Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
01/06/2024, 06:43 UTC
General
-
Target
91389187245a78e6a420a1c73d405ff0_NeikiAnalytics.exe
-
Size
3.6MB
-
MD5
91389187245a78e6a420a1c73d405ff0
-
SHA1
edb9db038f604bdfc6e53f528edee158f58844d5
-
SHA256
575995769c6de77768b0e90534a59d932562703fb72c90ab150bb94171525807
-
SHA512
cc701b19929b48c830de016e921d9bc098376d42b2f48f32ff6d9cce4a10da20a09324dd2dc8bbf741b61bb2df99bd7e708e2b8af70a2c1a16f9874b3853a426
-
SSDEEP
98304:ddByXcdnlLwOrI5Vfeg91hZOhkRpsinjB:ddien+OrFuBR6cB
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 4 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 35 IoCs
-
Drops file in Windows directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 15 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\91389187245a78e6a420a1c73d405ff0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\91389187245a78e6a420a1c73d405ff0_NeikiAnalytics.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
-
DNS8.8.8.8.in-addr.arpaRemote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle -
DNS217.106.137.52.in-addr.arpaRemote address:8.8.8.8:53Request217.106.137.52.in-addr.arpaIN PTRResponse
-
DNS172.210.232.199.in-addr.arpaRemote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
DNS67.31.126.40.in-addr.arpaRemote address:8.8.8.8:53Request67.31.126.40.in-addr.arpaIN PTRResponse
-
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
DNS97.17.167.52.in-addr.arpaRemote address:8.8.8.8:53Request97.17.167.52.in-addr.arpaIN PTRResponse
-
DNS50.23.12.20.in-addr.arpaRemote address:8.8.8.8:53Request50.23.12.20.in-addr.arpaIN PTRResponse
-
DNS15.164.165.52.in-addr.arpaRemote address:8.8.8.8:53Request15.164.165.52.in-addr.arpaIN PTRResponse
-
DNS31.243.111.52.in-addr.arpaRemote address:8.8.8.8:53Request31.243.111.52.in-addr.arpaIN PTRResponse
-
DNS0.205.248.87.in-addr.arpaRemote address:8.8.8.8:53Request0.205.248.87.in-addr.arpaIN PTRResponse0.205.248.87.in-addr.arpaIN PTRhttps-87-248-205-0lgwllnwnet
-
8.8.8.8:538.8.8.8.in-addr.arpadns
DNS Request
8.8.8.8.in-addr.arpa
-
8.8.8.8:53217.106.137.52.in-addr.arpadns
DNS Request
217.106.137.52.in-addr.arpa
-
8.8.8.8:53172.210.232.199.in-addr.arpadns
DNS Request
172.210.232.199.in-addr.arpa
-
8.8.8.8:5367.31.126.40.in-addr.arpadns
DNS Request
67.31.126.40.in-addr.arpa
-
8.8.8.8:5395.221.229.192.in-addr.arpadns
DNS Request
95.221.229.192.in-addr.arpa
-
8.8.8.8:5397.17.167.52.in-addr.arpadns
DNS Request
97.17.167.52.in-addr.arpa
-
8.8.8.8:5350.23.12.20.in-addr.arpadns
DNS Request
50.23.12.20.in-addr.arpa
-
8.8.8.8:5315.164.165.52.in-addr.arpadns
DNS Request
15.164.165.52.in-addr.arpa
-
8.8.8.8:5331.243.111.52.in-addr.arpadns
DNS Request
31.243.111.52.in-addr.arpa
-
8.8.8.8:530.205.248.87.in-addr.arpadns
DNS Request
0.205.248.87.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD592ccee738ede9c6ba9bfdc4c14ec4386
SHA18dbb0a9c3ed039ba02f517f1368081f96f49e3a7
SHA256dd4e27699a90e13dcdb775e17ca8e103d54ee0f30eac259271189fe443d17f56
SHA51237c99d73bf2c55493eaecee05d79763225f36ec2d88b1d48162ef481a3186994116b74b51df6407ad636ef732a29bf1c8ca5dd64a14376e2cb0bb18b939938b3
-
Filesize
3.6MB
MD56721c976f027b90d680104cf47c84013
SHA1bc46869aac36188cff318cad27a0571f48fad286
SHA256ef4ffdf831fa6d63e89c4cf1e8cc5756d7b5b0e89431b90f1668831a53915eca
SHA51258db91fdb346df2b0af6758c4d68f422a016f0ac60973e8ef40d06b0a82b9faec1f1e9779ad0b2912d40c7fe637c526eb5bf794f928d5db5382083e6aab94192
-
Filesize
3.6MB
MD5e8b96ba6317245685d259a463fdc476f
SHA151a0c1b4a8a462f7b063cca1792414833771a5d5
SHA2565fd60c97116bc0e5d886d2326e8259019bce04afa8129689c7cdc51e7a69e4f5
SHA512b62195016daf497b600dd812172dc47e9b04bfcac9a0767202298a95d4ff38fc8c13f3d978ae7802c95a4046a7c9a61dfb1c3a96c3bd28f19897b5e09880e2fc
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB