Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23/05/2024, 19:13
Static task
static1
Behavioral task
behavioral1
Sample
1eb3e85d8ba3b20ba25a152fd7571130_NeikiAnalytics.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
1eb3e85d8ba3b20ba25a152fd7571130_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
1eb3e85d8ba3b20ba25a152fd7571130_NeikiAnalytics.exe
-
Size
46KB
-
MD5
1eb3e85d8ba3b20ba25a152fd7571130
-
SHA1
ce62862abc7b376e5a3a3bee0f857583d7ac9f49
-
SHA256
2a58d3b142fb619fc9c105fd19b4d6a4e11d32e999bf3014a7e629fd0f58f928
-
SHA512
be39dfc89534bb2b9a77480a7dfae519bb12b09214c2007243efbe0d0cabb9fbe1de0c18c90cbf3435b533b2439190f4111302bf96da9093193a3da133227023
-
SSDEEP
768:WAUJmQCcmLCXQq6fsKiJYsIkjJVzqsVG5kuGVAQvSI:RUNHFKQbIkHvGkAu
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "5120" rmass.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts rmass.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{59434C45-5854-414c-5943-4C455854414c} rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{59434C45-5854-414c-5943-4C455854414c}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{59434C45-5854-414c-5943-4C455854414c}\IsInstalled = "1" rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{59434C45-5854-414c-5943-4C455854414c}\StubPath = "C:\\Windows\\system32\\ahuy.exe" rmass.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ntdbg.exe" rmass.exe -
Executes dropped EXE 2 IoCs
pid Process 3552 rmass.exe 1648 rmass.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "5120" rmass.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} rmass.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\RECOVER32.DLL" rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" rmass.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\rmass.exe rmass.exe File created C:\Windows\SysWOW64\ntdbg.exe rmass.exe File opened for modification C:\Windows\SysWOW64\ahuy.exe rmass.exe File opened for modification C:\Windows\SysWOW64\RECOVER32.DLL rmass.exe File created C:\Windows\SysWOW64\ahuy.exe rmass.exe File created C:\Windows\SysWOW64\RECOVER32.DLL rmass.exe File opened for modification C:\Windows\SysWOW64\winrnt.exe rmass.exe File opened for modification C:\Windows\SysWOW64\aset32.exe rmass.exe File opened for modification C:\Windows\SysWOW64\idbg32.exe rmass.exe File opened for modification C:\Windows\SysWOW64\rmass.exe 1eb3e85d8ba3b20ba25a152fd7571130_NeikiAnalytics.exe File created C:\Windows\SysWOW64\rmass.exe 1eb3e85d8ba3b20ba25a152fd7571130_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\ntdbg.exe rmass.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\System\aset32.exe rmass.exe File opened for modification C:\Program Files (x86)\Common Files\System\idbg32.exe rmass.exe File opened for modification C:\Program Files (x86)\Common Files\System\winrnt.exe rmass.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3552 rmass.exe 3552 rmass.exe 3552 rmass.exe 3552 rmass.exe 3552 rmass.exe 3552 rmass.exe 1648 rmass.exe 1648 rmass.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 5104 1eb3e85d8ba3b20ba25a152fd7571130_NeikiAnalytics.exe Token: SeDebugPrivilege 3552 rmass.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 5104 wrote to memory of 3552 5104 1eb3e85d8ba3b20ba25a152fd7571130_NeikiAnalytics.exe 84 PID 5104 wrote to memory of 3552 5104 1eb3e85d8ba3b20ba25a152fd7571130_NeikiAnalytics.exe 84 PID 5104 wrote to memory of 3552 5104 1eb3e85d8ba3b20ba25a152fd7571130_NeikiAnalytics.exe 84 PID 3552 wrote to memory of 620 3552 rmass.exe 5 PID 3552 wrote to memory of 3460 3552 rmass.exe 56 PID 3552 wrote to memory of 1648 3552 rmass.exe 85 PID 3552 wrote to memory of 1648 3552 rmass.exe 85 PID 3552 wrote to memory of 1648 3552 rmass.exe 85
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:620
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\1eb3e85d8ba3b20ba25a152fd7571130_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1eb3e85d8ba3b20ba25a152fd7571130_NeikiAnalytics.exe"2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\SysWOW64\rmass.exe"C:\Windows\system32\rmass.exe"3⤵
- Windows security bypass
- Drops file in Drivers directory
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Windows\SysWOW64\rmass.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1648
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD52b2c28a7a01f9584fe220ef84003427f
SHA15fc023df0b5064045eb8de7f2dbe26f07f6fec70
SHA2569e00af53b1d0c0f5270d94a666d95aa7b4dcb9fea49487c210c055c9dcfcc9eb
SHA51239192a8a91dec1abff25af8dac0cf39da4dfd51b3fb4f1ef0b4e776185d4280fbe8387c2ea778da7bbf2ce288b0bce4d23cbe8d9e87bbd250159044f5adbac78
-
Filesize
48KB
MD5b45c93380b2f44bc82b70b1cbe88507d
SHA1389b8afba795d0d3ccd09bc5a76fd23a391c753d
SHA256b38d9acd6937d5c1019963ddea5b0e70c6afabdf92be631d7efe4d4285390f43
SHA512f042cbf29fc1d5d5242ac7feeac1ed6e3f4eb7a2a1c8115ea7f0438139e91f875ac6dee855cc4752bddf7e17492013eb3c9461e8c90e26963f0896c04e03088d
-
Filesize
49KB
MD5933c503879f75b5a2c41f8bccb9011c4
SHA1f5099c06949de01e3fd5cfc8ed5d34618a35cf7b
SHA2568b0a3d4597f9ded21dbeca90afa43b7beba7c2511ce5db3883836e4c52e115e0
SHA51219a262936df7abd6fd562e40fdf1198e313efdf66b6911d2a965a571736674b0d110a76d73fe3e2dd99162910bb22bb942ac2f35083d7033bdef83ff6c1d0994
-
Filesize
46KB
MD51eb3e85d8ba3b20ba25a152fd7571130
SHA1ce62862abc7b376e5a3a3bee0f857583d7ac9f49
SHA2562a58d3b142fb619fc9c105fd19b4d6a4e11d32e999bf3014a7e629fd0f58f928
SHA512be39dfc89534bb2b9a77480a7dfae519bb12b09214c2007243efbe0d0cabb9fbe1de0c18c90cbf3435b533b2439190f4111302bf96da9093193a3da133227023
-
Filesize
1KB
MD56f47b62de25d1745e296a06b3f98ed19
SHA1a688bb35a4c8a5cc198985d624a1b5a6ac5b9f6f
SHA25615c7218eb9cef5fa0573db657b15ce3a5f0e0609f1166df8098ca7152df505b4
SHA512dea26fff8060f44bf20fe4fff2ecbacf428727f10c0f5886fb4813e28fce9cbc3d088337c84edd9857b18514c83f1bb1cf0f51518aaecef09f30e921f4d758d7