Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/05/2024, 21:23

General

  • Target

    56185c7ff9fe82048b7268875dc59fa0_NeikiAnalytics.exe

  • Size

    352KB

  • MD5

    56185c7ff9fe82048b7268875dc59fa0

  • SHA1

    4ccafa612274d1267689d8da4771bfc5a56cfb7d

  • SHA256

    4d02eef5a2923708b227fa39a3f397078e0a42f5a3bae71df65bfb2bdd4249cb

  • SHA512

    7bde3d576a13bdd5782c22277baf2ebfc33e81c439fe0b26c4c089faa8f40b83516394fd2cdd951ff6f836c1caeeb6b2046d2c28adfa9d0801aaadca201ee41b

  • SSDEEP

    6144:vIGEnprZkRs38t54c6rzNdfTIGEnprZkRs38t54c6rzNdfH:vxEnAR934PxEnAR934D

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 12 IoCs
  • Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
  • Disables use of System Restore points 1 TTPs
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 1 IoCs
  • Modifies system executable filetype association 2 TTPs 62 IoCs
  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 24 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in System32 directory 14 IoCs
  • Drops file in Windows directory 19 IoCs
  • Modifies Control Panel 42 IoCs
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
  • Modifies Internet Explorer start page 1 TTPs 6 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\56185c7ff9fe82048b7268875dc59fa0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\56185c7ff9fe82048b7268875dc59fa0_NeikiAnalytics.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Drops file in Drivers directory
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4224
    • C:\Windows\WlNLOGON.EXE
      C:\Windows\WlNLOGON.EXE
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:540
    • C:\Windows\SysWOW64\Shell.exe
      C:\Windows\system32\Shell.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:964
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1388
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1540
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2988

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE

    Filesize

    352KB

    MD5

    b8e9a513ee5c8d6766c41237670c7614

    SHA1

    49e779d697bc240394fcc4510fa7a700f113c14f

    SHA256

    46d1e3baaf5f74e2865e57a6ced8ee7bde6b3d9841042dd22d4b5879f4578daf

    SHA512

    b393d1395a82e1ca7b40b815103070c8a8a41eb1694a33d3589d3374105882b698300385e9579741dfa79d9b2607c0c9f39362b06f8d4a5a1dc3b0ba7f1cd9bd

  • C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

    Filesize

    352KB

    MD5

    22e4740ce8102844ebf4bf1248ca6380

    SHA1

    46e23cc4418d79240a58d864abc6c56c1d69b293

    SHA256

    07552ec118cfbd7bbc676682aab6dc67b179eb9c79e91cb0d4b659f01c96189e

    SHA512

    f25620de54bd3b714493dd61d1132e4bdb084828b95d1e33c90d28d6a7858e8b5821d8021d92a1077bc58aa799987c46456dc573f8a3291421b877bf78ffa1ed

  • C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE

    Filesize

    352KB

    MD5

    020620664d93e44c01354f9d7ea9cb61

    SHA1

    6ba418fdf13cbddd09c28a1daf3fdae7a16f1014

    SHA256

    12cbb2d67ddee02d34eeb6ae05e03f95b236df4368fd4becd140344607c5e95f

    SHA512

    8ceb6de776aaa53779f22f727c4743f10c436beba1a792346e92281defdc976209861a030ae6e38861fc3244b9f0453f70befc7ba7d02e5d884402c739cafbe4

  • C:\Users\Admin\AppData\Local\services.exe

    Filesize

    352KB

    MD5

    56185c7ff9fe82048b7268875dc59fa0

    SHA1

    4ccafa612274d1267689d8da4771bfc5a56cfb7d

    SHA256

    4d02eef5a2923708b227fa39a3f397078e0a42f5a3bae71df65bfb2bdd4249cb

    SHA512

    7bde3d576a13bdd5782c22277baf2ebfc33e81c439fe0b26c4c089faa8f40b83516394fd2cdd951ff6f836c1caeeb6b2046d2c28adfa9d0801aaadca201ee41b

  • C:\Windows\Desktop.ini

    Filesize

    65B

    MD5

    990a0bd866566534e37192439277e040

    SHA1

    90abfe04350a375df3beddd411256143e606461b

    SHA256

    ee3aaf1bcc2539bdddb6f25f4d0902cd023d83d902196d1bf2fcd37a73469038

    SHA512

    e598c68ae8f1a62cbc870fb7cf2c634ba24d1f1bfa62428a23aac7c914b3a775fa06564b6e084eaf9215086da433a80e49f2cbe81ca990414df3e57716dea4b7

  • C:\Windows\MSVBVM60.DLL

    Filesize

    1.4MB

    MD5

    25f62c02619174b35851b0e0455b3d94

    SHA1

    4e8ee85157f1769f6e3f61c0acbe59072209da71

    SHA256

    898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

    SHA512

    f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

  • C:\Windows\SysWOW64\OEMINFO.ini

    Filesize

    462B

    MD5

    45d327d7d806625d696945dea064d7a2

    SHA1

    81a36b2a66c8dcce870a82409c6f772cc06addf0

    SHA256

    e022ef7261dfe3e79b78e4bff605ae3f0480cd54d80b7c3358bd9091a0f0f04a

    SHA512

    8b78bb4fa2c05d509cf171525b0ba7bf735a8890854f0ef16b29c9456ff547ccd86423068f61c21b8f35a0797ee44f9a8697861c34f133c6c26dfcf99e8f849c

  • C:\Windows\SysWOW64\OEMLOGO.BMP

    Filesize

    40KB

    MD5

    4de286f5923036648db750d58ba496e8

    SHA1

    0252d5d6c7a3b7dfa71fca4b30a53522fd7c6f67

    SHA256

    eb79555170611879e79b4cdba59bdf679e63df9d7927d01354e5cf859274c58c

    SHA512

    069daaa01a04add11a9e5fc0988b5d42e6ad50011fa148df41ffb3a905ffc170ab65ba66f4ad921306503d8792dd192c173c532232fc7ef146c09aa76ddf548f

  • C:\Windows\SysWOW64\shell.exe

    Filesize

    352KB

    MD5

    29b15020fb3e3a793f27d8d2bc4a81b8

    SHA1

    1f99fc956d937b087fcd6f7f98469018b4accc0e

    SHA256

    298e3007ee55d4026ba8c876de20da26a67a8215a0fadbc612ef5acb89dd087d

    SHA512

    2e52e12442e1a59ce1746bf1c11cb8b2bed5c51c8a84ff31698e7ad90e8a47242ff882d7be4e30099a32d01cf7fd735ecaff85c215707c02e26e57d408a91652

  • C:\Windows\WlNLOGON.EXE

    Filesize

    352KB

    MD5

    19d10fd4f109c1cf38811331556e1479

    SHA1

    18cbd02c26768fd32368c2ebeee63d7baead06a0

    SHA256

    2626b592cc297ec207464f50384d0a4af23be3c9a694cf1099170fae1ee4628d

    SHA512

    543049371f47e8695ddaca02c6946a2382d46ae6fc946c6641f8b9b19d0598177a169b8da4bab607255ee3b1a9e740c9e486ac3edd3cc7348438946c480b76a4

  • memory/540-132-0x0000000000400000-0x00000000004AA000-memory.dmp

    Filesize

    680KB

  • memory/964-147-0x0000000000400000-0x00000000004AA000-memory.dmp

    Filesize

    680KB

  • memory/1388-103-0x0000000000400000-0x00000000004AA000-memory.dmp

    Filesize

    680KB

  • memory/1388-162-0x0000000000400000-0x00000000004AA000-memory.dmp

    Filesize

    680KB

  • memory/1540-178-0x0000000000400000-0x00000000004AA000-memory.dmp

    Filesize

    680KB

  • memory/2988-195-0x0000000000400000-0x00000000004AA000-memory.dmp

    Filesize

    680KB

  • memory/4224-0-0x0000000000400000-0x00000000004AA000-memory.dmp

    Filesize

    680KB

  • memory/4224-126-0x0000000000400000-0x00000000004AA000-memory.dmp

    Filesize

    680KB