Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

2fe1f7f748...cs.exe

windows7-x64

7

2fe1f7f748...cs.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    19/05/2024, 20:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2fe1f7f7483896f0544b19dfe7969490_NeikiAnalytics.exe

  • Size

    191KB

  • MD5

    2fe1f7f7483896f0544b19dfe7969490

  • SHA1

    a2e8211d41017453a6e7623af36d26019692d402

  • SHA256

    b186f549a48bf83d51b27e3ca265d31f6a46a4e1d91a0cac0b5bc867c06e39bb

  • SHA512

    e23f44e8b6f73f0acbe86b87039c8ef86bb118d7ca3402f4494ace74d520c5ffc9de3059f9494e324cac980b3162f87cdce6dbae2dc38044475cdacecb2b85cb

  • SSDEEP

    3072:2AKEsYqqjfipJWYpWJZfGXFxUYyaJC6sOMD5Qjj9jRMKSlJ8subptbbG+X:NKE+qjfipJWYpWJZfGXFRJJRsOM9+j5L

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 9 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 12 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2fe1f7f7483896f0544b19dfe7969490_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\2fe1f7f7483896f0544b19dfe7969490_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • Maps connected drives based on registry
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2228
    • C:\ProgramData\UserRuntime\cwrss.exe
      "C:\ProgramData\UserRuntime\cwrss.exe" 1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates connected drives
      • Maps connected drives based on registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:876
      • C:\Users\Admin\AppData\Roaming\UserRuntime\cwrss.exe
        "C:\Users\Admin\AppData\Roaming\UserRuntime\cwrss.exe" 1
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:1164
    • C:\ProgramData\UserRuntime\cwrss.exe
      "C:\ProgramData\UserRuntime\cwrss.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates connected drives
      • Maps connected drives based on registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1636
      • C:\ProgramData\UserRuntime\cwrss.exe
        "C:\ProgramData\UserRuntime\cwrss.exe" 1
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1956
        • C:\Users\Admin\AppData\Roaming\UserRuntime\cwrss.exe
          "C:\Users\Admin\AppData\Roaming\UserRuntime\cwrss.exe" 1
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          PID:1984

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\UserRuntime\cwrss.exe
    Filesize

    191KB

    MD5

    2a16afe9499b50f75b3968e77653945d

    SHA1

    1501ca113f6330b321b64f40916ff8c9f16677e5

    SHA256

    7528a744c62fc3952a08cb41b89a64e523d3c6ced3a6796fc75fc0e9b02ba3f1

    SHA512

    ad91f19f97b49a26b10afdbe3664e3ce9097f235f3b13f9ee9971ddf14627ba7ed7aac806186329a5d188a87e438e1826966bb3ee70de03ea1f1d6c5bc85b4b1

    Download Submit

  • C:\Users\Admin\AppData\Roaming\UserRuntime\cwrss.exe
    Filesize

    191KB

    MD5

    9f3f7b63f4f2c0705c4a4d5e947b1867

    SHA1

    f30cec51afd35730e56306a575f16ca71e9e9f1b

    SHA256

    39d48da70b94df76e72a55af1a6d31a783f523f78fca2968b63feeb5abe167a4

    SHA512

    84ac237e3c7cc8827bbc7abb1faaf28cde1ebaa9256d8a9f957c76e8c500648a88dc2e8eee04f729df7b5f2f1f75154915ff4c8f8e4fd2b523bf3cb34639c631

    Download Submit