Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
16/05/2024, 14:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e18880947cb98f428ec7a5e44abe1800_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
e18880947cb98f428ec7a5e44abe1800_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
e18880947cb98f428ec7a5e44abe1800_NeikiAnalytics.exe
-
Size
71KB
-
MD5
e18880947cb98f428ec7a5e44abe1800
-
SHA1
93c30cd12e31b54613c9cf426f04fce45f73c30e
-
SHA256
7a504633012ecfac5e3cd46fccde6af87cf8899ae266619b774a7b68ec124e6c
-
SHA512
de40784a511fd07bd2420cc56f9a05f5e0e952649342545055ef192900c300ec1ee99f7dabdb922a8379bdd2cec3d76b021252ccabbc55cf88a87d451b972d7f
-
SSDEEP
1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slg:Olg35GTslA5t3/w8d
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" mpoomug.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" mpoomug.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" mpoomug.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" mpoomug.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{465A4258-4458-5541-465A-425844585541}\StubPath = "C:\\Windows\\system32\\orheabeam.exe" mpoomug.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{465A4258-4458-5541-465A-425844585541} mpoomug.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{465A4258-4458-5541-465A-425844585541}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" mpoomug.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{465A4258-4458-5541-465A-425844585541}\IsInstalled = "1" mpoomug.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe mpoomug.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" mpoomug.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\brooceak-ouvor.exe" mpoomug.exe -
Executes dropped EXE 2 IoCs
pid Process 1412 mpoomug.exe 4292 mpoomug.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" mpoomug.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" mpoomug.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" mpoomug.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" mpoomug.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" mpoomug.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} mpoomug.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify mpoomug.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" mpoomug.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\eadxedut.dll" mpoomug.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\mpoomug.exe e18880947cb98f428ec7a5e44abe1800_NeikiAnalytics.exe File created C:\Windows\SysWOW64\brooceak-ouvor.exe mpoomug.exe File opened for modification C:\Windows\SysWOW64\orheabeam.exe mpoomug.exe File created C:\Windows\SysWOW64\orheabeam.exe mpoomug.exe File created C:\Windows\SysWOW64\eadxedut.dll mpoomug.exe File opened for modification C:\Windows\SysWOW64\mpoomug.exe mpoomug.exe File created C:\Windows\SysWOW64\mpoomug.exe e18880947cb98f428ec7a5e44abe1800_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\brooceak-ouvor.exe mpoomug.exe File opened for modification C:\Windows\SysWOW64\eadxedut.dll mpoomug.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 4292 mpoomug.exe 4292 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe 1412 mpoomug.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2816 e18880947cb98f428ec7a5e44abe1800_NeikiAnalytics.exe Token: SeDebugPrivilege 1412 mpoomug.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2816 wrote to memory of 1412 2816 e18880947cb98f428ec7a5e44abe1800_NeikiAnalytics.exe 85 PID 2816 wrote to memory of 1412 2816 e18880947cb98f428ec7a5e44abe1800_NeikiAnalytics.exe 85 PID 2816 wrote to memory of 1412 2816 e18880947cb98f428ec7a5e44abe1800_NeikiAnalytics.exe 85 PID 1412 wrote to memory of 4292 1412 mpoomug.exe 86 PID 1412 wrote to memory of 4292 1412 mpoomug.exe 86 PID 1412 wrote to memory of 4292 1412 mpoomug.exe 86 PID 1412 wrote to memory of 620 1412 mpoomug.exe 5 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56 PID 1412 wrote to memory of 3420 1412 mpoomug.exe 56
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:620
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\e18880947cb98f428ec7a5e44abe1800_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e18880947cb98f428ec7a5e44abe1800_NeikiAnalytics.exe"2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\mpoomug.exe"C:\Windows\system32\mpoomug.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\SysWOW64\mpoomug.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4292
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74KB
MD5fb0b85bb18dfee1a6bbebdaa765b536b
SHA1cf69cdcf802e4ba304797cd185625ebbcfe27781
SHA2562ecb8b001ef3562f3d1ca645fde1b62f824d619724a7c824e5c5c759a49690e0
SHA512d1aa202d54da647a066cd672364820c42ac2b1c71c71bf162419d9b72f5046ee3f21f7b8c2f57fbde214498d0ef4bc71e4a7daa8fb156ec54486906af6976bb5
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
Filesize
71KB
MD5e18880947cb98f428ec7a5e44abe1800
SHA193c30cd12e31b54613c9cf426f04fce45f73c30e
SHA2567a504633012ecfac5e3cd46fccde6af87cf8899ae266619b774a7b68ec124e6c
SHA512de40784a511fd07bd2420cc56f9a05f5e0e952649342545055ef192900c300ec1ee99f7dabdb922a8379bdd2cec3d76b021252ccabbc55cf88a87d451b972d7f
-
Filesize
73KB
MD53ac287235e4e00b3f28ab24f9e4b044b
SHA19ff2655877baf1d1719878bd95c4bc62ec5a3106
SHA256e2c9c87b3c3477a857e93b797be7337691a9ec2f50aef0a78766b46e74a4a40a
SHA5121dbf79c0d6aaeb0458aca33f8154ecc4b7d1f5a8e92448992c07fa94588cd2dbe7dd73fbc3d782e28a3a5fff43a557de0d6e4d9a674de5e7997f2f38f40f7f25