Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 04:35
Static task
static1
Behavioral task
behavioral1
Sample
37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe
-
Size
821KB
-
MD5
37b3a91b380bcfcf0e99968cd8b08a20
-
SHA1
2613b76e195f3c4a9df49550a81f51bc890f5d33
-
SHA256
cb3adeaee03768c5f785a46500f067efc4760f61b560cd07cf349ba4de1559cb
-
SHA512
086be58b775fd2b315d8ceb65d0276a0d848e7f5f157cb95b7cd2bd8398fb1e762f2dcc74657802b6a760c8e673d0f38a5c344318cad447f6b7a79dd152036b5
-
SSDEEP
12288:MOlZxSrnhmcLzzC4mkpRcXVeqGuoNApa+4nQew2wYuygUGv7PjIyk9DC:MCZxSrnscLXBmKyleqBa5nQKPuDDjc9m
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe = "0" 37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths 37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions 37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1692 powershell.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools 37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation 37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths 37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions 37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe = "0" 37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe -
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 4920 set thread context of 4936 4920 37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe 102 PID 4936 set thread context of 3464 4936 ngen.exe 56 PID 4936 set thread context of 2972 4936 ngen.exe 112 PID 2972 set thread context of 3464 2972 mtstocom.exe 56 PID 2972 set thread context of 5112 2972 mtstocom.exe 122 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \Registry\User\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 mtstocom.exe -
Runs regedit.exe 1 IoCs
pid Process 5044 regedit.exe -
Suspicious behavior: EnumeratesProcesses 63 IoCs
pid Process 1692 powershell.exe 1692 powershell.exe 1692 powershell.exe 4936 ngen.exe 4936 ngen.exe 4936 ngen.exe 4936 ngen.exe 4936 ngen.exe 4936 ngen.exe 4936 ngen.exe 4936 ngen.exe 4936 ngen.exe 4936 ngen.exe 4936 ngen.exe 4936 ngen.exe 4936 ngen.exe 4936 ngen.exe 4936 ngen.exe 4936 ngen.exe 4936 ngen.exe 4936 ngen.exe 2972 mtstocom.exe 2972 mtstocom.exe 2972 mtstocom.exe 2972 mtstocom.exe 2972 mtstocom.exe 2972 mtstocom.exe 2972 mtstocom.exe 2972 mtstocom.exe 2972 mtstocom.exe 2972 mtstocom.exe 2972 mtstocom.exe 2972 mtstocom.exe 2972 mtstocom.exe 2972 mtstocom.exe 2972 mtstocom.exe 2972 mtstocom.exe 2972 mtstocom.exe 2972 mtstocom.exe 2972 mtstocom.exe 2972 mtstocom.exe 2972 mtstocom.exe 2972 mtstocom.exe 2972 mtstocom.exe 2972 mtstocom.exe 2972 mtstocom.exe 2972 mtstocom.exe 2972 mtstocom.exe 2972 mtstocom.exe 2972 mtstocom.exe 2972 mtstocom.exe 2972 mtstocom.exe 2972 mtstocom.exe 2972 mtstocom.exe 2972 mtstocom.exe 2972 mtstocom.exe 2972 mtstocom.exe 2972 mtstocom.exe 2972 mtstocom.exe 2972 mtstocom.exe 2972 mtstocom.exe 2972 mtstocom.exe 2972 mtstocom.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 4936 ngen.exe 3464 Explorer.EXE 3464 Explorer.EXE 2972 mtstocom.exe 2972 mtstocom.exe 2972 mtstocom.exe 2972 mtstocom.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4920 37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe Token: SeDebugPrivilege 1692 powershell.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3464 Explorer.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 4920 wrote to memory of 1692 4920 37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe 99 PID 4920 wrote to memory of 1692 4920 37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe 99 PID 4920 wrote to memory of 5044 4920 37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe 100 PID 4920 wrote to memory of 5044 4920 37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe 100 PID 4920 wrote to memory of 5044 4920 37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe 100 PID 4920 wrote to memory of 5044 4920 37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe 100 PID 4920 wrote to memory of 4936 4920 37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe 102 PID 4920 wrote to memory of 4936 4920 37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe 102 PID 4920 wrote to memory of 4936 4920 37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe 102 PID 4920 wrote to memory of 4936 4920 37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe 102 PID 4920 wrote to memory of 4936 4920 37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe 102 PID 4920 wrote to memory of 4936 4920 37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe 102 PID 4920 wrote to memory of 1152 4920 37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe 103 PID 4920 wrote to memory of 1152 4920 37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe 103 PID 4920 wrote to memory of 1152 4920 37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe 103 PID 3464 wrote to memory of 2972 3464 Explorer.EXE 112 PID 3464 wrote to memory of 2972 3464 Explorer.EXE 112 PID 3464 wrote to memory of 2972 3464 Explorer.EXE 112 PID 2972 wrote to memory of 5112 2972 mtstocom.exe 122 PID 2972 wrote to memory of 5112 2972 mtstocom.exe 122 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe"2⤵
- UAC bypass
- Windows security bypass
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4920 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\37b3a91b380bcfcf0e99968cd8b08a20_NeikiAnalytics.exe" -Force3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1692
-
-
C:\Windows\regedit.exe"C:\Windows\regedit.exe"3⤵
- Runs regedit.exe
PID:5044
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4936
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"3⤵PID:1152
-
-
-
C:\Windows\SysWOW64\mtstocom.exe"C:\Windows\SysWOW64\mtstocom.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:5112
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82