Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
23/05/2024, 10:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0f37db955c54c1b0cec4b42d71a53230_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
0f37db955c54c1b0cec4b42d71a53230_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
0f37db955c54c1b0cec4b42d71a53230_NeikiAnalytics.exe
-
Size
68KB
-
MD5
0f37db955c54c1b0cec4b42d71a53230
-
SHA1
6cfc9296e9d4222ed303bce9459477e4e5b4016f
-
SHA256
6dac70abe229f7585487d1ea017c76c5afa4dac3fcec0c0ccf50efb084da292c
-
SHA512
c780bb70241f1526dbb6ba503410df9e278acaa60ba4e7b1f6058aa3801461faa2958c2961c2df35276f4108cd1fcd59fd5dc16201ee8425b1dbd7f99c9402c7
-
SSDEEP
1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8U:Olg35GTslA5t3/w8U
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" agbupic.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" agbupic.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" agbupic.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" agbupic.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4249534D-495a-4858-4249-534D495A4858} agbupic.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4249534D-495a-4858-4249-534D495A4858}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" agbupic.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4249534D-495a-4858-4249-534D495A4858}\IsInstalled = "1" agbupic.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4249534D-495a-4858-4249-534D495A4858}\StubPath = "C:\\Windows\\system32\\atgoatur-oudeas.exe" agbupic.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe agbupic.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" agbupic.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ixpihes-edom.exe" agbupic.exe -
Executes dropped EXE 2 IoCs
pid Process 3052 agbupic.exe 2544 agbupic.exe -
Loads dropped DLL 3 IoCs
pid Process 2172 0f37db955c54c1b0cec4b42d71a53230_NeikiAnalytics.exe 2172 0f37db955c54c1b0cec4b42d71a53230_NeikiAnalytics.exe 3052 agbupic.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" agbupic.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" agbupic.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" agbupic.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" agbupic.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" agbupic.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\ihlufoof.dll" agbupic.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" agbupic.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} agbupic.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify agbupic.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\agbupic.exe agbupic.exe File created C:\Windows\SysWOW64\ixpihes-edom.exe agbupic.exe File created C:\Windows\SysWOW64\ihlufoof.dll agbupic.exe File opened for modification C:\Windows\SysWOW64\ixpihes-edom.exe agbupic.exe File opened for modification C:\Windows\SysWOW64\atgoatur-oudeas.exe agbupic.exe File created C:\Windows\SysWOW64\atgoatur-oudeas.exe agbupic.exe File opened for modification C:\Windows\SysWOW64\ihlufoof.dll agbupic.exe File opened for modification C:\Windows\SysWOW64\agbupic.exe 0f37db955c54c1b0cec4b42d71a53230_NeikiAnalytics.exe File created C:\Windows\SysWOW64\agbupic.exe 0f37db955c54c1b0cec4b42d71a53230_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 2544 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe 3052 agbupic.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2172 0f37db955c54c1b0cec4b42d71a53230_NeikiAnalytics.exe Token: SeDebugPrivilege 3052 agbupic.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2172 wrote to memory of 3052 2172 0f37db955c54c1b0cec4b42d71a53230_NeikiAnalytics.exe 28 PID 2172 wrote to memory of 3052 2172 0f37db955c54c1b0cec4b42d71a53230_NeikiAnalytics.exe 28 PID 2172 wrote to memory of 3052 2172 0f37db955c54c1b0cec4b42d71a53230_NeikiAnalytics.exe 28 PID 2172 wrote to memory of 3052 2172 0f37db955c54c1b0cec4b42d71a53230_NeikiAnalytics.exe 28 PID 3052 wrote to memory of 436 3052 agbupic.exe 5 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 2544 3052 agbupic.exe 29 PID 3052 wrote to memory of 2544 3052 agbupic.exe 29 PID 3052 wrote to memory of 2544 3052 agbupic.exe 29 PID 3052 wrote to memory of 2544 3052 agbupic.exe 29 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20 PID 3052 wrote to memory of 1136 3052 agbupic.exe 20
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:436
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\0f37db955c54c1b0cec4b42d71a53230_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0f37db955c54c1b0cec4b42d71a53230_NeikiAnalytics.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\agbupic.exe"C:\Windows\system32\agbupic.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\agbupic.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2544
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD57b5e3c8bc516d1e6d4a6b4d036a61f70
SHA15856be3ce692fa11fa1b43777630afafb524ce6a
SHA256b92bb6bf6f923dbc1989eacc4a1ddbab42f20cf524425bd9f5447dad164e3a54
SHA51263cab165b9f0c5256a4a92b5c9b3089e92ce180b5ca88c6b423768c6459c82e89e10e491ec6d81ade3e2cf034cd60270f886c1cb312d9086f6dc49902e4b105a
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
Filesize
71KB
MD5ebb7718172c8eb1c1bd47300c402295c
SHA1900db796dcb2dc94cc4678a016183de4cd133721
SHA256686f32ffc48c20c64f3f6974b298ffc1d3c2e34ec365352c1263cabccac7edbf
SHA5120a450b6421338b979f39782730e11a44c265b8ece65e378046050535ebbbb31ad49600ceae3ab96fef913164d309172d287ff256a44cc1596bf013ec2a817cfc
-
Filesize
68KB
MD50f37db955c54c1b0cec4b42d71a53230
SHA16cfc9296e9d4222ed303bce9459477e4e5b4016f
SHA2566dac70abe229f7585487d1ea017c76c5afa4dac3fcec0c0ccf50efb084da292c
SHA512c780bb70241f1526dbb6ba503410df9e278acaa60ba4e7b1f6058aa3801461faa2958c2961c2df35276f4108cd1fcd59fd5dc16201ee8425b1dbd7f99c9402c7