Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    21/05/2024, 10:25

General

  • Target

    3603cae0e9b4682cdb9edfb76f92a67535b9a2de1424249607e298b94005c9b0_NeikiAnalytics.exe

  • Size

    1.0MB

  • MD5

    83a7009446886b5a6fcc262cdf8fea00

  • SHA1

    c29cae2d6d5c95c87959393bbf4b07d13fc08ab7

  • SHA256

    3603cae0e9b4682cdb9edfb76f92a67535b9a2de1424249607e298b94005c9b0

  • SHA512

    8c313c440a73ffd81104b2fa9aa816054598c34429667606ca528eb5c6b4a93b34c57e2d9cfcafd867df72b0ea01e98223495a021a5fe1985c97932f516ac6a1

  • SSDEEP

    24576:8mUNJyJqb1FcMap2ATT5emUNJyJqb1FcMap2ATT5emUNJyJqb1FcMap2ATT58:8mV2ApemV2ApemV2Ap8

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3603cae0e9b4682cdb9edfb76f92a67535b9a2de1424249607e298b94005c9b0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\3603cae0e9b4682cdb9edfb76f92a67535b9a2de1424249607e298b94005c9b0_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Modifies WinLogon
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:3052
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      PID:2604

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b5d6c5fdf11de5562c0bd70da62faa91

    SHA1

    ac5a0707c548200b14056808e7bb93bcfed6a9b3

    SHA256

    f8f6a0d96ff9a22c99e758f04b898d734327808a1e9c775428ecf37ae7dc656d

    SHA512

    ee947e6268d3c9c41596eb960f05b667b9afcad9f45f97e6feb4505dd3015fa6c1ecc8935bd1c623499f65c1d4a6a72126fa44680233434e250802c49b66d398

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    0cf80faf0e3f34df9442b70acc19e509

    SHA1

    4ceae49dd9eb890a02a789cc5de2bc0bd01e68e7

    SHA256

    d60e5629c28d6e55ce341b3bb2fa3df516e51d00d3c119a5d44781f446ceb562

    SHA512

    8130789e935a487a97d57e3fcbeaa8ebc51c20ec2b93e018705184494f974a60e618a3b466d1115bdee3fb9257477c9c931e10d8c3cdb3c005c47891b4cfb642

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2XHJXO3H\login[1].htm

    Filesize

    168B

    MD5

    d57e3a550060f85d44a175139ea23021

    SHA1

    2c5cb3428a322c9709a34d04dd86fe7628f8f0a6

    SHA256

    43edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c

    SHA512

    0364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063

  • C:\Users\Admin\AppData\Local\Temp\6B3E.tmp

    Filesize

    42KB

    MD5

    c6292a707b04f54e99a8a3c1b8b19dd2

    SHA1

    ed4806bffc278631b8ba9fdbf86f88dfc8107d5b

    SHA256

    0548651d448a467c6ead79cc1dc61b74be478639e093a292f52b8a963a05b6c8

    SHA512

    dea473c8c4b8694074edfeb75623684f610020367a4bc51dfcefd0d00d8bffb50ba6a5a696ea1ff55f63fe1573c130772dfde6374137d77af417f4d1a3b16106

  • C:\Users\Admin\AppData\Local\Temp\A493.tmp

    Filesize

    593B

    MD5

    926512864979bc27cf187f1de3f57aff

    SHA1

    acdeb9d6187932613c7fa08eaf28f0cd8116f4b5

    SHA256

    b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f

    SHA512

    f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b

  • C:\Users\Admin\AppData\Local\Temp\Cab4F2D.tmp

    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

  • C:\Users\Admin\AppData\Local\Temp\D993.tmp

    Filesize

    1KB

    MD5

    b4eb7f2f6a13d0093ad3faba6de92ca7

    SHA1

    ddce82403cd203b2b2f99f420cc2ef64305dbea7

    SHA256

    61430ae7773bc9c6a72854b3621f69f75f16844211c403ce4bb6d8dd196b6c09

    SHA512

    f9ce6ce7d687a1714a9acf66772bc5cde7f39fa7bf337afe428eb7c0681052f007f218b0873c6cb057d76c3a0e46d5a4ed3c5c2c8ef94c4e78c22cb3a902b363

  • C:\Users\Admin\AppData\Local\Temp\D9A6.tmp

    Filesize

    593B

    MD5

    3b03d93d3487806337b5c6443ce7a62d

    SHA1

    93a7a790bb6348606cbdaf5daeaaf4ea8cf731d0

    SHA256

    7392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30

    SHA512

    770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88

  • C:\Users\Admin\AppData\Local\Temp\DAE0.tmp

    Filesize

    457B

    MD5

    531ec87a0b2f9477a52d88b111d0d46a

    SHA1

    50a72e5752075309f91c062e0282a7e7cd1e751e

    SHA256

    4875b451859b1eb8d0d3b040b1bb8d654d212edb6d9c721cf0f4372129579385

    SHA512

    07994963fd76b31ef0ba2c7f418dcb3ee0290f6baca2d8ec63a6e6b861557b13fbc20d2f0a10a66f35c4d72d4d2c1920ac88b96174604f2f8856868912327da1

  • C:\Users\Admin\AppData\Local\Temp\Tar4F4F.tmp

    Filesize

    177KB

    MD5

    435a9ac180383f9fa094131b173a2f7b

    SHA1

    76944ea657a9db94f9a4bef38f88c46ed4166983

    SHA256

    67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

    SHA512

    1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

  • \Windows\AppPatch\svchost.exe

    Filesize

    1.0MB

    MD5

    2b5a40c044414b8c15e429aa5fa340b4

    SHA1

    e2bcdac11b6f6bae0cdc5b875d577f8aaad03b0d

    SHA256

    147f25fc2dff70b66eb2107f4f0bb1e4961b392a048c0db508a07cf6b2c22e52

    SHA512

    187c6966734a490e16aa41669f66c8925f59dd903f22c68b68910507477ca59131af259fa5d83d0cfae71f63ac3439035f173cacedef64ad5ae4f6aa872cc465

  • memory/2604-63-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-53-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-29-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-37-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-47-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-55-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-56-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-58-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-62-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-70-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-77-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-76-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-75-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-74-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-73-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-72-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-71-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-69-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-68-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-67-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-66-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-65-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-64-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-25-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-61-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-60-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-59-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-57-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-54-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-27-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-52-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-51-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-50-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-49-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-48-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-46-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-45-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-44-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-43-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-42-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-41-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-40-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-39-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-38-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-36-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-35-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-31-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-34-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-33-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-32-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-392-0x00000000021C0000-0x0000000002276000-memory.dmp

    Filesize

    728KB

  • memory/2604-16-0x0000000000350000-0x00000000003F8000-memory.dmp

    Filesize

    672KB

  • memory/2604-18-0x0000000000350000-0x00000000003F8000-memory.dmp

    Filesize

    672KB

  • memory/2604-20-0x0000000000350000-0x00000000003F8000-memory.dmp

    Filesize

    672KB

  • memory/2604-24-0x0000000000350000-0x00000000003F8000-memory.dmp

    Filesize

    672KB

  • memory/2604-22-0x0000000000350000-0x00000000003F8000-memory.dmp

    Filesize

    672KB

  • memory/2604-14-0x0000000000350000-0x00000000003F8000-memory.dmp

    Filesize

    672KB

  • memory/3052-13-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB