Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01/06/2024, 22:21
Static task
static1
Behavioral task
behavioral1
Sample
023f97a2ae47b83f90788d0733a00330_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
023f97a2ae47b83f90788d0733a00330_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
023f97a2ae47b83f90788d0733a00330_NeikiAnalytics.exe
-
Size
1.7MB
-
MD5
023f97a2ae47b83f90788d0733a00330
-
SHA1
df2dee6db040c44db1ba770fd3e2f8ad8ce0bdc0
-
SHA256
be6ba8b6e1bb8716515070f1018f37a9553f3c453e269b63171699cba5ee478f
-
SHA512
3cd67b4626bf584213fb953952832b6ac3a1a47c225a2aec7865c27e0a1b708ffefab9763142253bf39b0144c0b85561e761040f9b03c92fc7bbd7938e8b4b07
-
SSDEEP
49152:DpPNiqTVoiCVsqSMRrQFTAm4o24TduMpwNRL:NNiqpcsFCrQFEm40vpw3
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 023f97a2ae47b83f90788d0733a00330_NeikiAnalytics.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe -
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 023f97a2ae47b83f90788d0733a00330_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 023f97a2ae47b83f90788d0733a00330_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe -
Executes dropped EXE 4 IoCs
pid Process 2076 explorer.exe 2220 spoolsv.exe 1824 svchost.exe 496 spoolsv.exe -
Identifies Wine through registry keys 2 TTPs 5 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Wine spoolsv.exe Key opened \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Wine 023f97a2ae47b83f90788d0733a00330_NeikiAnalytics.exe Key opened \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Wine explorer.exe Key opened \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Wine spoolsv.exe Key opened \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Wine svchost.exe -
Loads dropped DLL 4 IoCs
pid Process 2424 023f97a2ae47b83f90788d0733a00330_NeikiAnalytics.exe 2076 explorer.exe 2220 spoolsv.exe 1824 svchost.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 2424 023f97a2ae47b83f90788d0733a00330_NeikiAnalytics.exe 2076 explorer.exe 2220 spoolsv.exe 1824 svchost.exe 496 spoolsv.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\themes\explorer.exe 023f97a2ae47b83f90788d0733a00330_NeikiAnalytics.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 832 schtasks.exe 1060 schtasks.exe 1600 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2424 023f97a2ae47b83f90788d0733a00330_NeikiAnalytics.exe 2424 023f97a2ae47b83f90788d0733a00330_NeikiAnalytics.exe 2424 023f97a2ae47b83f90788d0733a00330_NeikiAnalytics.exe 2424 023f97a2ae47b83f90788d0733a00330_NeikiAnalytics.exe 2424 023f97a2ae47b83f90788d0733a00330_NeikiAnalytics.exe 2424 023f97a2ae47b83f90788d0733a00330_NeikiAnalytics.exe 2424 023f97a2ae47b83f90788d0733a00330_NeikiAnalytics.exe 2424 023f97a2ae47b83f90788d0733a00330_NeikiAnalytics.exe 2424 023f97a2ae47b83f90788d0733a00330_NeikiAnalytics.exe 2424 023f97a2ae47b83f90788d0733a00330_NeikiAnalytics.exe 2424 023f97a2ae47b83f90788d0733a00330_NeikiAnalytics.exe 2424 023f97a2ae47b83f90788d0733a00330_NeikiAnalytics.exe 2424 023f97a2ae47b83f90788d0733a00330_NeikiAnalytics.exe 2424 023f97a2ae47b83f90788d0733a00330_NeikiAnalytics.exe 2424 023f97a2ae47b83f90788d0733a00330_NeikiAnalytics.exe 2424 023f97a2ae47b83f90788d0733a00330_NeikiAnalytics.exe 2424 023f97a2ae47b83f90788d0733a00330_NeikiAnalytics.exe 2424 023f97a2ae47b83f90788d0733a00330_NeikiAnalytics.exe 2076 explorer.exe 2076 explorer.exe 2076 explorer.exe 2076 explorer.exe 2076 explorer.exe 2076 explorer.exe 2076 explorer.exe 2076 explorer.exe 2076 explorer.exe 2076 explorer.exe 2076 explorer.exe 2076 explorer.exe 2076 explorer.exe 2076 explorer.exe 2076 explorer.exe 2076 explorer.exe 2076 explorer.exe 2220 spoolsv.exe 1824 svchost.exe 1824 svchost.exe 1824 svchost.exe 1824 svchost.exe 1824 svchost.exe 1824 svchost.exe 1824 svchost.exe 1824 svchost.exe 1824 svchost.exe 1824 svchost.exe 1824 svchost.exe 1824 svchost.exe 1824 svchost.exe 1824 svchost.exe 1824 svchost.exe 1824 svchost.exe 1824 svchost.exe 496 spoolsv.exe 2076 explorer.exe 1824 svchost.exe 1824 svchost.exe 2076 explorer.exe 2076 explorer.exe 2076 explorer.exe 1824 svchost.exe 1824 svchost.exe 2076 explorer.exe 2076 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2076 explorer.exe 1824 svchost.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 2424 023f97a2ae47b83f90788d0733a00330_NeikiAnalytics.exe 2424 023f97a2ae47b83f90788d0733a00330_NeikiAnalytics.exe 2076 explorer.exe 2076 explorer.exe 2220 spoolsv.exe 2220 spoolsv.exe 1824 svchost.exe 1824 svchost.exe 496 spoolsv.exe 496 spoolsv.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2424 wrote to memory of 2076 2424 023f97a2ae47b83f90788d0733a00330_NeikiAnalytics.exe 28 PID 2424 wrote to memory of 2076 2424 023f97a2ae47b83f90788d0733a00330_NeikiAnalytics.exe 28 PID 2424 wrote to memory of 2076 2424 023f97a2ae47b83f90788d0733a00330_NeikiAnalytics.exe 28 PID 2424 wrote to memory of 2076 2424 023f97a2ae47b83f90788d0733a00330_NeikiAnalytics.exe 28 PID 2076 wrote to memory of 2220 2076 explorer.exe 29 PID 2076 wrote to memory of 2220 2076 explorer.exe 29 PID 2076 wrote to memory of 2220 2076 explorer.exe 29 PID 2076 wrote to memory of 2220 2076 explorer.exe 29 PID 2220 wrote to memory of 1824 2220 spoolsv.exe 30 PID 2220 wrote to memory of 1824 2220 spoolsv.exe 30 PID 2220 wrote to memory of 1824 2220 spoolsv.exe 30 PID 2220 wrote to memory of 1824 2220 spoolsv.exe 30 PID 1824 wrote to memory of 496 1824 svchost.exe 31 PID 1824 wrote to memory of 496 1824 svchost.exe 31 PID 1824 wrote to memory of 496 1824 svchost.exe 31 PID 1824 wrote to memory of 496 1824 svchost.exe 31 PID 2076 wrote to memory of 2768 2076 explorer.exe 32 PID 2076 wrote to memory of 2768 2076 explorer.exe 32 PID 2076 wrote to memory of 2768 2076 explorer.exe 32 PID 2076 wrote to memory of 2768 2076 explorer.exe 32 PID 1824 wrote to memory of 832 1824 svchost.exe 33 PID 1824 wrote to memory of 832 1824 svchost.exe 33 PID 1824 wrote to memory of 832 1824 svchost.exe 33 PID 1824 wrote to memory of 832 1824 svchost.exe 33 PID 1824 wrote to memory of 1060 1824 svchost.exe 38 PID 1824 wrote to memory of 1060 1824 svchost.exe 38 PID 1824 wrote to memory of 1060 1824 svchost.exe 38 PID 1824 wrote to memory of 1060 1824 svchost.exe 38 PID 1824 wrote to memory of 1600 1824 svchost.exe 40 PID 1824 wrote to memory of 1600 1824 svchost.exe 40 PID 1824 wrote to memory of 1600 1824 svchost.exe 40 PID 1824 wrote to memory of 1600 1824 svchost.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\023f97a2ae47b83f90788d0733a00330_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\023f97a2ae47b83f90788d0733a00330_NeikiAnalytics.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:496
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 22:23 /f5⤵
- Creates scheduled task(s)
PID:832
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 22:24 /f5⤵
- Creates scheduled task(s)
PID:1060
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 22:25 /f5⤵
- Creates scheduled task(s)
PID:1600
-
-
-
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe3⤵PID:2768
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD5746fda60b66fdad9cdec11da99e6d1f3
SHA125231f1c02cf438fb0ad8e098368fd001bb44200
SHA25652a71c032e1bba5bc5618ffd55b7eabaaddfd5430140eac899a0651ce77edc4e
SHA512bc092369d40a9307b02bb6867e99b78d33374ffa6b54561f9b939275e0b41d38352b5c58957e729287e0e6c65b0e44f6458a0250bd893c810e8c3caa25aa6968
-
Filesize
1.7MB
MD52fcbe4062791dc183016d40cadb8ac73
SHA152da10c2f679d3fcc21cb030be89bf8132e91a87
SHA256f442f7227c25a5b40218b59daf4d211153715b6d823fd92ec601615cc2feff8e
SHA512645308e1e9ddeca3e62890b66e15e1d78d57b919c2e96c4b221f4107eff57b5ece7bab93bf4f1173c34ea6cd6662c93d8a69afdfa6344557d3767067c2ddff31
-
Filesize
1.7MB
MD591a89d61550541761c01689c4fabdfb4
SHA104bae140f688772c941302e94e6d6066fe791f32
SHA256374bbe01c45e938b195b114f86c74d5e443e6dcdc2f3e1ee735df3c1e460da59
SHA51225b13086540e3752dd712d6cc5fccc4ce3d645c9c1f5d068040605162c0dcef72fcd4408709ce066a901896cca169d98f23f35fb20d9195b60991e2035a87579