Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21/05/2024, 05:40
Static task
static1
Behavioral task
behavioral1
Sample
07557bab54457b768b82937e5cba655a3c56e3b77994ec36fd47541fd578e753_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
07557bab54457b768b82937e5cba655a3c56e3b77994ec36fd47541fd578e753_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
07557bab54457b768b82937e5cba655a3c56e3b77994ec36fd47541fd578e753_NeikiAnalytics.exe
-
Size
24KB
-
MD5
68587b038eedacd64aba24fa8e1546b0
-
SHA1
afa9bccccfcc54ebaf80087195c4c696c783cad6
-
SHA256
07557bab54457b768b82937e5cba655a3c56e3b77994ec36fd47541fd578e753
-
SHA512
c475c5a4344a1c85ad1621de79c9f09ada89e3f7b090ea5b61dd07491589252a8828c21aaaa424ec38c9bac2db9d1cbe1e10a4ec92c1c7e003668ac3dadefd9b
-
SSDEEP
384:jIz4u6jtrusk+3E7ZDrAHxFXf4JyVN0P1TQeUDTl9BaHM+NE:jIUbh1H3E7hAHnRN0lvUfBaHm
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "5120" rmass.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts rmass.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{52494A54-4f4f-5658-5249-4A544F4F5658} rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{52494A54-4f4f-5658-5249-4A544F4F5658}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{52494A54-4f4f-5658-5249-4A544F4F5658}\IsInstalled = "1" rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{52494A54-4f4f-5658-5249-4A544F4F5658}\StubPath = "C:\\Windows\\system32\\ahuy.exe" rmass.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ntdbg.exe" rmass.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" rmass.exe -
Executes dropped EXE 2 IoCs
pid Process 2708 rmass.exe 1924 rmass.exe -
resource yara_rule behavioral2/files/0x00050000000232a4-2.dat upx behavioral2/memory/2708-5-0x0000000000400000-0x0000000000411000-memory.dmp upx behavioral2/memory/1924-15-0x0000000000400000-0x0000000000411000-memory.dmp upx behavioral2/memory/2708-49-0x0000000000400000-0x0000000000411000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "5120" rmass.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\RECOVER32.DLL" rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" rmass.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} rmass.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify rmass.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\aset32.exe rmass.exe File opened for modification C:\Windows\SysWOW64\idbg32.exe rmass.exe File created C:\Windows\SysWOW64\rmass.exe 07557bab54457b768b82937e5cba655a3c56e3b77994ec36fd47541fd578e753_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\ahuy.exe rmass.exe File created C:\Windows\SysWOW64\ahuy.exe rmass.exe File opened for modification C:\Windows\SysWOW64\RECOVER32.DLL rmass.exe File created C:\Windows\SysWOW64\RECOVER32.DLL rmass.exe File opened for modification C:\Windows\SysWOW64\winrnt.exe rmass.exe File opened for modification C:\Windows\SysWOW64\rmass.exe rmass.exe File opened for modification C:\Windows\SysWOW64\rmass.exe 07557bab54457b768b82937e5cba655a3c56e3b77994ec36fd47541fd578e753_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\ntdbg.exe rmass.exe File created C:\Windows\SysWOW64\ntdbg.exe rmass.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\System\winrnt.exe rmass.exe File opened for modification C:\Program Files (x86)\Common Files\System\aset32.exe rmass.exe File opened for modification C:\Program Files (x86)\Common Files\System\idbg32.exe rmass.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2708 rmass.exe 2708 rmass.exe 2708 rmass.exe 2708 rmass.exe 2708 rmass.exe 2708 rmass.exe 1924 rmass.exe 1924 rmass.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2708 rmass.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 916 wrote to memory of 2708 916 07557bab54457b768b82937e5cba655a3c56e3b77994ec36fd47541fd578e753_NeikiAnalytics.exe 83 PID 916 wrote to memory of 2708 916 07557bab54457b768b82937e5cba655a3c56e3b77994ec36fd47541fd578e753_NeikiAnalytics.exe 83 PID 916 wrote to memory of 2708 916 07557bab54457b768b82937e5cba655a3c56e3b77994ec36fd47541fd578e753_NeikiAnalytics.exe 83 PID 2708 wrote to memory of 608 2708 rmass.exe 5 PID 2708 wrote to memory of 3480 2708 rmass.exe 56 PID 2708 wrote to memory of 1924 2708 rmass.exe 84 PID 2708 wrote to memory of 1924 2708 rmass.exe 84 PID 2708 wrote to memory of 1924 2708 rmass.exe 84
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:608
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\07557bab54457b768b82937e5cba655a3c56e3b77994ec36fd47541fd578e753_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\07557bab54457b768b82937e5cba655a3c56e3b77994ec36fd47541fd578e753_NeikiAnalytics.exe"2⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Windows\SysWOW64\rmass.exe"C:\Windows\SysWOW64\rmass.exe"3⤵
- Windows security bypass
- Drops file in Drivers directory
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\rmass.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1924
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD52b2c28a7a01f9584fe220ef84003427f
SHA15fc023df0b5064045eb8de7f2dbe26f07f6fec70
SHA2569e00af53b1d0c0f5270d94a666d95aa7b4dcb9fea49487c210c055c9dcfcc9eb
SHA51239192a8a91dec1abff25af8dac0cf39da4dfd51b3fb4f1ef0b4e776185d4280fbe8387c2ea778da7bbf2ce288b0bce4d23cbe8d9e87bbd250159044f5adbac78
-
Filesize
24KB
MD511ab26a5e34c960146d71a9033c2ba50
SHA1a63fa76ce0fc1c9a9c793fbb02e5f456da3914a2
SHA25647c717b8a5e9dca9b5a5916153aee01084912bc9635d9642f93a91691b176fdf
SHA512db7bdee74d18604d2654e9ecad1444e1e647a7513cb14500c945a7199e6477f404e1e41f09bb7c2a027fad00d51d13b99c059107a8faece2ec3d15d3744258d6
-
Filesize
25KB
MD56eeede57f58a9e62fdca2bc2736237e0
SHA1fa447f29988927fd8ef8a3f05e90973305646092
SHA256792c79c05bde21f1b77890e03ba5f64f0d18fda07ff02488afc2b383a168a71f
SHA5127776a66619fbdaef8ab88e8eb9bd0b25c8e24c0d6e19650ed17bbc515122ef9efc4a3ef20d29cd140716ab3486c8483f9046d35e2fd2e7ef3ee1b7b82bc694e5
-
Filesize
22KB
MD5ac13ee5ce9f1bc74a8878f829a6875d2
SHA104c1ddc68dc071d35cfe1d3d81ced3675ffd2828
SHA25649cb25ebdcb84e7bf6476f276c158ec86823001b54d79eb437274a21db0e13e1
SHA5127356840599e613e56eb5a568e1ec78f9ad65882d7d51914a630e12c01c57f653905d3c71ee619277f4fa791ad12ee538f8b9e049cbc2a512a410e6a4dc6e12e1
-
Filesize
1KB
MD56f47b62de25d1745e296a06b3f98ed19
SHA1a688bb35a4c8a5cc198985d624a1b5a6ac5b9f6f
SHA25615c7218eb9cef5fa0573db657b15ce3a5f0e0609f1166df8098ca7152df505b4
SHA512dea26fff8060f44bf20fe4fff2ecbacf428727f10c0f5886fb4813e28fce9cbc3d088337c84edd9857b18514c83f1bb1cf0f51518aaecef09f30e921f4d758d7