Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 10:48
Static task
static1
Behavioral task
behavioral1
Sample
ec8be5cdde4517148643db5db9e369e0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
ec8be5cdde4517148643db5db9e369e0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
ec8be5cdde4517148643db5db9e369e0_NeikiAnalytics.exe
-
Size
1.2MB
-
MD5
ec8be5cdde4517148643db5db9e369e0
-
SHA1
be7ac26962777255857076071c2ccbf08fdebaac
-
SHA256
089466f082e5ee62814b7c80ff414da0d1f4aa45ed2e95f9c5890c084097dc69
-
SHA512
c2cb465697e217fce62f38862f4ead2a3ac190109e5cece194bb8c7ca12f5e95d8e6a0ee24d9c37981c2ab485692f756119b92dbd33a56ab49e827cfc9872932
-
SSDEEP
24576:9j+cktriK2PVboYTicnT1SBb//wDKULTrhSFkOTu+FMu:0SPVboYTVABjRGtSFruNu
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
Executes dropped EXE 4 IoCs
pid Process 1756 explorer.exe 2712 spoolsv.exe 2124 svchost.exe 2624 spoolsv.exe -
Loads dropped DLL 8 IoCs
pid Process 1088 ec8be5cdde4517148643db5db9e369e0_NeikiAnalytics.exe 1088 ec8be5cdde4517148643db5db9e369e0_NeikiAnalytics.exe 1756 explorer.exe 1756 explorer.exe 2712 spoolsv.exe 2712 spoolsv.exe 2124 svchost.exe 2124 svchost.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 35 IoCs
pid Process 1088 ec8be5cdde4517148643db5db9e369e0_NeikiAnalytics.exe 1756 explorer.exe 2712 spoolsv.exe 2124 svchost.exe 2624 spoolsv.exe 1756 explorer.exe 2124 svchost.exe 1756 explorer.exe 2124 svchost.exe 1756 explorer.exe 2124 svchost.exe 1756 explorer.exe 2124 svchost.exe 1756 explorer.exe 2124 svchost.exe 1756 explorer.exe 2124 svchost.exe 1756 explorer.exe 2124 svchost.exe 1756 explorer.exe 2124 svchost.exe 1756 explorer.exe 2124 svchost.exe 1756 explorer.exe 2124 svchost.exe 1756 explorer.exe 2124 svchost.exe 1756 explorer.exe 2124 svchost.exe 1756 explorer.exe 2124 svchost.exe 1756 explorer.exe 2124 svchost.exe 1756 explorer.exe 2124 svchost.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\themes\explorer.exe ec8be5cdde4517148643db5db9e369e0_NeikiAnalytics.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2384 schtasks.exe 1768 schtasks.exe 340 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1088 ec8be5cdde4517148643db5db9e369e0_NeikiAnalytics.exe 1088 ec8be5cdde4517148643db5db9e369e0_NeikiAnalytics.exe 1088 ec8be5cdde4517148643db5db9e369e0_NeikiAnalytics.exe 1088 ec8be5cdde4517148643db5db9e369e0_NeikiAnalytics.exe 1088 ec8be5cdde4517148643db5db9e369e0_NeikiAnalytics.exe 1088 ec8be5cdde4517148643db5db9e369e0_NeikiAnalytics.exe 1088 ec8be5cdde4517148643db5db9e369e0_NeikiAnalytics.exe 1088 ec8be5cdde4517148643db5db9e369e0_NeikiAnalytics.exe 1088 ec8be5cdde4517148643db5db9e369e0_NeikiAnalytics.exe 1088 ec8be5cdde4517148643db5db9e369e0_NeikiAnalytics.exe 1088 ec8be5cdde4517148643db5db9e369e0_NeikiAnalytics.exe 1088 ec8be5cdde4517148643db5db9e369e0_NeikiAnalytics.exe 1088 ec8be5cdde4517148643db5db9e369e0_NeikiAnalytics.exe 1088 ec8be5cdde4517148643db5db9e369e0_NeikiAnalytics.exe 1088 ec8be5cdde4517148643db5db9e369e0_NeikiAnalytics.exe 1088 ec8be5cdde4517148643db5db9e369e0_NeikiAnalytics.exe 1088 ec8be5cdde4517148643db5db9e369e0_NeikiAnalytics.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 2124 svchost.exe 2124 svchost.exe 2124 svchost.exe 2124 svchost.exe 2124 svchost.exe 2124 svchost.exe 2124 svchost.exe 2124 svchost.exe 2124 svchost.exe 2124 svchost.exe 2124 svchost.exe 2124 svchost.exe 2124 svchost.exe 2124 svchost.exe 2124 svchost.exe 2124 svchost.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 2124 svchost.exe 2124 svchost.exe 2124 svchost.exe 1756 explorer.exe 1756 explorer.exe 2124 svchost.exe 2124 svchost.exe 1756 explorer.exe 2124 svchost.exe 1756 explorer.exe 1756 explorer.exe 2124 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2124 svchost.exe 1756 explorer.exe -
Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 1088 ec8be5cdde4517148643db5db9e369e0_NeikiAnalytics.exe 1088 ec8be5cdde4517148643db5db9e369e0_NeikiAnalytics.exe 1088 ec8be5cdde4517148643db5db9e369e0_NeikiAnalytics.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 2712 spoolsv.exe 2712 spoolsv.exe 2712 spoolsv.exe 2124 svchost.exe 2124 svchost.exe 2124 svchost.exe 2624 spoolsv.exe 2624 spoolsv.exe 2624 spoolsv.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1088 wrote to memory of 1756 1088 ec8be5cdde4517148643db5db9e369e0_NeikiAnalytics.exe 28 PID 1088 wrote to memory of 1756 1088 ec8be5cdde4517148643db5db9e369e0_NeikiAnalytics.exe 28 PID 1088 wrote to memory of 1756 1088 ec8be5cdde4517148643db5db9e369e0_NeikiAnalytics.exe 28 PID 1088 wrote to memory of 1756 1088 ec8be5cdde4517148643db5db9e369e0_NeikiAnalytics.exe 28 PID 1756 wrote to memory of 2712 1756 explorer.exe 29 PID 1756 wrote to memory of 2712 1756 explorer.exe 29 PID 1756 wrote to memory of 2712 1756 explorer.exe 29 PID 1756 wrote to memory of 2712 1756 explorer.exe 29 PID 2712 wrote to memory of 2124 2712 spoolsv.exe 30 PID 2712 wrote to memory of 2124 2712 spoolsv.exe 30 PID 2712 wrote to memory of 2124 2712 spoolsv.exe 30 PID 2712 wrote to memory of 2124 2712 spoolsv.exe 30 PID 2124 wrote to memory of 2624 2124 svchost.exe 31 PID 2124 wrote to memory of 2624 2124 svchost.exe 31 PID 2124 wrote to memory of 2624 2124 svchost.exe 31 PID 2124 wrote to memory of 2624 2124 svchost.exe 31 PID 1756 wrote to memory of 2980 1756 explorer.exe 32 PID 1756 wrote to memory of 2980 1756 explorer.exe 32 PID 1756 wrote to memory of 2980 1756 explorer.exe 32 PID 1756 wrote to memory of 2980 1756 explorer.exe 32 PID 2124 wrote to memory of 2384 2124 svchost.exe 33 PID 2124 wrote to memory of 2384 2124 svchost.exe 33 PID 2124 wrote to memory of 2384 2124 svchost.exe 33 PID 2124 wrote to memory of 2384 2124 svchost.exe 33 PID 2124 wrote to memory of 1768 2124 svchost.exe 38 PID 2124 wrote to memory of 1768 2124 svchost.exe 38 PID 2124 wrote to memory of 1768 2124 svchost.exe 38 PID 2124 wrote to memory of 1768 2124 svchost.exe 38 PID 2124 wrote to memory of 340 2124 svchost.exe 40 PID 2124 wrote to memory of 340 2124 svchost.exe 40 PID 2124 wrote to memory of 340 2124 svchost.exe 40 PID 2124 wrote to memory of 340 2124 svchost.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec8be5cdde4517148643db5db9e369e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ec8be5cdde4517148643db5db9e369e0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:2624
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 10:50 /f5⤵
- Creates scheduled task(s)
PID:2384
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 10:51 /f5⤵
- Creates scheduled task(s)
PID:1768
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 10:52 /f5⤵
- Creates scheduled task(s)
PID:340
-
-
-
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe3⤵PID:2980
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5e464fc4e371559ff91f686db5580359c
SHA15cc253d0f1288769432b3f5db2214131622d7200
SHA2562c26780d101a7edc0f9298de25979200c24097c571c6f8d509f7d0a4bb812fb3
SHA512612cf25c2a86f6f0f67b4efed685a4c01e9823ccbaa499b3631c76dce6d9215f17cbcb194724534c994fe1ac197fc5ea8e3ecda5f0e1e19f491db549569668a7
-
Filesize
1.2MB
MD53471d8d0f0ee2ebc92b0014c6302d2e2
SHA1014e4562923ce0bed7ba7f28df6c4611a00c0f5c
SHA256a421f21cea0148c8b6e2d7cd56f8a32af78e529320fc4a53af8e4597c1d903c6
SHA51281c98af2dfd1d4319bd89fc0ae5b217931fcc58ff33d2bec81d2e8b7ac603c9ee9bf52efe5507f929fdb2121c1904cf7f60e2bcb057cdadfcb327d7cc8dff7b1
-
Filesize
1.2MB
MD5dbeb634d0e98b74e83deda69dfed9556
SHA1ec32bcc852662c8818d23bbdb9415f0e58dc5ded
SHA2564824bac30f6dc9a7444e2aea4acb154f851744b9dda09f45c8ccbf3048ce6611
SHA512ca1426c0a3c461913fa2025b5119db391f4d3f087a50bc865228a19075083e4518af56f6ea2a59457711ce71de0796490ced556e4fc6ceb24f076bf7e1320e1b