Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/06/2024, 05:06

General

  • Target

    9c805fc3829e484ede63b33a40b13b10_NeikiAnalytics.exe

  • Size

    383KB

  • MD5

    9c805fc3829e484ede63b33a40b13b10

  • SHA1

    ec0b1354b3c5f05ab1d17968501fffa833b74466

  • SHA256

    bf5e5101a0e8da1521a958ecb965bbf16142b808fa7db91318c8a39e905b6c68

  • SHA512

    e1f66e3f3f0f7a390eb8df47064344a692ad5d1b45aa93eff0027a1d1e3ac2c67bfae1ff9b4d036a8c54407e4413a0dedcc51d199bdb33910d78f9a3b9f709fd

  • SSDEEP

    6144:td5afqlpDHA9NtTV3okaEXnMhr1gg5YdEV1l6RXMAcfBOWq3oXY/LBFV7UMXKb3w:td5acTP+n25J1sJWWLBF2MXKb5Ol7

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies WinLogon 2 TTPs 1 IoCs
  • Drops file in Program Files directory 18 IoCs
  • Drops file in Windows directory 2 IoCs
  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9c805fc3829e484ede63b33a40b13b10_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\9c805fc3829e484ede63b33a40b13b10_NeikiAnalytics.exe"
    1⤵
    • Modifies WinLogon
    • Drops file in Windows directory
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1652
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2808
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 4288
        3⤵
        • Program crash
        PID:4476
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2808 -ip 2808
    1⤵
      PID:1948

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Low\IE\QZO1WZZQ\login[1].htm

      Filesize

      168B

      MD5

      d57e3a550060f85d44a175139ea23021

      SHA1

      2c5cb3428a322c9709a34d04dd86fe7628f8f0a6

      SHA256

      43edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c

      SHA512

      0364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063

    • C:\Windows\apppatch\svchost.exe

      Filesize

      383KB

      MD5

      ef3eebab9685ca66b54fa11d3e38d0fe

      SHA1

      5d603707c6f946bea266e35cdea0064860c62e33

      SHA256

      7322827e79ade9dcf2e20fbad3e29ce8792a8fa9db53c31846b22c939a40a58d

      SHA512

      d4fbfb50059d302530092b0acededf526007498572066c87f52acd8c9ba74b62455b262248cbf89f403d428f8ba975ddf898db364f845a59a4d1213d2cc12f9f

    • memory/1652-0-0x0000000000400000-0x000000000049D000-memory.dmp

      Filesize

      628KB

    • memory/1652-12-0x0000000000400000-0x000000000049D000-memory.dmp

      Filesize

      628KB

    • memory/2808-14-0x0000000000400000-0x000000000049D000-memory.dmp

      Filesize

      628KB

    • memory/2808-15-0x0000000002960000-0x0000000002A0A000-memory.dmp

      Filesize

      680KB

    • memory/2808-16-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-20-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-18-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-34-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-36-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-48-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-77-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-76-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-75-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-74-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-73-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-72-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-71-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-70-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-69-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-68-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-67-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-66-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-65-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-64-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-63-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-62-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-61-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-60-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-59-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-58-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-57-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-56-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-55-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-54-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-53-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-52-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-51-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-50-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-49-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-47-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-46-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-45-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-44-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-43-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-41-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-40-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-37-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-32-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-33-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-31-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-30-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-28-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-26-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-25-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-23-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-42-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-39-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-38-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-35-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-29-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-27-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-24-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-22-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-21-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-294-0x0000000000400000-0x000000000049D000-memory.dmp

      Filesize

      628KB

    • memory/2808-297-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB

    • memory/2808-2185-0x0000000002B50000-0x0000000002C07000-memory.dmp

      Filesize

      732KB