Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17/05/2024, 01:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7d7cbadcf82e04a6950be873fb5d1ed0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
7d7cbadcf82e04a6950be873fb5d1ed0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
7d7cbadcf82e04a6950be873fb5d1ed0_NeikiAnalytics.exe
-
Size
71KB
-
MD5
7d7cbadcf82e04a6950be873fb5d1ed0
-
SHA1
1b860101d252d3f67f44a09c1da67c921400dc88
-
SHA256
e2bd08d0e4c170b1c48f807227ceb06ed39816db99026aaeb70ee4ba037f621b
-
SHA512
04306b1ca3f5daf780e8a5bc929a3b2ac3c7bfa5bcea317bdc1f30ef6c88906400d59b28ce848a6fd891877c64db7f5253bcbf14e6062725dfc7b985d7efe9ed
-
SSDEEP
1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw85:Olg35GTslA5t3/w85
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" opkosoav.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" opkosoav.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" opkosoav.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" opkosoav.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4256524B-4950-5453-4256-524B49505453} opkosoav.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4256524B-4950-5453-4256-524B49505453}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" opkosoav.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4256524B-4950-5453-4256-524B49505453}\IsInstalled = "1" opkosoav.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4256524B-4950-5453-4256-524B49505453}\StubPath = "C:\\Windows\\system32\\ansixes.exe" opkosoav.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" opkosoav.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\xruput-utor.exe" opkosoav.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe opkosoav.exe -
Executes dropped EXE 2 IoCs
pid Process 3660 opkosoav.exe 1032 opkosoav.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" opkosoav.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" opkosoav.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" opkosoav.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" opkosoav.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" opkosoav.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\ixkunah.dll" opkosoav.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" opkosoav.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} opkosoav.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify opkosoav.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\ixkunah.dll opkosoav.exe File opened for modification C:\Windows\SysWOW64\opkosoav.exe opkosoav.exe File created C:\Windows\SysWOW64\opkosoav.exe 7d7cbadcf82e04a6950be873fb5d1ed0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\xruput-utor.exe opkosoav.exe File created C:\Windows\SysWOW64\xruput-utor.exe opkosoav.exe File opened for modification C:\Windows\SysWOW64\ansixes.exe opkosoav.exe File opened for modification C:\Windows\SysWOW64\ixkunah.dll opkosoav.exe File opened for modification C:\Windows\SysWOW64\opkosoav.exe 7d7cbadcf82e04a6950be873fb5d1ed0_NeikiAnalytics.exe File created C:\Windows\SysWOW64\ansixes.exe opkosoav.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 1032 opkosoav.exe 1032 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe 3660 opkosoav.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4216 7d7cbadcf82e04a6950be873fb5d1ed0_NeikiAnalytics.exe Token: SeDebugPrivilege 3660 opkosoav.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4216 wrote to memory of 3660 4216 7d7cbadcf82e04a6950be873fb5d1ed0_NeikiAnalytics.exe 82 PID 4216 wrote to memory of 3660 4216 7d7cbadcf82e04a6950be873fb5d1ed0_NeikiAnalytics.exe 82 PID 4216 wrote to memory of 3660 4216 7d7cbadcf82e04a6950be873fb5d1ed0_NeikiAnalytics.exe 82 PID 3660 wrote to memory of 612 3660 opkosoav.exe 5 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 1032 3660 opkosoav.exe 83 PID 3660 wrote to memory of 1032 3660 opkosoav.exe 83 PID 3660 wrote to memory of 1032 3660 opkosoav.exe 83 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56 PID 3660 wrote to memory of 3480 3660 opkosoav.exe 56
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:612
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\7d7cbadcf82e04a6950be873fb5d1ed0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7d7cbadcf82e04a6950be873fb5d1ed0_NeikiAnalytics.exe"2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Windows\SysWOW64\opkosoav.exe"C:\Windows\system32\opkosoav.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Windows\SysWOW64\opkosoav.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1032
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
73KB
MD5ad59961e0eb0c2a68189b0d78b179f3f
SHA1930ddbb2baa36f0fd37031a0b0802aadc6f14d69
SHA2569a67c72883e2439173d3b34d002e7dd8a331c7113d2f5330cad1f6e9fe923bcf
SHA512ca1a8674b1468ad6d965d48caae202f655d8664a8908afc6a1d13710b49ae51ba8063c1b18f79576445ece61d20afab96a34c87c8d0d89dcc6c36f3b5f6b1b14
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
Filesize
71KB
MD57d7cbadcf82e04a6950be873fb5d1ed0
SHA11b860101d252d3f67f44a09c1da67c921400dc88
SHA256e2bd08d0e4c170b1c48f807227ceb06ed39816db99026aaeb70ee4ba037f621b
SHA51204306b1ca3f5daf780e8a5bc929a3b2ac3c7bfa5bcea317bdc1f30ef6c88906400d59b28ce848a6fd891877c64db7f5253bcbf14e6062725dfc7b985d7efe9ed
-
Filesize
74KB
MD5a4ed4805fdca1808ed7e655a96d111f6
SHA17f7f2c31a97f95727578afe8c2bc00e8778642c9
SHA25663c276f8fe02bbcd41dda140933f6a355f07c98d80a83855be5d0a2ee8e34276
SHA512d21649d1e2be4a862b95422fadd1e5da58a5378f14fa6f1837d4dbc7bb18b2a68f4ab8c2097eaf2c65c510ad5ec06ad0474b53ab528a63cf3dddeb0688b75763