Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 12:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe
-
Size
843KB
-
MD5
44a951475bbf66cefc34b1fc3845b580
-
SHA1
20dae9ecb9278ad5e7c518a276f8a594edc5a114
-
SHA256
9221fcebfa4240f4267240bceb4744a30033ffd50875cf2af562f9da2f5240a1
-
SHA512
c087b652a9b2283813313d27fdde4f26705764136b40b8c485fb95a806e1f5a47239ffc87651714f6287e5b93d06a3b752415c0984c1bf835087aeb3be6634ab
-
SSDEEP
12288:TwKfOVRo9yRYK42X5sUSF14tr4O8b8ITDnlLvAYrIw6E:TxWVeyRYK4s2hzM4O8b8ITDnl7CE
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 2348 microsoftinfopath.exe 2252 operatingmicrosoft.exe 1204 nppdf32acrobat.exe 2240 sourceengine.exe -
Loads dropped DLL 4 IoCs
pid Process 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe -
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SourceOffice = "c:\\program files (x86)\\common files\\microsoft shared\\source engine\\sourceengine.exe" 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\EngineOffice = "C:\\Users\\Admin\\AppData\\Local\\Temp\\44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe" 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\EngineSource = "C:\\Users\\Admin\\AppData\\Local\\Temp\\44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe" 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\msader15Microsoft = "c:\\program files (x86)\\common files\\system\\ado\\ja-jp\\operatingmicrosoft.exe" 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OfficeMicrosoft = "c:\\program files (x86)\\microsoft office\\office14\\infopathom\\microsoftinfopath.exe" 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\msinfoSystme = "c:\\program files (x86)\\common files\\microsoft shared\\msinfo\\fr-fr\\dexploitationwindows.exe" 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BCSSync = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\BCSSync.exe\" /DelayServices" 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\AcrobatNPPDF32 = "c:\\program files (x86)\\adobe\\reader 9.0\\reader\\browser\\nppdf32acrobat.exe" 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\pdf417pmpdatamatrixpmp2.8.8118.0 = "c:\\program files (x86)\\adobe\\reader 9.0\\reader\\plug_ins\\acroform\\pmp\\qrcodepmppdf417pmp.exe" 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\ntdll.dll.dll 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe File created C:\Windows\SysWOW64\ntdll.dll.dll microsoftinfopath.exe File created C:\Windows\SysWOW64\ntdll.dll.dll operatingmicrosoft.exe File created C:\Windows\SysWOW64\ntdll.dll.dll nppdf32acrobat.exe File created C:\Windows\SysWOW64\ntdll.dll.dll sourceengine.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\RCX36BE.tmp 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\RCX2195.tmp 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\ja-JP\RCX21A6.tmp 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\NPPDF32Acrobat.exe 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\fr-FR\EngineMSTTSLoc.exe 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\RCX36CE.tmp 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\SourceEngine.exe 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\RCX36BD.tmp 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\dexploitationWindows.exe 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe File created C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\MicrosoftInfoPath.exe 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\RCX2175.tmp 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\qrcodepmppdf417pmp.exe 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\MicrosoftInfoPath.exe 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\System\ado\ja-JP\OperatingMicrosoft.exe 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe -
Checks processor information in registry 2 TTPs 15 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 nppdf32acrobat.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString sourceengine.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier sourceengine.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 operatingmicrosoft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier operatingmicrosoft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString nppdf32acrobat.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 microsoftinfopath.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier nppdf32acrobat.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 sourceengine.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString operatingmicrosoft.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString microsoftinfopath.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier microsoftinfopath.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2348 microsoftinfopath.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2252 operatingmicrosoft.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 1204 nppdf32acrobat.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2240 sourceengine.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2148 wrote to memory of 2348 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 30 PID 2148 wrote to memory of 2348 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 30 PID 2148 wrote to memory of 2348 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 30 PID 2148 wrote to memory of 2348 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 30 PID 2148 wrote to memory of 2348 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 30 PID 2148 wrote to memory of 2348 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 30 PID 2148 wrote to memory of 2348 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 30 PID 2148 wrote to memory of 2252 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 31 PID 2148 wrote to memory of 2252 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 31 PID 2148 wrote to memory of 2252 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 31 PID 2148 wrote to memory of 2252 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 31 PID 2148 wrote to memory of 2252 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 31 PID 2148 wrote to memory of 2252 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 31 PID 2148 wrote to memory of 2252 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 31 PID 2148 wrote to memory of 1204 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 33 PID 2148 wrote to memory of 1204 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 33 PID 2148 wrote to memory of 1204 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 33 PID 2148 wrote to memory of 1204 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 33 PID 2148 wrote to memory of 1204 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 33 PID 2148 wrote to memory of 1204 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 33 PID 2148 wrote to memory of 1204 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 33 PID 2148 wrote to memory of 2240 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 34 PID 2148 wrote to memory of 2240 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 34 PID 2148 wrote to memory of 2240 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 34 PID 2148 wrote to memory of 2240 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 34 PID 2148 wrote to memory of 2240 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 34 PID 2148 wrote to memory of 2240 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 34 PID 2148 wrote to memory of 2240 2148 44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\44a951475bbf66cefc34b1fc3845b580_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\program files (x86)\microsoft office\office14\infopathom\microsoftinfopath.exe"c:\program files (x86)\microsoft office\office14\infopathom\microsoftinfopath.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2348
-
-
\??\c:\program files (x86)\common files\system\ado\ja-jp\operatingmicrosoft.exe"c:\program files (x86)\common files\system\ado\ja-jp\operatingmicrosoft.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2252
-
-
\??\c:\program files (x86)\adobe\reader 9.0\reader\browser\nppdf32acrobat.exe"c:\program files (x86)\adobe\reader 9.0\reader\browser\nppdf32acrobat.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1204
-
-
\??\c:\program files (x86)\common files\microsoft shared\source engine\sourceengine.exe"c:\program files (x86)\common files\microsoft shared\source engine\sourceengine.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2240
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
845KB
MD5e3f5d21ee8e755592f316b155fe3c7d2
SHA1bb46f1e95a85e75116723fde8b5467ae96abcd56
SHA256b3aabaa0dbdae465cdb57c0420ebb4071ed66b2a7d83b388d6d9e6ed889f3c34
SHA512a6a6ed91f3513023da3533a267d9b2bb7e89c29aeadd78be50971da56c8353f9597b8b8a320437e9201e32d29a8a98e9bfc948019a5104cbc43f29211d491afc
-
Filesize
843KB
MD544a951475bbf66cefc34b1fc3845b580
SHA120dae9ecb9278ad5e7c518a276f8a594edc5a114
SHA2569221fcebfa4240f4267240bceb4744a30033ffd50875cf2af562f9da2f5240a1
SHA512c087b652a9b2283813313d27fdde4f26705764136b40b8c485fb95a806e1f5a47239ffc87651714f6287e5b93d06a3b752415c0984c1bf835087aeb3be6634ab