Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

7707652499...cs.exe

windows7-x64

8

7707652499...cs.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    26/05/2024, 05:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe

  • Size

    629KB

  • MD5

    77076524991a132b4d23bb7e83a9edb0

  • SHA1

    f8439a70ac3b851a5e67da4b91ca28ec5abc879c

  • SHA256

    8999ee0edae430356495baac9163eca6583f679a709179c45688a8e69d319324

  • SHA512

    a97809ef692471182abb85963b7822750015f024603520bc36fc1bb4fa7fa3a9eceb5253859594184b51817e93df91654aac55a912de56a7bd08fb7b0c79542a

  • SSDEEP

    6144:j4sZBOZdjEYTPXMhaMP/kFTA7OA/BOZdjEYF:jnANL8oq/kFTsOxNF

Score
8/10
persistence

Malware Config

Signatures

  • Drops file in Drivers directory 5 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 18 IoCs
    persistence
  • Drops file in System32 directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe"
    1⤵
    • Drops file in Drivers directory
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2976
    • C:\windows\system\jxmktrq.exe
      "C:\windows\system\jxmktrq.exe" "C:\Users\Admin\AppData\Local\Temp\77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe"
      2⤵
      • Drops file in Drivers directory
      • Deletes itself
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2604
      • C:\windows\SysWOW64\bbbtesy.exe
        "C:\windows\system32\bbbtesy.exe"
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1596
        • C:\windows\SysWOW64\bbbtesy.exe
          "C:\windows\system32\bbbtesy.exe"
          4⤵
          • Executes dropped EXE
          PID:2764
        • C:\windows\SysWOW64\bbbtesy.exe
          "C:\windows\system32\bbbtesy.exe"
          4⤵
          • Executes dropped EXE
          PID:2148
        • C:\windows\SysWOW64\bbbtesy.exe
          "C:\windows\system32\bbbtesy.exe"
          4⤵
          • Executes dropped EXE
          PID:2112
        • C:\windows\SysWOW64\bbbtesy.exe
          "C:\windows\system32\bbbtesy.exe"
          4⤵
          • Executes dropped EXE
          PID:2708
        • C:\windows\SysWOW64\bbbtesy.exe
          "C:\windows\system32\bbbtesy.exe"
          4⤵
          • Executes dropped EXE
          PID:1684
        • C:\windows\SysWOW64\bbbtesy.exe
          "C:\windows\system32\bbbtesy.exe"
          4⤵
          • Executes dropped EXE
          PID:2940
        • C:\windows\SysWOW64\bbbtesy.exe
          "C:\windows\system32\bbbtesy.exe"
          4⤵
          • Executes dropped EXE
          PID:1292
        • C:\windows\SysWOW64\bbbtesy.exe
          "C:\windows\system32\bbbtesy.exe"
          4⤵
          • Executes dropped EXE
          PID:2248
        • C:\windows\SysWOW64\bbbtesy.exe
          "C:\windows\system32\bbbtesy.exe"
          4⤵
          • Executes dropped EXE
          PID:2196
        • C:\windows\SysWOW64\bbbtesy.exe
          "C:\windows\system32\bbbtesy.exe"
          4⤵
          • Executes dropped EXE
          PID:1392
        • C:\windows\SysWOW64\bbbtesy.exe
          "C:\windows\system32\bbbtesy.exe"
          4⤵
          • Executes dropped EXE
          PID:2644
        • C:\windows\SysWOW64\bbbtesy.exe
          "C:\windows\system32\bbbtesy.exe"
          4⤵
          • Executes dropped EXE
          PID:1692
        • C:\windows\SysWOW64\bbbtesy.exe
          "C:\windows\system32\bbbtesy.exe"
          4⤵
          • Executes dropped EXE
          PID:2316
        • C:\windows\SysWOW64\bbbtesy.exe
          "C:\windows\system32\bbbtesy.exe"
          4⤵
          • Executes dropped EXE
          PID:1264
        • C:\windows\SysWOW64\bbbtesy.exe
          "C:\windows\system32\bbbtesy.exe"
          4⤵
          • Executes dropped EXE
          PID:1520
        • C:\windows\SysWOW64\bbbtesy.exe
          "C:\windows\system32\bbbtesy.exe"
          4⤵
          • Executes dropped EXE
          PID:1704
        • C:\windows\SysWOW64\bbbtesy.exe
          "C:\windows\system32\bbbtesy.exe"
          4⤵
          • Executes dropped EXE
          PID:1004
        • C:\windows\SysWOW64\bbbtesy.exe
          "C:\windows\system32\bbbtesy.exe"
          4⤵
          • Executes dropped EXE
          PID:2280
        • C:\windows\SysWOW64\bbbtesy.exe
          "C:\windows\system32\bbbtesy.exe"
          4⤵
          • Executes dropped EXE
          PID:1980
        • C:\windows\SysWOW64\bbbtesy.exe
          "C:\windows\system32\bbbtesy.exe"
          4⤵
          • Executes dropped EXE
          PID:1608
        • C:\windows\SysWOW64\bbbtesy.exe
          "C:\windows\system32\bbbtesy.exe"
          4⤵
            PID:1948
          • C:\windows\SysWOW64\bbbtesy.exe
            "C:\windows\system32\bbbtesy.exe"
            4⤵
              PID:1636
            • C:\windows\SysWOW64\bbbtesy.exe
              "C:\windows\system32\bbbtesy.exe"
              4⤵
                PID:1512
              • C:\windows\SysWOW64\bbbtesy.exe
                "C:\windows\system32\bbbtesy.exe"
                4⤵
                  PID:1932
                • C:\windows\SysWOW64\bbbtesy.exe
                  "C:\windows\system32\bbbtesy.exe"
                  4⤵
                    PID:2560
                  • C:\windows\SysWOW64\bbbtesy.exe
                    "C:\windows\system32\bbbtesy.exe"
                    4⤵
                      PID:2876
                    • C:\windows\SysWOW64\bbbtesy.exe
                      "C:\windows\system32\bbbtesy.exe"
                      4⤵
                        PID:2464
                      • C:\windows\SysWOW64\bbbtesy.exe
                        "C:\windows\system32\bbbtesy.exe"
                        4⤵
                          PID:2652
                        • C:\windows\SysWOW64\bbbtesy.exe
                          "C:\windows\system32\bbbtesy.exe"
                          4⤵
                            PID:2820
                          • C:\windows\SysWOW64\bbbtesy.exe
                            "C:\windows\system32\bbbtesy.exe"
                            4⤵
                              PID:2648
                            • C:\windows\SysWOW64\bbbtesy.exe
                              "C:\windows\system32\bbbtesy.exe"
                              4⤵
                                PID:1944
                              • C:\windows\SysWOW64\bbbtesy.exe
                                "C:\windows\system32\bbbtesy.exe"
                                4⤵
                                  PID:3032
                                • C:\windows\SysWOW64\bbbtesy.exe
                                  "C:\windows\system32\bbbtesy.exe"
                                  4⤵
                                    PID:1624
                                  • C:\windows\SysWOW64\bbbtesy.exe
                                    "C:\windows\system32\bbbtesy.exe"
                                    4⤵
                                      PID:1516
                                    • C:\windows\SysWOW64\bbbtesy.exe
                                      "C:\windows\system32\bbbtesy.exe"
                                      4⤵
                                        PID:2168
                                      • C:\windows\SysWOW64\bbbtesy.exe
                                        "C:\windows\system32\bbbtesy.exe"
                                        4⤵
                                          PID:2160
                                        • C:\windows\SysWOW64\bbbtesy.exe
                                          "C:\windows\system32\bbbtesy.exe"
                                          4⤵
                                            PID:532
                                          • C:\windows\SysWOW64\bbbtesy.exe
                                            "C:\windows\system32\bbbtesy.exe"
                                            4⤵
                                              PID:576
                                            • C:\windows\SysWOW64\bbbtesy.exe
                                              "C:\windows\system32\bbbtesy.exe"
                                              4⤵
                                                PID:1604
                                              • C:\windows\SysWOW64\bbbtesy.exe
                                                "C:\windows\system32\bbbtesy.exe"
                                                4⤵
                                                  PID:2824
                                                • C:\windows\SysWOW64\bbbtesy.exe
                                                  "C:\windows\system32\bbbtesy.exe"
                                                  4⤵
                                                    PID:1172
                                                  • C:\windows\SysWOW64\bbbtesy.exe
                                                    "C:\windows\system32\bbbtesy.exe"
                                                    4⤵
                                                      PID:1684
                                                    • C:\windows\SysWOW64\aaxwqmj.exe
                                                      "C:\windows\system32\aaxwqmj.exe" "C:\windows\SysWOW64\bbbtesy.exe"
                                                      4⤵
                                                      • Drops file in System32 directory
                                                      PID:3016
                                                  • C:\windows\SysWOW64\bbbtesy.exe
                                                    "C:\windows\system32\bbbtesy.exe"
                                                    3⤵
                                                    • Executes dropped EXE
                                                    PID:1564
                                                  • C:\windows\SysWOW64\bbbtesy.exe
                                                    "C:\windows\system32\bbbtesy.exe"
                                                    3⤵
                                                    • Executes dropped EXE
                                                    PID:636
                                                  • C:\windows\SysWOW64\bbbtesy.exe
                                                    "C:\windows\system32\bbbtesy.exe"
                                                    3⤵
                                                    • Executes dropped EXE
                                                    PID:1860
                                                  • C:\windows\SysWOW64\bbbtesy.exe
                                                    "C:\windows\system32\bbbtesy.exe"
                                                    3⤵
                                                    • Executes dropped EXE
                                                    PID:1156
                                                  • C:\windows\SysWOW64\bbbtesy.exe
                                                    "C:\windows\system32\bbbtesy.exe"
                                                    3⤵
                                                    • Executes dropped EXE
                                                    PID:2960
                                                  • C:\windows\SysWOW64\bbbtesy.exe
                                                    "C:\windows\system32\bbbtesy.exe"
                                                    3⤵
                                                    • Executes dropped EXE
                                                    PID:2844
                                                  • C:\windows\SysWOW64\bbbtesy.exe
                                                    "C:\windows\system32\bbbtesy.exe"
                                                    3⤵
                                                    • Executes dropped EXE
                                                    PID:1928
                                                  • C:\windows\SysWOW64\bbbtesy.exe
                                                    "C:\windows\system32\bbbtesy.exe"
                                                    3⤵
                                                    • Executes dropped EXE
                                                    PID:540
                                                  • C:\windows\SysWOW64\bbbtesy.exe
                                                    "C:\windows\system32\bbbtesy.exe"
                                                    3⤵
                                                    • Executes dropped EXE
                                                    PID:2224
                                                  • C:\windows\SysWOW64\bbbtesy.exe
                                                    "C:\windows\system32\bbbtesy.exe"
                                                    3⤵
                                                    • Executes dropped EXE
                                                    PID:1960
                                                  • C:\windows\SysWOW64\bbbtesy.exe
                                                    "C:\windows\system32\bbbtesy.exe"
                                                    3⤵
                                                    • Executes dropped EXE
                                                    PID:1720
                                                  • C:\windows\SysWOW64\bbbtesy.exe
                                                    "C:\windows\system32\bbbtesy.exe"
                                                    3⤵
                                                    • Executes dropped EXE
                                                    PID:2432
                                                  • C:\windows\SysWOW64\bbbtesy.exe
                                                    "C:\windows\system32\bbbtesy.exe"
                                                    3⤵
                                                    • Executes dropped EXE
                                                    PID:1844
                                                  • C:\windows\SysWOW64\bbbtesy.exe
                                                    "C:\windows\system32\bbbtesy.exe"
                                                    3⤵
                                                    • Executes dropped EXE
                                                    PID:1880
                                                  • C:\windows\SysWOW64\bbbtesy.exe
                                                    "C:\windows\system32\bbbtesy.exe"
                                                    3⤵
                                                    • Executes dropped EXE
                                                    PID:936
                                                  • C:\windows\SysWOW64\bbbtesy.exe
                                                    "C:\windows\system32\bbbtesy.exe"
                                                    3⤵
                                                    • Executes dropped EXE
                                                    PID:1660
                                                  • C:\windows\SysWOW64\bbbtesy.exe
                                                    "C:\windows\system32\bbbtesy.exe"
                                                    3⤵
                                                    • Executes dropped EXE
                                                    PID:880
                                                  • C:\windows\SysWOW64\bbbtesy.exe
                                                    "C:\windows\system32\bbbtesy.exe"
                                                    3⤵
                                                    • Executes dropped EXE
                                                    PID:1576
                                                  • C:\windows\SysWOW64\bbbtesy.exe
                                                    "C:\windows\system32\bbbtesy.exe"
                                                    3⤵
                                                    • Executes dropped EXE
                                                    PID:1708
                                                  • C:\windows\SysWOW64\bbbtesy.exe
                                                    "C:\windows\system32\bbbtesy.exe"
                                                    3⤵
                                                    • Executes dropped EXE
                                                    PID:2244
                                                  • C:\windows\SysWOW64\bbbtesy.exe
                                                    "C:\windows\system32\bbbtesy.exe"
                                                    3⤵
                                                      PID:3012
                                                    • C:\windows\SysWOW64\bbbtesy.exe
                                                      "C:\windows\system32\bbbtesy.exe"
                                                      3⤵
                                                        PID:1896
                                                      • C:\windows\SysWOW64\bbbtesy.exe
                                                        "C:\windows\system32\bbbtesy.exe"
                                                        3⤵
                                                          PID:2540
                                                        • C:\windows\SysWOW64\bbbtesy.exe
                                                          "C:\windows\system32\bbbtesy.exe"
                                                          3⤵
                                                            PID:3020
                                                          • C:\windows\SysWOW64\bbbtesy.exe
                                                            "C:\windows\system32\bbbtesy.exe"
                                                            3⤵
                                                              PID:2684
                                                            • C:\windows\SysWOW64\bbbtesy.exe
                                                              "C:\windows\system32\bbbtesy.exe"
                                                              3⤵
                                                                PID:2612
                                                              • C:\windows\SysWOW64\bbbtesy.exe
                                                                "C:\windows\system32\bbbtesy.exe"
                                                                3⤵
                                                                  PID:2716
                                                                • C:\windows\SysWOW64\bbbtesy.exe
                                                                  "C:\windows\system32\bbbtesy.exe"
                                                                  3⤵
                                                                    PID:2492
                                                                  • C:\windows\SysWOW64\bbbtesy.exe
                                                                    "C:\windows\system32\bbbtesy.exe"
                                                                    3⤵
                                                                      PID:2628
                                                                    • C:\windows\SysWOW64\bbbtesy.exe
                                                                      "C:\windows\system32\bbbtesy.exe"
                                                                      3⤵
                                                                        PID:2380
                                                                      • C:\windows\SysWOW64\bbbtesy.exe
                                                                        "C:\windows\system32\bbbtesy.exe"
                                                                        3⤵
                                                                          PID:2528
                                                                        • C:\windows\SysWOW64\bbbtesy.exe
                                                                          "C:\windows\system32\bbbtesy.exe"
                                                                          3⤵
                                                                            PID:860
                                                                          • C:\windows\SysWOW64\bbbtesy.exe
                                                                            "C:\windows\system32\bbbtesy.exe"
                                                                            3⤵
                                                                              PID:1580
                                                                            • C:\windows\SysWOW64\bbbtesy.exe
                                                                              "C:\windows\system32\bbbtesy.exe"
                                                                              3⤵
                                                                                PID:2764
                                                                              • C:\windows\SysWOW64\bbbtesy.exe
                                                                                "C:\windows\system32\bbbtesy.exe"
                                                                                3⤵
                                                                                  PID:1644
                                                                                • C:\windows\SysWOW64\bbbtesy.exe
                                                                                  "C:\windows\system32\bbbtesy.exe"
                                                                                  3⤵
                                                                                    PID:2184
                                                                                  • C:\windows\SysWOW64\bbbtesy.exe
                                                                                    "C:\windows\system32\bbbtesy.exe"
                                                                                    3⤵
                                                                                      PID:1328
                                                                                    • C:\windows\SysWOW64\bbbtesy.exe
                                                                                      "C:\windows\system32\bbbtesy.exe"
                                                                                      3⤵
                                                                                        PID:552
                                                                                      • C:\windows\SysWOW64\bbbtesy.exe
                                                                                        "C:\windows\system32\bbbtesy.exe"
                                                                                        3⤵
                                                                                          PID:680
                                                                                        • C:\windows\SysWOW64\bbbtesy.exe
                                                                                          "C:\windows\system32\bbbtesy.exe"
                                                                                          3⤵
                                                                                            PID:668
                                                                                          • C:\windows\SysWOW64\bbbtesy.exe
                                                                                            "C:\windows\system32\bbbtesy.exe"
                                                                                            3⤵
                                                                                              PID:2040
                                                                                            • C:\windows\SysWOW64\bbbtesy.exe
                                                                                              "C:\windows\system32\bbbtesy.exe"
                                                                                              3⤵
                                                                                                PID:2812
                                                                                              • C:\windows\SysWOW64\aaxwqmj.exe
                                                                                                "C:\windows\system32\aaxwqmj.exe"
                                                                                                3⤵
                                                                                                  PID:2256
                                                                                                • C:\windows\SysWOW64\aaxwqmj.exe
                                                                                                  "C:\windows\system32\aaxwqmj.exe"
                                                                                                  3⤵
                                                                                                    PID:1052
                                                                                                  • C:\windows\SysWOW64\aaxwqmj.exe
                                                                                                    "C:\windows\system32\aaxwqmj.exe"
                                                                                                    3⤵
                                                                                                      PID:1776
                                                                                                    • C:\windows\SysWOW64\aaxwqmj.exe
                                                                                                      "C:\windows\system32\aaxwqmj.exe"
                                                                                                      3⤵
                                                                                                        PID:3068
                                                                                                      • C:\windows\SysWOW64\aaxwqmj.exe
                                                                                                        "C:\windows\system32\aaxwqmj.exe"
                                                                                                        3⤵
                                                                                                          PID:2316
                                                                                                        • C:\windows\SysWOW64\aaxwqmj.exe
                                                                                                          "C:\windows\system32\aaxwqmj.exe"
                                                                                                          3⤵
                                                                                                            PID:1228
                                                                                                        • C:\windows\SysWOW64\bbbtesy.exe
                                                                                                          "C:\windows\system32\bbbtesy.exe" "C:\Users\Admin\AppData\Local\Temp\77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe"
                                                                                                          2⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          PID:2304
                                                                                                        • C:\windows\jrdom.exe
                                                                                                          "C:\windows\jrdom.exe" "C:\Users\Admin\AppData\Local\Temp\77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe"
                                                                                                          2⤵
                                                                                                          • Drops file in Drivers directory
                                                                                                          • Executes dropped EXE
                                                                                                          • Loads dropped DLL
                                                                                                          • Adds Run key to start application
                                                                                                          • Drops file in System32 directory
                                                                                                          • Drops file in Windows directory
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:2620
                                                                                                          • C:\windows\SysWOW64\bbbtesy.exe
                                                                                                            "C:\windows\system32\bbbtesy.exe"
                                                                                                            3⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:1524
                                                                                                          • C:\windows\SysWOW64\bbbtesy.exe
                                                                                                            "C:\windows\system32\bbbtesy.exe"
                                                                                                            3⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:2176
                                                                                                          • C:\windows\SysWOW64\bbbtesy.exe
                                                                                                            "C:\windows\system32\bbbtesy.exe"
                                                                                                            3⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:752
                                                                                                          • C:\windows\SysWOW64\bbbtesy.exe
                                                                                                            "C:\windows\system32\bbbtesy.exe"
                                                                                                            3⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:2040
                                                                                                          • C:\windows\SysWOW64\bbbtesy.exe
                                                                                                            "C:\windows\system32\bbbtesy.exe"
                                                                                                            3⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:2004
                                                                                                          • C:\windows\SysWOW64\bbbtesy.exe
                                                                                                            "C:\windows\system32\bbbtesy.exe"
                                                                                                            3⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:2836
                                                                                                          • C:\windows\SysWOW64\bbbtesy.exe
                                                                                                            "C:\windows\system32\bbbtesy.exe"
                                                                                                            3⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:1404
                                                                                                          • C:\windows\SysWOW64\bbbtesy.exe
                                                                                                            "C:\windows\system32\bbbtesy.exe"
                                                                                                            3⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:1972
                                                                                                          • C:\windows\SysWOW64\bbbtesy.exe
                                                                                                            "C:\windows\system32\bbbtesy.exe"
                                                                                                            3⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:1952
                                                                                                          • C:\windows\SysWOW64\bbbtesy.exe
                                                                                                            "C:\windows\system32\bbbtesy.exe"
                                                                                                            3⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:1552
                                                                                                          • C:\windows\SysWOW64\bbbtesy.exe
                                                                                                            "C:\windows\system32\bbbtesy.exe"
                                                                                                            3⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:856
                                                                                                          • C:\windows\SysWOW64\bbbtesy.exe
                                                                                                            "C:\windows\system32\bbbtesy.exe"
                                                                                                            3⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:1092
                                                                                                          • C:\windows\SysWOW64\bbbtesy.exe
                                                                                                            "C:\windows\system32\bbbtesy.exe"
                                                                                                            3⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:2272
                                                                                                          • C:\windows\SysWOW64\bbbtesy.exe
                                                                                                            "C:\windows\system32\bbbtesy.exe"
                                                                                                            3⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:1456
                                                                                                          • C:\windows\SysWOW64\bbbtesy.exe
                                                                                                            "C:\windows\system32\bbbtesy.exe"
                                                                                                            3⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:1268
                                                                                                          • C:\windows\SysWOW64\bbbtesy.exe
                                                                                                            "C:\windows\system32\bbbtesy.exe"
                                                                                                            3⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:1012
                                                                                                          • C:\windows\SysWOW64\bbbtesy.exe
                                                                                                            "C:\windows\system32\bbbtesy.exe"
                                                                                                            3⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:2240
                                                                                                          • C:\windows\SysWOW64\bbbtesy.exe
                                                                                                            "C:\windows\system32\bbbtesy.exe"
                                                                                                            3⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:1936
                                                                                                          • C:\windows\SysWOW64\bbbtesy.exe
                                                                                                            "C:\windows\system32\bbbtesy.exe"
                                                                                                            3⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:2076
                                                                                                          • C:\windows\SysWOW64\bbbtesy.exe
                                                                                                            "C:\windows\system32\bbbtesy.exe"
                                                                                                            3⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:560
                                                                                                          • C:\windows\SysWOW64\bbbtesy.exe
                                                                                                            "C:\windows\system32\bbbtesy.exe"
                                                                                                            3⤵
                                                                                                              PID:616
                                                                                                            • C:\windows\SysWOW64\bbbtesy.exe
                                                                                                              "C:\windows\system32\bbbtesy.exe"
                                                                                                              3⤵
                                                                                                                PID:2904
                                                                                                              • C:\windows\SysWOW64\bbbtesy.exe
                                                                                                                "C:\windows\system32\bbbtesy.exe"
                                                                                                                3⤵
                                                                                                                  PID:1632
                                                                                                                • C:\windows\SysWOW64\bbbtesy.exe
                                                                                                                  "C:\windows\system32\bbbtesy.exe"
                                                                                                                  3⤵
                                                                                                                    PID:3024
                                                                                                                  • C:\windows\SysWOW64\bbbtesy.exe
                                                                                                                    "C:\windows\system32\bbbtesy.exe"
                                                                                                                    3⤵
                                                                                                                      PID:2600
                                                                                                                    • C:\windows\SysWOW64\bbbtesy.exe
                                                                                                                      "C:\windows\system32\bbbtesy.exe"
                                                                                                                      3⤵
                                                                                                                        PID:2720
                                                                                                                      • C:\windows\SysWOW64\bbbtesy.exe
                                                                                                                        "C:\windows\system32\bbbtesy.exe"
                                                                                                                        3⤵
                                                                                                                          PID:2580
                                                                                                                        • C:\windows\SysWOW64\bbbtesy.exe
                                                                                                                          "C:\windows\system32\bbbtesy.exe"
                                                                                                                          3⤵
                                                                                                                            PID:2572
                                                                                                                          • C:\windows\SysWOW64\bbbtesy.exe
                                                                                                                            "C:\windows\system32\bbbtesy.exe"
                                                                                                                            3⤵
                                                                                                                              PID:2480
                                                                                                                            • C:\windows\SysWOW64\bbbtesy.exe
                                                                                                                              "C:\windows\system32\bbbtesy.exe"
                                                                                                                              3⤵
                                                                                                                                PID:2512
                                                                                                                              • C:\windows\SysWOW64\bbbtesy.exe
                                                                                                                                "C:\windows\system32\bbbtesy.exe"
                                                                                                                                3⤵
                                                                                                                                  PID:2728
                                                                                                                                • C:\windows\SysWOW64\bbbtesy.exe
                                                                                                                                  "C:\windows\system32\bbbtesy.exe"
                                                                                                                                  3⤵
                                                                                                                                    PID:1236
                                                                                                                                  • C:\windows\SysWOW64\bbbtesy.exe
                                                                                                                                    "C:\windows\system32\bbbtesy.exe"
                                                                                                                                    3⤵
                                                                                                                                      PID:2784
                                                                                                                                    • C:\windows\SysWOW64\bbbtesy.exe
                                                                                                                                      "C:\windows\system32\bbbtesy.exe"
                                                                                                                                      3⤵
                                                                                                                                        PID:768
                                                                                                                                      • C:\windows\SysWOW64\bbbtesy.exe
                                                                                                                                        "C:\windows\system32\bbbtesy.exe"
                                                                                                                                        3⤵
                                                                                                                                          PID:1564
                                                                                                                                        • C:\windows\SysWOW64\bbbtesy.exe
                                                                                                                                          "C:\windows\system32\bbbtesy.exe"
                                                                                                                                          3⤵
                                                                                                                                            PID:996
                                                                                                                                          • C:\windows\SysWOW64\bbbtesy.exe
                                                                                                                                            "C:\windows\system32\bbbtesy.exe"
                                                                                                                                            3⤵
                                                                                                                                              PID:2148
                                                                                                                                            • C:\windows\SysWOW64\bbbtesy.exe
                                                                                                                                              "C:\windows\system32\bbbtesy.exe"
                                                                                                                                              3⤵
                                                                                                                                                PID:844
                                                                                                                                              • C:\windows\SysWOW64\bbbtesy.exe
                                                                                                                                                "C:\windows\system32\bbbtesy.exe"
                                                                                                                                                3⤵
                                                                                                                                                  PID:780
                                                                                                                                                • C:\windows\SysWOW64\bbbtesy.exe
                                                                                                                                                  "C:\windows\system32\bbbtesy.exe"
                                                                                                                                                  3⤵
                                                                                                                                                    PID:2252
                                                                                                                                                  • C:\windows\SysWOW64\bbbtesy.exe
                                                                                                                                                    "C:\windows\system32\bbbtesy.exe"
                                                                                                                                                    3⤵
                                                                                                                                                      PID:2000
                                                                                                                                                    • C:\windows\SysWOW64\bbbtesy.exe
                                                                                                                                                      "C:\windows\system32\bbbtesy.exe"
                                                                                                                                                      3⤵
                                                                                                                                                        PID:2012
                                                                                                                                                      • C:\windows\SysWOW64\aaxwqmj.exe
                                                                                                                                                        "C:\windows\system32\aaxwqmj.exe"
                                                                                                                                                        3⤵
                                                                                                                                                        • Drops file in Drivers directory
                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                        PID:2220
                                                                                                                                                        • C:\windows\SysWOW64\aaxwqmj.exe
                                                                                                                                                          "C:\windows\system32\aaxwqmj.exe"
                                                                                                                                                          4⤵
                                                                                                                                                            PID:1112
                                                                                                                                                          • C:\windows\SysWOW64\aaxwqmj.exe
                                                                                                                                                            "C:\windows\system32\aaxwqmj.exe"
                                                                                                                                                            4⤵
                                                                                                                                                              PID:1716
                                                                                                                                                            • C:\windows\SysWOW64\aaxwqmj.exe
                                                                                                                                                              "C:\windows\system32\aaxwqmj.exe"
                                                                                                                                                              4⤵
                                                                                                                                                                PID:1076
                                                                                                                                                              • C:\windows\SysWOW64\aaxwqmj.exe
                                                                                                                                                                "C:\windows\system32\aaxwqmj.exe"
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:2328
                                                                                                                                                                • C:\windows\SysWOW64\aaxwqmj.exe
                                                                                                                                                                  "C:\windows\system32\aaxwqmj.exe"
                                                                                                                                                                  4⤵
                                                                                                                                                                    PID:1460
                                                                                                                                                                • C:\windows\SysWOW64\aaxwqmj.exe
                                                                                                                                                                  "C:\windows\system32\aaxwqmj.exe"
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:1396
                                                                                                                                                                  • C:\windows\SysWOW64\aaxwqmj.exe
                                                                                                                                                                    "C:\windows\system32\aaxwqmj.exe"
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:2692
                                                                                                                                                                    • C:\windows\SysWOW64\aaxwqmj.exe
                                                                                                                                                                      "C:\windows\system32\aaxwqmj.exe"
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:1152
                                                                                                                                                                      • C:\windows\SysWOW64\aaxwqmj.exe
                                                                                                                                                                        "C:\windows\system32\aaxwqmj.exe"
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:2284
                                                                                                                                                                        • C:\windows\SysWOW64\aaxwqmj.exe
                                                                                                                                                                          "C:\windows\system32\aaxwqmj.exe"
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:1444

                                                                                                                                                                      Network

                                                                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                                                                      Replay Monitor

                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                      Downloads

                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exejxmktrq.exe_
                                                                                                                                                                        Filesize

                                                                                                                                                                        824KB

                                                                                                                                                                        MD5

                                                                                                                                                                        df4c3258b1787546a9caa598b9fe740f

                                                                                                                                                                        SHA1

                                                                                                                                                                        43525098551d4d601e423ef6cbc4abb2e9053adf

                                                                                                                                                                        SHA256

                                                                                                                                                                        eb700b9142395565f60da84af4289b713e30f90c760e1d4f689cdcc358963fd6

                                                                                                                                                                        SHA512

                                                                                                                                                                        19e06487a6a7b188af9aab91d8f90bda949f133282c50edaff3afec305b6b45bb9958b31c2224ffd89c7c33edea68ca6626f62d444160b388f05a71e45109c08

                                                                                                                                                                        Download Submit

                                                                                                                                                                      • \Windows\SysWOW64\bbbtesy.exe
                                                                                                                                                                        Filesize

                                                                                                                                                                        629KB

                                                                                                                                                                        MD5

                                                                                                                                                                        77076524991a132b4d23bb7e83a9edb0

                                                                                                                                                                        SHA1

                                                                                                                                                                        f8439a70ac3b851a5e67da4b91ca28ec5abc879c

                                                                                                                                                                        SHA256

                                                                                                                                                                        8999ee0edae430356495baac9163eca6583f679a709179c45688a8e69d319324

                                                                                                                                                                        SHA512

                                                                                                                                                                        a97809ef692471182abb85963b7822750015f024603520bc36fc1bb4fa7fa3a9eceb5253859594184b51817e93df91654aac55a912de56a7bd08fb7b0c79542a

                                                                                                                                                                        Download Submit