Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
17/05/2024, 04:01
Behavioral task
behavioral1
Sample
a1e061d688293d8a2f85cb1b0bd9bd40_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
a1e061d688293d8a2f85cb1b0bd9bd40_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
a1e061d688293d8a2f85cb1b0bd9bd40_NeikiAnalytics.exe
-
Size
161KB
-
MD5
a1e061d688293d8a2f85cb1b0bd9bd40
-
SHA1
775b00762bc15704a40d3a0f4bede4c35de1b6cc
-
SHA256
cc09d3a8431472866869eaabff7d0646f5298ea0546534c0a7332786baceeea3
-
SHA512
d1d9563873203a922203eeaa3d4544c14f3df94ebe8183ea5760dc81e9224edbe6abe6937dcc35010a4d7ffcc3675133f012e0313369a22bc916a96850206eda
-
SSDEEP
3072:X5SVkkgUWib1UC7AdYzrV+Dljy/32ubwZZqJ:EUquCkdYzrVolu/J0ZZ
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 1212 WindowsService.exe 2696 WindowsService.exe 780 WindowsService.exe -
Loads dropped DLL 5 IoCs
pid Process 2732 a1e061d688293d8a2f85cb1b0bd9bd40_NeikiAnalytics.exe 2732 a1e061d688293d8a2f85cb1b0bd9bd40_NeikiAnalytics.exe 2732 a1e061d688293d8a2f85cb1b0bd9bd40_NeikiAnalytics.exe 2732 a1e061d688293d8a2f85cb1b0bd9bd40_NeikiAnalytics.exe 2732 a1e061d688293d8a2f85cb1b0bd9bd40_NeikiAnalytics.exe -
resource yara_rule behavioral1/memory/2436-0-0x0000000000400000-0x000000000043C000-memory.dmp upx behavioral1/memory/2436-165-0x0000000000400000-0x000000000043C000-memory.dmp upx behavioral1/memory/2732-447-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2436-448-0x0000000000400000-0x000000000043C000-memory.dmp upx behavioral1/files/0x003a000000015cc7-473.dat upx behavioral1/memory/1212-492-0x0000000000400000-0x000000000043C000-memory.dmp upx behavioral1/memory/2732-1044-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1212-1041-0x0000000000400000-0x000000000043C000-memory.dmp upx behavioral1/memory/2696-1029-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2696-1049-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sidebar = "C:\\Users\\Admin\\AppData\\Roaming\\SystemWindows\\WindowsService.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2436 set thread context of 2732 2436 a1e061d688293d8a2f85cb1b0bd9bd40_NeikiAnalytics.exe 28 PID 1212 set thread context of 2696 1212 WindowsService.exe 33 PID 1212 set thread context of 780 1212 WindowsService.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe Token: SeDebugPrivilege 2696 WindowsService.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2436 a1e061d688293d8a2f85cb1b0bd9bd40_NeikiAnalytics.exe 2732 a1e061d688293d8a2f85cb1b0bd9bd40_NeikiAnalytics.exe 1212 WindowsService.exe 2696 WindowsService.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 2436 wrote to memory of 2732 2436 a1e061d688293d8a2f85cb1b0bd9bd40_NeikiAnalytics.exe 28 PID 2436 wrote to memory of 2732 2436 a1e061d688293d8a2f85cb1b0bd9bd40_NeikiAnalytics.exe 28 PID 2436 wrote to memory of 2732 2436 a1e061d688293d8a2f85cb1b0bd9bd40_NeikiAnalytics.exe 28 PID 2436 wrote to memory of 2732 2436 a1e061d688293d8a2f85cb1b0bd9bd40_NeikiAnalytics.exe 28 PID 2436 wrote to memory of 2732 2436 a1e061d688293d8a2f85cb1b0bd9bd40_NeikiAnalytics.exe 28 PID 2436 wrote to memory of 2732 2436 a1e061d688293d8a2f85cb1b0bd9bd40_NeikiAnalytics.exe 28 PID 2436 wrote to memory of 2732 2436 a1e061d688293d8a2f85cb1b0bd9bd40_NeikiAnalytics.exe 28 PID 2436 wrote to memory of 2732 2436 a1e061d688293d8a2f85cb1b0bd9bd40_NeikiAnalytics.exe 28 PID 2732 wrote to memory of 1316 2732 a1e061d688293d8a2f85cb1b0bd9bd40_NeikiAnalytics.exe 29 PID 2732 wrote to memory of 1316 2732 a1e061d688293d8a2f85cb1b0bd9bd40_NeikiAnalytics.exe 29 PID 2732 wrote to memory of 1316 2732 a1e061d688293d8a2f85cb1b0bd9bd40_NeikiAnalytics.exe 29 PID 2732 wrote to memory of 1316 2732 a1e061d688293d8a2f85cb1b0bd9bd40_NeikiAnalytics.exe 29 PID 1316 wrote to memory of 2564 1316 cmd.exe 31 PID 1316 wrote to memory of 2564 1316 cmd.exe 31 PID 1316 wrote to memory of 2564 1316 cmd.exe 31 PID 1316 wrote to memory of 2564 1316 cmd.exe 31 PID 2732 wrote to memory of 1212 2732 a1e061d688293d8a2f85cb1b0bd9bd40_NeikiAnalytics.exe 32 PID 2732 wrote to memory of 1212 2732 a1e061d688293d8a2f85cb1b0bd9bd40_NeikiAnalytics.exe 32 PID 2732 wrote to memory of 1212 2732 a1e061d688293d8a2f85cb1b0bd9bd40_NeikiAnalytics.exe 32 PID 2732 wrote to memory of 1212 2732 a1e061d688293d8a2f85cb1b0bd9bd40_NeikiAnalytics.exe 32 PID 1212 wrote to memory of 2696 1212 WindowsService.exe 33 PID 1212 wrote to memory of 2696 1212 WindowsService.exe 33 PID 1212 wrote to memory of 2696 1212 WindowsService.exe 33 PID 1212 wrote to memory of 2696 1212 WindowsService.exe 33 PID 1212 wrote to memory of 2696 1212 WindowsService.exe 33 PID 1212 wrote to memory of 2696 1212 WindowsService.exe 33 PID 1212 wrote to memory of 2696 1212 WindowsService.exe 33 PID 1212 wrote to memory of 2696 1212 WindowsService.exe 33 PID 1212 wrote to memory of 780 1212 WindowsService.exe 34 PID 1212 wrote to memory of 780 1212 WindowsService.exe 34 PID 1212 wrote to memory of 780 1212 WindowsService.exe 34 PID 1212 wrote to memory of 780 1212 WindowsService.exe 34 PID 1212 wrote to memory of 780 1212 WindowsService.exe 34 PID 1212 wrote to memory of 780 1212 WindowsService.exe 34 PID 1212 wrote to memory of 780 1212 WindowsService.exe 34 PID 1212 wrote to memory of 780 1212 WindowsService.exe 34 PID 1212 wrote to memory of 780 1212 WindowsService.exe 34 PID 1212 wrote to memory of 780 1212 WindowsService.exe 34 PID 1212 wrote to memory of 780 1212 WindowsService.exe 34 PID 1212 wrote to memory of 780 1212 WindowsService.exe 34 PID 1212 wrote to memory of 780 1212 WindowsService.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1e061d688293d8a2f85cb1b0bd9bd40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a1e061d688293d8a2f85cb1b0bd9bd40_NeikiAnalytics.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\a1e061d688293d8a2f85cb1b0bd9bd40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a1e061d688293d8a2f85cb1b0bd9bd40_NeikiAnalytics.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\CQPBK.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "sidebar" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe" /f4⤵
- Adds Run key to start application
PID:2564
-
-
-
C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2696
-
-
C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"4⤵
- Executes dropped EXE
PID:780
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
157B
MD5f6a90c20834f271a907a4e2bc28184c2
SHA136c9d1602b74f622346fbb22693597d7889df48d
SHA25673f29cd953eee40cea4de67842556ffd96efe8094a6a9b70f33a35df2582febd
SHA51239cabae19fe1faa37455e4bd242c868be60d6252b07f01224b3f7501c3cf734e503300b840d83381a452707cab6df2f95f920655884be56d4024676b26943804
-
Filesize
161KB
MD5c9fd4877ed22dcc01d82539202738529
SHA1e67762f261e0fffbaf7c211f24eb1f614cb765ff
SHA2567b3a901f7014f5853decde46a9186137e39c6ceb335d47c875fce891e8f5b07b
SHA512b9b2fdaf3abae0ff1d14c111a7a35f8195c6bbe595303ff3d707c4194aefe3aabc9a82addcf5208458743c29d2c07c117436bb877f9488941eb54853b0c4e7c1