Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
21/05/2024, 08:40
Behavioral task
behavioral1
Sample
240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe
-
Size
1.2MB
-
MD5
721b758a83caa37ad1a51b55f41ec1f0
-
SHA1
90a497ae13229c029868c3b89c9519f7d652e11c
-
SHA256
240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea
-
SHA512
cdcf3e69c392122a7a590babfa5c09291aa300cbf76f004363f3f938ddb6e5a7658626652b28c21166a60a2d2b7e48a1822b38b65c73b335ab82aec8f2dc1e9b
-
SSDEEP
24576:zQ5aILMCfmAUjzX6xQGCZLFdGm1Sd8zG7u75+FmVf6IIwqEK9o:E5aIwC+Agr6S/FEAGsjiII8
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
resource yara_rule behavioral1/files/0x0007000000015693-25.dat family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
resource yara_rule behavioral1/memory/1872-15-0x00000000002E0000-0x0000000000309000-memory.dmp trickbot_loader32 -
Executes dropped EXE 3 IoCs
pid Process 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 1832 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 1964 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe -
Loads dropped DLL 2 IoCs
pid Process 1872 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe 1872 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2488 sc.exe 1244 sc.exe 2112 sc.exe 1628 sc.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1872 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe 1872 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe 1872 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 1232 powershell.exe 2568 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2568 powershell.exe Token: SeDebugPrivilege 1232 powershell.exe Token: SeTcbPrivilege 1832 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe Token: SeTcbPrivilege 1964 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1872 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 1832 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 1964 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1872 wrote to memory of 3016 1872 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe 29 PID 1872 wrote to memory of 3016 1872 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe 29 PID 1872 wrote to memory of 3016 1872 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe 29 PID 1872 wrote to memory of 3016 1872 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe 29 PID 1872 wrote to memory of 2992 1872 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe 30 PID 1872 wrote to memory of 2992 1872 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe 30 PID 1872 wrote to memory of 2992 1872 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe 30 PID 1872 wrote to memory of 2992 1872 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe 30 PID 1872 wrote to memory of 2560 1872 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe 33 PID 1872 wrote to memory of 2560 1872 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe 33 PID 1872 wrote to memory of 2560 1872 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe 33 PID 1872 wrote to memory of 2560 1872 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe 33 PID 1872 wrote to memory of 2688 1872 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe 35 PID 1872 wrote to memory of 2688 1872 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe 35 PID 1872 wrote to memory of 2688 1872 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe 35 PID 1872 wrote to memory of 2688 1872 240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe 35 PID 2560 wrote to memory of 2568 2560 cmd.exe 36 PID 2560 wrote to memory of 2568 2560 cmd.exe 36 PID 2560 wrote to memory of 2568 2560 cmd.exe 36 PID 2560 wrote to memory of 2568 2560 cmd.exe 36 PID 2688 wrote to memory of 2476 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 37 PID 2688 wrote to memory of 2476 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 37 PID 2688 wrote to memory of 2476 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 37 PID 2688 wrote to memory of 2476 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 37 PID 2688 wrote to memory of 2604 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 40 PID 2688 wrote to memory of 2604 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 40 PID 2688 wrote to memory of 2604 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 40 PID 2688 wrote to memory of 2604 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 40 PID 2992 wrote to memory of 2488 2992 cmd.exe 38 PID 2992 wrote to memory of 2488 2992 cmd.exe 38 PID 2992 wrote to memory of 2488 2992 cmd.exe 38 PID 2992 wrote to memory of 2488 2992 cmd.exe 38 PID 3016 wrote to memory of 1628 3016 cmd.exe 39 PID 3016 wrote to memory of 1628 3016 cmd.exe 39 PID 3016 wrote to memory of 1628 3016 cmd.exe 39 PID 3016 wrote to memory of 1628 3016 cmd.exe 39 PID 2688 wrote to memory of 2436 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 41 PID 2688 wrote to memory of 2436 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 41 PID 2688 wrote to memory of 2436 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 41 PID 2688 wrote to memory of 2436 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 41 PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 43 PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 43 PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 43 PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 43 PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 43 PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 43 PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 43 PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 43 PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 43 PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 43 PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 43 PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 43 PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 43 PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 43 PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 43 PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 43 PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 43 PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 43 PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 43 PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 43 PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 43 PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 43 PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 43 PID 2688 wrote to memory of 2508 2688 240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe 43 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend2⤵
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\SysWOW64\sc.exesc stop WinDefend3⤵
- Launches sc.exe
PID:1628
-
-
-
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend2⤵
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\SysWOW64\sc.exesc delete WinDefend3⤵
- Launches sc.exe
PID:2488
-
-
-
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2568
-
-
-
C:\Users\Admin\AppData\Roaming\WinSocket\240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exeC:\Users\Admin\AppData\Roaming\WinSocket\240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend3⤵PID:2476
-
C:\Windows\SysWOW64\sc.exesc stop WinDefend4⤵
- Launches sc.exe
PID:2112
-
-
-
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend3⤵PID:2604
-
C:\Windows\SysWOW64\sc.exesc delete WinDefend4⤵
- Launches sc.exe
PID:1244
-
-
-
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵PID:2436
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true4⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1232
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:2508
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {DFB65A56-F391-4E2D-BEBE-3E37A91C3DD2} S-1-5-18:NT AUTHORITY\System:Service:1⤵PID:320
-
C:\Users\Admin\AppData\Roaming\WinSocket\240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exeC:\Users\Admin\AppData\Roaming\WinSocket\240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1832 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:1112
-
-
-
C:\Users\Admin\AppData\Roaming\WinSocket\240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exeC:\Users\Admin\AppData\Roaming\WinSocket\240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1964 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:3004
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD5def7594a7f6b0585e7f87c95ca6f468c
SHA1e56d69f2ad5ecb7500cdd01e045be8179c58e5ff
SHA256d898a8001d9e1d4f6db793093f30f8b337645fb1f5c6806cd435992605549ac9
SHA512ba95b683e5326c1157cf7fa6c8d5a87c3fb4910b4b6a369f7a3257ec711291d61de9ffde415d4e52ebd13fe257a9cb2f3ff3c9cbb9cd664bf59df777add1cf7b
-
C:\Users\Admin\AppData\Roaming\WinSocket\240cdb864068a633246b9284920b9b4ea9cb377deae277963939798efd7c74ea_NeikiAnalytict.exe
Filesize1.2MB
MD5721b758a83caa37ad1a51b55f41ec1f0
SHA190a497ae13229c029868c3b89c9519f7d652e11c
SHA256240cdb754057a533245b9274820b8b4ea8cb366deae266953938697efd6c64ea
SHA512cdcf3e69c392122a7a590babfa5c09291aa300cbf76f004363f3f938ddb6e5a7658626652b28c21166a60a2d2b7e48a1822b38b65c73b335ab82aec8f2dc1e9b