Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    20/05/2024, 10:48

General

  • Target

    ec8be5cdde4517148643db5db9e369e0_NeikiAnalytics.exe

  • Size

    1.2MB

  • MD5

    ec8be5cdde4517148643db5db9e369e0

  • SHA1

    be7ac26962777255857076071c2ccbf08fdebaac

  • SHA256

    089466f082e5ee62814b7c80ff414da0d1f4aa45ed2e95f9c5890c084097dc69

  • SHA512

    c2cb465697e217fce62f38862f4ead2a3ac190109e5cece194bb8c7ca12f5e95d8e6a0ee24d9c37981c2ab485692f756119b92dbd33a56ab49e827cfc9872932

  • SSDEEP

    24576:9j+cktriK2PVboYTicnT1SBb//wDKULTrhSFkOTu+FMu:0SPVboYTVABjRGtSFruNu

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 8 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 35 IoCs
  • Drops file in Windows directory 4 IoCs
  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ec8be5cdde4517148643db5db9e369e0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\ec8be5cdde4517148643db5db9e369e0_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1088
    • \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1756
      • \??\c:\windows\resources\spoolsv.exe
        c:\windows\resources\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2712
        • \??\c:\windows\resources\svchost.exe
          c:\windows\resources\svchost.exe
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2124
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetWindowsHookEx
            PID:2624
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 10:50 /f
            5⤵
            • Creates scheduled task(s)
            PID:2384
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 10:51 /f
            5⤵
            • Creates scheduled task(s)
            PID:1768
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 10:52 /f
            5⤵
            • Creates scheduled task(s)
            PID:340
      • C:\Windows\Explorer.exe
        C:\Windows\Explorer.exe
        3⤵
          PID:2980

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Windows\Resources\Themes\explorer.exe

      Filesize

      1.2MB

      MD5

      e464fc4e371559ff91f686db5580359c

      SHA1

      5cc253d0f1288769432b3f5db2214131622d7200

      SHA256

      2c26780d101a7edc0f9298de25979200c24097c571c6f8d509f7d0a4bb812fb3

      SHA512

      612cf25c2a86f6f0f67b4efed685a4c01e9823ccbaa499b3631c76dce6d9215f17cbcb194724534c994fe1ac197fc5ea8e3ecda5f0e1e19f491db549569668a7

    • \Windows\Resources\spoolsv.exe

      Filesize

      1.2MB

      MD5

      3471d8d0f0ee2ebc92b0014c6302d2e2

      SHA1

      014e4562923ce0bed7ba7f28df6c4611a00c0f5c

      SHA256

      a421f21cea0148c8b6e2d7cd56f8a32af78e529320fc4a53af8e4597c1d903c6

      SHA512

      81c98af2dfd1d4319bd89fc0ae5b217931fcc58ff33d2bec81d2e8b7ac603c9ee9bf52efe5507f929fdb2121c1904cf7f60e2bcb057cdadfcb327d7cc8dff7b1

    • \Windows\Resources\svchost.exe

      Filesize

      1.2MB

      MD5

      dbeb634d0e98b74e83deda69dfed9556

      SHA1

      ec32bcc852662c8818d23bbdb9415f0e58dc5ded

      SHA256

      4824bac30f6dc9a7444e2aea4acb154f851744b9dda09f45c8ccbf3048ce6611

      SHA512

      ca1426c0a3c461913fa2025b5119db391f4d3f087a50bc865228a19075083e4518af56f6ea2a59457711ce71de0796490ced556e4fc6ceb24f076bf7e1320e1b

    • memory/1088-52-0x0000000000400000-0x0000000000793000-memory.dmp

      Filesize

      3.6MB

    • memory/1088-12-0x0000000003AB0000-0x0000000003E43000-memory.dmp

      Filesize

      3.6MB

    • memory/1088-13-0x0000000003AB0000-0x0000000003E43000-memory.dmp

      Filesize

      3.6MB

    • memory/1088-0-0x0000000000400000-0x0000000000793000-memory.dmp

      Filesize

      3.6MB

    • memory/1088-60-0x0000000000400000-0x0000000000793000-memory.dmp

      Filesize

      3.6MB

    • memory/1756-78-0x0000000000400000-0x0000000000793000-memory.dmp

      Filesize

      3.6MB

    • memory/1756-72-0x0000000000400000-0x0000000000793000-memory.dmp

      Filesize

      3.6MB

    • memory/1756-88-0x0000000000400000-0x0000000000793000-memory.dmp

      Filesize

      3.6MB

    • memory/1756-86-0x0000000000400000-0x0000000000793000-memory.dmp

      Filesize

      3.6MB

    • memory/1756-84-0x0000000000400000-0x0000000000793000-memory.dmp

      Filesize

      3.6MB

    • memory/1756-82-0x0000000000400000-0x0000000000793000-memory.dmp

      Filesize

      3.6MB

    • memory/1756-80-0x0000000000400000-0x0000000000793000-memory.dmp

      Filesize

      3.6MB

    • memory/1756-61-0x0000000000400000-0x0000000000793000-memory.dmp

      Filesize

      3.6MB

    • memory/1756-62-0x0000000000400000-0x0000000000793000-memory.dmp

      Filesize

      3.6MB

    • memory/1756-27-0x0000000003950000-0x0000000003CE3000-memory.dmp

      Filesize

      3.6MB

    • memory/1756-64-0x0000000000400000-0x0000000000793000-memory.dmp

      Filesize

      3.6MB

    • memory/1756-66-0x0000000000400000-0x0000000000793000-memory.dmp

      Filesize

      3.6MB

    • memory/1756-76-0x0000000000400000-0x0000000000793000-memory.dmp

      Filesize

      3.6MB

    • memory/1756-68-0x0000000000400000-0x0000000000793000-memory.dmp

      Filesize

      3.6MB

    • memory/1756-74-0x0000000000400000-0x0000000000793000-memory.dmp

      Filesize

      3.6MB

    • memory/1756-70-0x0000000000400000-0x0000000000793000-memory.dmp

      Filesize

      3.6MB

    • memory/2124-63-0x0000000000400000-0x0000000000793000-memory.dmp

      Filesize

      3.6MB

    • memory/2124-81-0x0000000000400000-0x0000000000793000-memory.dmp

      Filesize

      3.6MB

    • memory/2124-73-0x0000000000400000-0x0000000000793000-memory.dmp

      Filesize

      3.6MB

    • memory/2124-69-0x0000000000400000-0x0000000000793000-memory.dmp

      Filesize

      3.6MB

    • memory/2124-67-0x0000000000400000-0x0000000000793000-memory.dmp

      Filesize

      3.6MB

    • memory/2124-77-0x0000000000400000-0x0000000000793000-memory.dmp

      Filesize

      3.6MB

    • memory/2124-45-0x0000000000400000-0x0000000000793000-memory.dmp

      Filesize

      3.6MB

    • memory/2124-79-0x0000000000400000-0x0000000000793000-memory.dmp

      Filesize

      3.6MB

    • memory/2124-89-0x0000000000400000-0x0000000000793000-memory.dmp

      Filesize

      3.6MB

    • memory/2124-71-0x0000000000400000-0x0000000000793000-memory.dmp

      Filesize

      3.6MB

    • memory/2124-87-0x0000000000400000-0x0000000000793000-memory.dmp

      Filesize

      3.6MB

    • memory/2124-83-0x0000000000400000-0x0000000000793000-memory.dmp

      Filesize

      3.6MB

    • memory/2124-85-0x0000000000400000-0x0000000000793000-memory.dmp

      Filesize

      3.6MB

    • memory/2624-57-0x0000000000400000-0x0000000000793000-memory.dmp

      Filesize

      3.6MB

    • memory/2624-53-0x0000000000400000-0x0000000000793000-memory.dmp

      Filesize

      3.6MB

    • memory/2712-58-0x0000000000400000-0x0000000000793000-memory.dmp

      Filesize

      3.6MB

    • memory/2712-43-0x0000000003890000-0x0000000003C23000-memory.dmp

      Filesize

      3.6MB

    • memory/2712-41-0x0000000003890000-0x0000000003C23000-memory.dmp

      Filesize

      3.6MB