SSDEEP
1536:xE52iwhqb1tqObPvZkcUbSpx7/wteyNjBPp:20PhqZ/TvZtYSXceK1Pp
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" odsoocov-ucum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" odsoocov-ucum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" odsoocov-ucum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" odsoocov-ucum.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4249534D-495a-4858-4249-534D495A4858} odsoocov-ucum.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4249534D-495a-4858-4249-534D495A4858}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" odsoocov-ucum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4249534D-495a-4858-4249-534D495A4858}\IsInstalled = "1" odsoocov-ucum.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4249534D-495a-4858-4249-534D495A4858}\StubPath = "C:\\Windows\\system32\\ufxoanar.exe" odsoocov-ucum.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe odsoocov-ucum.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" odsoocov-ucum.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\urxoapar-adoab.exe" odsoocov-ucum.exe -
Executes dropped EXE 2 IoCs
pid Process 1120 odsoocov-ucum.exe 2608 odsoocov-ucum.exe -
Loads dropped DLL 3 IoCs
pid Process 1640 ddf68eb8b43083d5c73cb4bf83588010_NeikiAnalytics.exe 1640 ddf68eb8b43083d5c73cb4bf83588010_NeikiAnalytics.exe 1120 odsoocov-ucum.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" odsoocov-ucum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" odsoocov-ucum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" odsoocov-ucum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" odsoocov-ucum.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} odsoocov-ucum.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify odsoocov-ucum.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" odsoocov-ucum.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\irkepead.dll" odsoocov-ucum.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" odsoocov-ucum.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\urxoapar-adoab.exe odsoocov-ucum.exe File opened for modification C:\Windows\SysWOW64\ufxoanar.exe odsoocov-ucum.exe File created C:\Windows\SysWOW64\ufxoanar.exe odsoocov-ucum.exe File opened for modification C:\Windows\SysWOW64\irkepead.dll odsoocov-ucum.exe File opened for modification C:\Windows\SysWOW64\odsoocov-ucum.exe ddf68eb8b43083d5c73cb4bf83588010_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\urxoapar-adoab.exe odsoocov-ucum.exe File opened for modification C:\Windows\SysWOW64\odsoocov-ucum.exe odsoocov-ucum.exe File created C:\Windows\SysWOW64\odsoocov-ucum.exe ddf68eb8b43083d5c73cb4bf83588010_NeikiAnalytics.exe File created C:\Windows\SysWOW64\irkepead.dll odsoocov-ucum.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 2608 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe 1120 odsoocov-ucum.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1120 odsoocov-ucum.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1640 wrote to memory of 1120 1640 ddf68eb8b43083d5c73cb4bf83588010_NeikiAnalytics.exe 28 PID 1640 wrote to memory of 1120 1640 ddf68eb8b43083d5c73cb4bf83588010_NeikiAnalytics.exe 28 PID 1640 wrote to memory of 1120 1640 ddf68eb8b43083d5c73cb4bf83588010_NeikiAnalytics.exe 28 PID 1640 wrote to memory of 1120 1640 ddf68eb8b43083d5c73cb4bf83588010_NeikiAnalytics.exe 28 PID 1120 wrote to memory of 436 1120 odsoocov-ucum.exe 5 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 2608 1120 odsoocov-ucum.exe 29 PID 1120 wrote to memory of 2608 1120 odsoocov-ucum.exe 29 PID 1120 wrote to memory of 2608 1120 odsoocov-ucum.exe 29 PID 1120 wrote to memory of 2608 1120 odsoocov-ucum.exe 29 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20 PID 1120 wrote to memory of 1124 1120 odsoocov-ucum.exe 20
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:436
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\ddf68eb8b43083d5c73cb4bf83588010_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ddf68eb8b43083d5c73cb4bf83588010_NeikiAnalytics.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\SysWOW64\odsoocov-ucum.exe"C:\Windows\SysWOW64\odsoocov-ucum.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\SysWOW64\odsoocov-ucum.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2608
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
Filesize
73KB
MD5e25de5b9f23fdb84cb698f3a24e8e841
SHA1343388dd3c1f274b7ea2a43d3ec7bb6ee94fb79b
SHA256f13d308b51a3cd98aa43d9f0595bc559011eddc591633ab7f4f9b835f9c99c00
SHA512c0baadcda1bc3943cb80272bbccc45d03ada733e863cd6089d1b374bc7c0d434f8a01ed45b5b189225d5c4424bae2a5f473e00b6a3aa352508b2ebd77ef23085
-
Filesize
74KB
MD592c19fb3d15371329617e69015bf5f6b
SHA1a469b4e68c1b1e37fa569b2c4ad0c9a80b42ba28
SHA2566fff1b1d0925f06bad895ef528777885cd4712bd50d37c6655928ffbeda47a57
SHA5129205896a2b0748909e2bb3f9b2667766aea01ef1b7a25f91aa2b4e4de5b231df73c252dbb711a3e7255446c4551b2ac7d633a03c96671fdde28dfcc89945e60a
-
Filesize
71KB
MD5ce1e0b6527d00b1c641d54752bb39f2f
SHA18d2ad1f52ed781298ff9676714adf91bfc21e229
SHA2565336e7bbe6dada253b053b3f3906dea9a9d12fe5541d6afbe062efec3e650d9b
SHA5121100a52c9d4aa961c8722fbb0bb57cff0f29469d8ee733e344a502a0b37f51924c4bae4b122b299bb4c00b13e4769e2a15174e28b38ecdd4fc72ae818036f356