Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/05/2024, 13:40

General

  • Target

    e0f5eeca391f562e9b47684478f8fe70_NeikiAnalytics.exe

  • Size

    91KB

  • MD5

    e0f5eeca391f562e9b47684478f8fe70

  • SHA1

    b9d651efa29afe6e1ff5969abbaea4771befc774

  • SHA256

    4f4cb7610809fa4eaefa419a1ee6a90d07ed4ea911cc27a05b81561d6c253551

  • SHA512

    bc41f0318f9356d75f6d9e8af33ab0c352e4e572aae99222091965ceafc241103b30941f1a73e7ae8fedea9cd937405a672b3f5e6761cc8140594b1ab1c40429

  • SSDEEP

    768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3Imu73gRYjXbUeHORIC4Zk:uT3OA3+KQsxfS4GT3OA3+KQsxfS45W

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Disables RegEdit via registry modification 2 IoCs
  • Disables use of System Restore points 1 TTPs
  • Executes dropped EXE 7 IoCs
  • Modifies system executable filetype association 2 TTPs 13 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Drops file in System32 directory 6 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies Control Panel 4 IoCs
  • Modifies registry class 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • System policy modification 1 TTPs 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e0f5eeca391f562e9b47684478f8fe70_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\e0f5eeca391f562e9b47684478f8fe70_NeikiAnalytics.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4036
    • C:\Windows\xk.exe
      C:\Windows\xk.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:3688
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:1868
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:2512
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:2408
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:4256
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:4352
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:4556

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE

    Filesize

    91KB

    MD5

    8635edd6cb22d0fbeb5d583e5adcb6ec

    SHA1

    98258d1f64cd622c25c17cd65847fee9e5b61e99

    SHA256

    3252dea7b96d310b04bed50c951a9288ba955b40e537108f1727db05d2d50be3

    SHA512

    8df5463263ac360e60d29c48bf2726cb56b749a2368a8a512c990815ac3c209d5737a0d9a921357a6aef96d8b3641e33827c1efa9a041b626bbe8dcdf9950e55

  • C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE

    Filesize

    91KB

    MD5

    eb2b55dc782b668a649d30b62e707966

    SHA1

    c6f6127a46d57a1d2f35c969dbaec892bc0f4d78

    SHA256

    6370d1e4784fe201ea9555f39b5529d7dce660e600e70a94978a1933e3001c8a

    SHA512

    f009b9bad3d31deacb12148a286224b2c82f418cfa971e45213e86b00eaf5f36f8ea5a9f1e68a400a3d08fdc6189b00300bc000fe9f69f579ea1f40b48dca0fe

  • C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

    Filesize

    91KB

    MD5

    02e5a21d7d44584401e7055759efcaee

    SHA1

    e43ef8981ee396f8f040c5b9e593e39a774f40df

    SHA256

    6fd505188a0e34f80f6d6889689af59070b91d3af1474e28fdc7b9ebf0f79726

    SHA512

    848eaba8868df43c94141274e596a4d19f36b2b8b60056b34fc425cb7526f51abdb1587d6e4e4cc515ee3cf97b8f7676148cefc6f2e7e5579fef4f035308b8ec

  • C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE

    Filesize

    91KB

    MD5

    765f0d86257b1a1eea797e1b0a0233a4

    SHA1

    53e9160dbeedf3cf794162764724284aea77a022

    SHA256

    d86510c57048743ed63e303c2a3d30d4b9e0f4ef949cd38f8c85ecbe11b1138f

    SHA512

    33f1658634b0ca06a59973659135271f6a981b5208c9cf74bdd7ae4c8083b798263dd64818b0afdc82ef42a2c780349b0937d7bf5c803cc55ee69a7534b974ab

  • C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

    Filesize

    91KB

    MD5

    5f503d179195336896818b9ef1e71c8a

    SHA1

    1236d2ba1f51c1289a1b7f82e1fb4bd549dfa0cd

    SHA256

    5e9e58d13519e94a197871e5475a85c1eb3ed0e273e6606f4fe5227a4c3e74c5

    SHA512

    1332f608a971079277127239073fcc2ed6742358c64f2bc2f18f1bb15d75fdc27a2add4c0da08791b75b0c1e2ce7f48f2e31d947a06aff2e55dfb5c640435f8e

  • C:\Users\Admin\AppData\Local\winlogon.exe

    Filesize

    91KB

    MD5

    e0f5eeca391f562e9b47684478f8fe70

    SHA1

    b9d651efa29afe6e1ff5969abbaea4771befc774

    SHA256

    4f4cb7610809fa4eaefa419a1ee6a90d07ed4ea911cc27a05b81561d6c253551

    SHA512

    bc41f0318f9356d75f6d9e8af33ab0c352e4e572aae99222091965ceafc241103b30941f1a73e7ae8fedea9cd937405a672b3f5e6761cc8140594b1ab1c40429

  • C:\Windows\SysWOW64\IExplorer.exe

    Filesize

    91KB

    MD5

    74dfa6f60082a52f1b679c84d648d083

    SHA1

    73fa2476d936834a2616a7c9c14978e73ac6f296

    SHA256

    aa63d475ae202a15dfc02ae00a1255b5968a1e863b6510fb19f5abc050fd0311

    SHA512

    8814b9b548ed595e2b89efa03cf859143f965625d3db8ab3e26da4822716aa961c9cdc9214ab3be7f3dcd9ce06710601b9d9b745df6f7489173b4fb123d6affa

  • C:\Windows\xk.exe

    Filesize

    91KB

    MD5

    84ab13f748ba4c72810b73ad03b904bf

    SHA1

    2d33bc1f6b237e4e0cb884c71d49e8952d1da5b4

    SHA256

    74c392cf68d684fba3cfe5adfbcd53bff656a6563b77a3377dd1622773d74de2

    SHA512

    41e6714f03c35e801ef6b2363b650c22249f58eaea9359a2dbc7a6344adfc4848741f30a18504c1988fede67fae80a7e9f635a607ebf8b67e0da538464f84e15

  • memory/1868-131-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/1868-124-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/1868-125-0x00000000759F0000-0x0000000075B4D000-memory.dmp

    Filesize

    1.4MB

  • memory/2408-142-0x00000000759F0000-0x0000000075B4D000-memory.dmp

    Filesize

    1.4MB

  • memory/2408-147-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/2512-138-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/2512-134-0x00000000759F0000-0x0000000075B4D000-memory.dmp

    Filesize

    1.4MB

  • memory/3688-112-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/3688-113-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/3688-114-0x00000000759F0000-0x0000000075B4D000-memory.dmp

    Filesize

    1.4MB

  • memory/3688-116-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/3688-120-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/4036-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

    Filesize

    16KB

  • memory/4036-0-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/4036-4-0x0000000000401000-0x0000000000427000-memory.dmp

    Filesize

    152KB

  • memory/4036-150-0x0000000000401000-0x0000000000427000-memory.dmp

    Filesize

    152KB

  • memory/4036-2-0x00000000759F0000-0x0000000075B4D000-memory.dmp

    Filesize

    1.4MB

  • memory/4036-176-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/4036-177-0x0000000000401000-0x0000000000427000-memory.dmp

    Filesize

    152KB

  • memory/4036-3-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/4256-152-0x00000000759F0000-0x0000000075B4D000-memory.dmp

    Filesize

    1.4MB

  • memory/4256-157-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/4256-156-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/4352-166-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/4352-161-0x00000000759F0000-0x0000000075B4D000-memory.dmp

    Filesize

    1.4MB

  • memory/4556-170-0x00000000759F0000-0x0000000075B4D000-memory.dmp

    Filesize

    1.4MB

  • memory/4556-175-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB