Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/05/2024, 10:07

General

  • Target

    e4390cae7f985e5a72256ae618d65970_NeikiAnalytics.exe

  • Size

    70KB

  • MD5

    e4390cae7f985e5a72256ae618d65970

  • SHA1

    911d346185d7db392f524dfb504454c209fb1447

  • SHA256

    747d8f5b11fdd96d46a6b4d6f9fc056796ee730fdd50fd345aa38f81cd8fd59a

  • SHA512

    242ce02a9267407473d19818b30a3fde5d394a49611c20586f06fe6139260ebc4c31d0d7f35ca4dd9c8a7d17c5d0f038627a6046b8466bff8288cdf4ffe6864a

  • SSDEEP

    1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8O:Olg35GTslA5t3/w8O

Malware Config

Signatures

  • Windows security bypass 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Sets file execution options in registry 2 TTPs 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Windows security modification 2 TTPs 4 IoCs
  • Modifies WinLogon 2 TTPs 5 IoCs
  • Drops file in System32 directory 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:616
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
        PID:3440
        • C:\Users\Admin\AppData\Local\Temp\e4390cae7f985e5a72256ae618d65970_NeikiAnalytics.exe
          "C:\Users\Admin\AppData\Local\Temp\e4390cae7f985e5a72256ae618d65970_NeikiAnalytics.exe"
          2⤵
          • Drops file in System32 directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2016
          • C:\Windows\SysWOW64\afneguf.exe
            "C:\Windows\system32\afneguf.exe"
            3⤵
            • Windows security bypass
            • Modifies Installed Components in the registry
            • Sets file execution options in registry
            • Executes dropped EXE
            • Windows security modification
            • Modifies WinLogon
            • Drops file in System32 directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1428
            • C:\Windows\SysWOW64\afneguf.exe
              --k33p
              4⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              PID:3432

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Windows\SysWOW64\afneguf.exe

        Filesize

        70KB

        MD5

        e4390cae7f985e5a72256ae618d65970

        SHA1

        911d346185d7db392f524dfb504454c209fb1447

        SHA256

        747d8f5b11fdd96d46a6b4d6f9fc056796ee730fdd50fd345aa38f81cd8fd59a

        SHA512

        242ce02a9267407473d19818b30a3fde5d394a49611c20586f06fe6139260ebc4c31d0d7f35ca4dd9c8a7d17c5d0f038627a6046b8466bff8288cdf4ffe6864a

      • C:\Windows\SysWOW64\ahxuban-odat.exe

        Filesize

        73KB

        MD5

        5bcdf244f31b4f977f9348d1871c4046

        SHA1

        3d5ff4b863169a2046ae24f0da333578ddeed334

        SHA256

        769b5248a34939a35695d884809b21f6773573823f8a43618993a370f438a963

        SHA512

        813fdfe7b87a7e1a2ad110f1a5cddfb0c209b85544b8e9e5182a7f67a41a8c89db808381c7bfe6b9c53d06dab8e9f585c94408f26a7dea24b8c7a595006ce8a6

      • C:\Windows\SysWOW64\ilpoohed-oudid.exe

        Filesize

        74KB

        MD5

        8512d4b0729845ef1cd1e622f95a2192

        SHA1

        534303ff78066842460c400e59cd5f3706e55c91

        SHA256

        59bc2e2940c345d659caccf55d411538f094565a65b5b7a1152954a1767038b1

        SHA512

        3e57e1a5ffcc88b7c0bb5f1464ffba8e94fd05e74a798eaddddbdfb9c4e450bda6171e5d25c039f3f1e2d04f87411037cebeaf338b81fd62bb2c3b3620c8ebd5

      • C:\Windows\SysWOW64\ukheanooh-axat.dll

        Filesize

        5KB

        MD5

        f37b21c00fd81bd93c89ce741a88f183

        SHA1

        b2796500597c68e2f5638e1101b46eaf32676c1c

        SHA256

        76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

        SHA512

        252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

      • memory/1428-49-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

      • memory/2016-5-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

      • memory/3432-50-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB