Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
30/05/2024, 03:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
61de036bf4ee6266864e8f4d872f4590_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
61de036bf4ee6266864e8f4d872f4590_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
61de036bf4ee6266864e8f4d872f4590_NeikiAnalytics.exe
-
Size
72KB
-
MD5
61de036bf4ee6266864e8f4d872f4590
-
SHA1
c4f5c976b761ea8bdc4c7631d08f2666103de389
-
SHA256
4524b9efba95b60bb75596bd85653e54ae94132d386190ff86a28b53cfaa1b28
-
SHA512
69127883257164473a56278ad6b068210bf204f040f8a1dbb1e355fccb9bab9d3758d6d25efc255ec4ba86481e2844079d1094dd4751e570632bea2916c1aafd
-
SSDEEP
1536:xFA56h4XCr4FQ1qOFufvaxsYK281DHK2Fs6UDhDZFSLHXVGIynej:Di6aQR0XLF1Dqb6UDhDZFSLHXVEej
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" utteasut-ageab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" utteasut-ageab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" utteasut-ageab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" utteasut-ageab.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{554F5448-4350-4851-554F-544843504851} utteasut-ageab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{554F5448-4350-4851-554F-544843504851}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" utteasut-ageab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{554F5448-4350-4851-554F-544843504851}\IsInstalled = "1" utteasut-ageab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{554F5448-4350-4851-554F-544843504851}\StubPath = "C:\\Windows\\system32\\ondohoam.exe" utteasut-ageab.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe utteasut-ageab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" utteasut-ageab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ebmatob.exe" utteasut-ageab.exe -
Executes dropped EXE 2 IoCs
pid Process 1436 utteasut-ageab.exe 1748 utteasut-ageab.exe -
Loads dropped DLL 3 IoCs
pid Process 2844 61de036bf4ee6266864e8f4d872f4590_NeikiAnalytics.exe 2844 61de036bf4ee6266864e8f4d872f4590_NeikiAnalytics.exe 1436 utteasut-ageab.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" utteasut-ageab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" utteasut-ageab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" utteasut-ageab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" utteasut-ageab.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} utteasut-ageab.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify utteasut-ageab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" utteasut-ageab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\aggodoov-cooc.dll" utteasut-ageab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" utteasut-ageab.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\utteasut-ageab.exe 61de036bf4ee6266864e8f4d872f4590_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\aggodoov-cooc.dll utteasut-ageab.exe File created C:\Windows\SysWOW64\ondohoam.exe utteasut-ageab.exe File created C:\Windows\SysWOW64\aggodoov-cooc.dll utteasut-ageab.exe File opened for modification C:\Windows\SysWOW64\utteasut-ageab.exe utteasut-ageab.exe File created C:\Windows\SysWOW64\utteasut-ageab.exe 61de036bf4ee6266864e8f4d872f4590_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\ebmatob.exe utteasut-ageab.exe File created C:\Windows\SysWOW64\ebmatob.exe utteasut-ageab.exe File opened for modification C:\Windows\SysWOW64\ondohoam.exe utteasut-ageab.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1748 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe 1436 utteasut-ageab.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1436 utteasut-ageab.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2844 wrote to memory of 1436 2844 61de036bf4ee6266864e8f4d872f4590_NeikiAnalytics.exe 28 PID 2844 wrote to memory of 1436 2844 61de036bf4ee6266864e8f4d872f4590_NeikiAnalytics.exe 28 PID 2844 wrote to memory of 1436 2844 61de036bf4ee6266864e8f4d872f4590_NeikiAnalytics.exe 28 PID 2844 wrote to memory of 1436 2844 61de036bf4ee6266864e8f4d872f4590_NeikiAnalytics.exe 28 PID 1436 wrote to memory of 428 1436 utteasut-ageab.exe 5 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1748 1436 utteasut-ageab.exe 29 PID 1436 wrote to memory of 1748 1436 utteasut-ageab.exe 29 PID 1436 wrote to memory of 1748 1436 utteasut-ageab.exe 29 PID 1436 wrote to memory of 1748 1436 utteasut-ageab.exe 29 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21 PID 1436 wrote to memory of 1216 1436 utteasut-ageab.exe 21
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:428
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\61de036bf4ee6266864e8f4d872f4590_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\61de036bf4ee6266864e8f4d872f4590_NeikiAnalytics.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\SysWOW64\utteasut-ageab.exe"C:\Windows\SysWOW64\utteasut-ageab.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\SysWOW64\utteasut-ageab.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1748
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
Filesize
73KB
MD59c0c374ddf8d39f679f58c4e92b4d01a
SHA16a4763d67c127034c1691ecd0d7bfb84f389b4dd
SHA2560a5079a5508687173c9438d9a979c46384c2a75c41a84681e7965eb8458149d0
SHA512fe037f7985e0e4e92dfe732685839e4f36385336bada0c22178ff55ba509f33d4a762df920d0add66a163a5d68f4d862c610a20753634dc9748d67e03c033856
-
Filesize
72KB
MD5964c0645601c372c4c7233d7f5bba4ea
SHA116972fce8e68492e2e319e30a84d7fa1ce026244
SHA256a70e5d1fa747177a88e159a34dabfc62f63f6f70aafd91200babf7854967cb8e
SHA512c154b639b43c64d6bd5eb91920fd8a50ace5d3037debd458c0de22c50d6506a40e2e7d1202793c19e558e92bbb38b270395d8d0186102257b730b1f88f7d8bc3
-
Filesize
70KB
MD52b9bbbbef8f8c16abe4559de79a0ebf1
SHA1c92497507fde5caf15130bf1cf88d5017e3cfbff
SHA256fd6fe433a41b194720d083015dca28bddc9e48a141a47f4a70f39ccb70ff39fe
SHA51237a3075d7606f64bc14de82044d46899c3989fc1038e812c31448b2fa7e84058c7799023d684d9da0ede3dcfb236f359fafe0e1f9d71a8ea90eafaa1459ccc28