Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
31/05/2024, 17:32
General
-
Target
59b1984572c2ae6a7dddbf7b56738130_NeikiAnalytics.dll
-
Size
468KB
-
MD5
59b1984572c2ae6a7dddbf7b56738130
-
SHA1
864b626f79aa3a7feaf04c95f20b37d02b18e1bd
-
SHA256
15e502896e34d87921319a8830dc75d38580e5d15dcbbd9f9ee882efcabf3352
-
SHA512
29b7089f232e74b0620b2245c40b314d64010d7ac0a11b4b4de49a3aa59e8eb1e28eae3b063bf31bcafff0d4a30375c48f1400ff133b6cefa45ed521a78ea25b
-
SSDEEP
6144:oi05kH9OyU2uv5SRf/FWgFgt0gqIRAUW9kVYeVprU4wfhTv5xD2ZP0GVGdXcukT4:7rHGPv5SmptZDmUWuVZkxikdXcq
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 10 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 14 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 22 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\59b1984572c2ae6a7dddbf7b56738130_NeikiAnalytics.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\DsmUserTask.exeC:\Windows\system32\DsmUserTask.exe1⤵
-
C:\Windows\system32\NetCfgNotifyObjectHost.exeC:\Windows\system32\NetCfgNotifyObjectHost.exe1⤵
-
C:\Windows\system32\rdpshell.exeC:\Windows\system32\rdpshell.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\u3GCno4.cmd1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Delete /F /TN "User_Feed_Synchronization-{6893c48b-093d-67fa-0118-e174d21e6c79}"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /TN "User_Feed_Synchronization-{6893c48b-093d-67fa-0118-e174d21e6c79}"2⤵
-
-
C:\Windows\system32\ddodiag.exeC:\Windows\system32\ddodiag.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\RF70Ejn.cmd1⤵
- Drops file in System32 directory
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\3K0p8N.cmd2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /F /TN "Zjytiviekgag" /SC minute /MO 60 /TR "C:\Windows\system32\2577\ddodiag.exe" /RL highest3⤵
- Creates scheduled task(s)
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
130B
MD5d7b2fa08987dc6f71381ee56d14ce129
SHA191d01921a2cda0feec6b0d5891902a40d43ab363
SHA256fd3d5dc7cfc78649d77b98ae0ea8ec4e76faf49d5ce6b454397204b8a8b654da
SHA51270d40903c95aef7c6b51dc260fd26c77c639ef99e819bee70cfad7788e102cf34616743b9d47a555ee009c423d2acd2f819ab1ce376c8ecb9c3e90cbb4266e5a
-
Filesize
192B
MD51fafcbc588fd772bb5a1e1e469d28171
SHA13b09e1d9242a51ed12a074b4e6e85509e419cdac
SHA256a90649281a28ae7ed8cbaf64c08aff72c69817d7a07b00598c2a9321de0e3090
SHA51223ac682f76ef37edfd8dd52d14b12e1fedf916369e6c4104dff81602f7a8aa5e342c1abe60e0b69231a76bdbe77efe79efc5d6971cd3feffb8b573ebd31b849d
-
Filesize
468KB
MD5c313c61546841496e0d3350988d1e939
SHA12e84cf0144cffa7d26f315ff3075748e89a1f2bf
SHA2567c69322d47957e9fe83507c2e7c15ea7ffc2720dcdfd91565cc9fb832ceff89f
SHA5123958898789f26d6f6ba89f504a3bcda254acfa828b754c1b4a58c274f474c5493e4fbbcb5a50db8ed274d80c48072a7f1bd8e9e2ed64fe5310bc6ca653f8f391
-
Filesize
472KB
MD541886bf2f308c50c62a9bf567a153656
SHA1896163acea33ea9fbf7f645337ddfd334908c066
SHA256dd8629ba985610182694a0bbb9aba8e32f25cff419f2590fbeb70654847126e2
SHA512e5868f38d993884dd1bfd84ccd204911835dcbf5ba88cbb43b56b1a64e26279856d9c1b55746fb9a596fc33cf65aeaabbdbb1684e8ebfd48e1dfb721e951a568
-
Filesize
231B
MD5e087a13c3a5e3207aa8e6cb49c313a86
SHA1e6902f03bffe4da3fce9f652ecd678d5b0acaacd
SHA256bd85e13e47646e689cbc90964c556d893e5196fc50be31f7a35ed2f6d99fb7ff
SHA512cb471ebe91ff526b909ad493ebf3e1fa36d716dd6003fc838fb0175e8b40b9b81f18c096853635990191cb4cf7beae1f6930ea3b36c80f3e05507a18f5de6b65
-
Filesize
910B
MD567d697a63835540696ba01c90c68bfad
SHA15c6588cd52c0e963939d91ac01d3c450d95ad9cb
SHA25656bf76a0a3111346aa5d6b40c68f904fa0ea69b5d655e856c7d4cfad1c4df290
SHA512bf127756390b24c4b466b24f7a655819b95aa38b2c855014df652ba3f49ae6fc379d4f7006e225b226420f9ba48629524ad781b8781f1771dd5b52d41b5d57db
-
Filesize
468KB
MD5428066713f225bb8431340fa670671d4
SHA147f6878ff33317c3fc09c494df729a463bda174c
SHA256da6c395a2018d3439ad580a19e6a1ca5ff29ef9074411ee9f9f1b0a6365dfebd
SHA512292aad2762ae4dc519c69411aa114a29894f60ffac103813db4946f2fac4f5a166f66523c421529d6847c0882d8ab467392ee8da1e3a4fca0d6d4e6ebda5b737
-
Filesize
468KB
-
Filesize
28KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
64KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
28KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
4KB
-
Filesize
4KB