Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
23/05/2024, 19:13
Static task
static1
Behavioral task
behavioral1
Sample
1eb3e85d8ba3b20ba25a152fd7571130_NeikiAnalytics.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
1eb3e85d8ba3b20ba25a152fd7571130_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
1eb3e85d8ba3b20ba25a152fd7571130_NeikiAnalytics.exe
-
Size
46KB
-
MD5
1eb3e85d8ba3b20ba25a152fd7571130
-
SHA1
ce62862abc7b376e5a3a3bee0f857583d7ac9f49
-
SHA256
2a58d3b142fb619fc9c105fd19b4d6a4e11d32e999bf3014a7e629fd0f58f928
-
SHA512
be39dfc89534bb2b9a77480a7dfae519bb12b09214c2007243efbe0d0cabb9fbe1de0c18c90cbf3435b533b2439190f4111302bf96da9093193a3da133227023
-
SSDEEP
768:WAUJmQCcmLCXQq6fsKiJYsIkjJVzqsVG5kuGVAQvSI:RUNHFKQbIkHvGkAu
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "5120" rmass.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts rmass.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4748505A-5247-4643-4748-505A52474643}\StubPath = "C:\\Windows\\system32\\ahuy.exe" rmass.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4748505A-5247-4643-4748-505A52474643} rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4748505A-5247-4643-4748-505A52474643}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4748505A-5247-4643-4748-505A52474643}\IsInstalled = "1" rmass.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ntdbg.exe" rmass.exe -
Executes dropped EXE 2 IoCs
pid Process 2972 rmass.exe 2764 rmass.exe -
Loads dropped DLL 3 IoCs
pid Process 844 1eb3e85d8ba3b20ba25a152fd7571130_NeikiAnalytics.exe 844 1eb3e85d8ba3b20ba25a152fd7571130_NeikiAnalytics.exe 2972 rmass.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "5120" rmass.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" rmass.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} rmass.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\RECOVER32.DLL" rmass.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ntdbg.exe rmass.exe File opened for modification C:\Windows\SysWOW64\RECOVER32.DLL rmass.exe File opened for modification C:\Windows\SysWOW64\aset32.exe rmass.exe File opened for modification C:\Windows\SysWOW64\idbg32.exe rmass.exe File opened for modification C:\Windows\SysWOW64\rmass.exe rmass.exe File opened for modification C:\Windows\SysWOW64\rmass.exe 1eb3e85d8ba3b20ba25a152fd7571130_NeikiAnalytics.exe File created C:\Windows\SysWOW64\ntdbg.exe rmass.exe File opened for modification C:\Windows\SysWOW64\ahuy.exe rmass.exe File created C:\Windows\SysWOW64\ahuy.exe rmass.exe File created C:\Windows\SysWOW64\RECOVER32.DLL rmass.exe File opened for modification C:\Windows\SysWOW64\winrnt.exe rmass.exe File created C:\Windows\SysWOW64\rmass.exe 1eb3e85d8ba3b20ba25a152fd7571130_NeikiAnalytics.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\System\winrnt.exe rmass.exe File opened for modification C:\Program Files (x86)\Common Files\System\aset32.exe rmass.exe File opened for modification C:\Program Files (x86)\Common Files\System\idbg32.exe rmass.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2972 rmass.exe 2972 rmass.exe 2972 rmass.exe 2764 rmass.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 844 1eb3e85d8ba3b20ba25a152fd7571130_NeikiAnalytics.exe Token: SeDebugPrivilege 2972 rmass.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 844 wrote to memory of 2972 844 1eb3e85d8ba3b20ba25a152fd7571130_NeikiAnalytics.exe 28 PID 844 wrote to memory of 2972 844 1eb3e85d8ba3b20ba25a152fd7571130_NeikiAnalytics.exe 28 PID 844 wrote to memory of 2972 844 1eb3e85d8ba3b20ba25a152fd7571130_NeikiAnalytics.exe 28 PID 844 wrote to memory of 2972 844 1eb3e85d8ba3b20ba25a152fd7571130_NeikiAnalytics.exe 28 PID 2972 wrote to memory of 436 2972 rmass.exe 5 PID 2972 wrote to memory of 1216 2972 rmass.exe 21 PID 2972 wrote to memory of 2764 2972 rmass.exe 29 PID 2972 wrote to memory of 2764 2972 rmass.exe 29 PID 2972 wrote to memory of 2764 2972 rmass.exe 29 PID 2972 wrote to memory of 2764 2972 rmass.exe 29
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:436
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\1eb3e85d8ba3b20ba25a152fd7571130_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1eb3e85d8ba3b20ba25a152fd7571130_NeikiAnalytics.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Windows\SysWOW64\rmass.exe"C:\Windows\system32\rmass.exe"3⤵
- Windows security bypass
- Drops file in Drivers directory
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\rmass.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2764
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD52b2c28a7a01f9584fe220ef84003427f
SHA15fc023df0b5064045eb8de7f2dbe26f07f6fec70
SHA2569e00af53b1d0c0f5270d94a666d95aa7b4dcb9fea49487c210c055c9dcfcc9eb
SHA51239192a8a91dec1abff25af8dac0cf39da4dfd51b3fb4f1ef0b4e776185d4280fbe8387c2ea778da7bbf2ce288b0bce4d23cbe8d9e87bbd250159044f5adbac78
-
Filesize
48KB
MD5ed734ad41b4c156e54d57775c9f4db65
SHA1b25f93f170d7aa675421a122755320638a692d9f
SHA25666ccadc1f235b5dd9450c2b614c0a0a63f6a7ffa0f8f769f6a4bebb3e073fff9
SHA512d8f5cb53efcaee54681ea2e9d9a24489ab524b89bb36b55f543529b2b280e513b25cd418db5d7fc98fdf885e5c6bd44b111020fab1670da8f5ff54dc9ed3cb1a
-
Filesize
49KB
MD54f5716d2c9f069c5fc8192508656cad3
SHA1a4901cf3a7260b4d42653b4778f7645a24d15d6f
SHA256e2c5f38312b76d553529b2dac88dca0ce445c0f4a959f676aaad48b8adf645f8
SHA5123e4cd90554560cec73950db59d810fc2b14da3194425d81b2b5d4a5350838ab9ce03da9c2b24e9dcce985322697169763060930ee977de8e3ad2694f6008f4e1
-
Filesize
1KB
MD5b10b13206b0f2cf3968050072f6979bf
SHA1699db21ba9cecf3f13ac3d76e22cfa41aa94da80
SHA2560eef3217095cb97b695c434e74d6314bf9e869a013d6e9c88e58c34576a276b4
SHA512d33bfd931be6676539507a69101d99fa4c5ef36b12422bd11f063b9b6a47b7444f6c4ad5f35e044714fdb872e96cd9fddf049e8329af1219483887f6ac5f4a5d
-
Filesize
46KB
MD51eb3e85d8ba3b20ba25a152fd7571130
SHA1ce62862abc7b376e5a3a3bee0f857583d7ac9f49
SHA2562a58d3b142fb619fc9c105fd19b4d6a4e11d32e999bf3014a7e629fd0f58f928
SHA512be39dfc89534bb2b9a77480a7dfae519bb12b09214c2007243efbe0d0cabb9fbe1de0c18c90cbf3435b533b2439190f4111302bf96da9093193a3da133227023