Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/06/2024, 05:06

General

  • Target

    9c830d51d65dd354bf08339d7c5e30f0_NeikiAnalytics.exe

  • Size

    213KB

  • MD5

    9c830d51d65dd354bf08339d7c5e30f0

  • SHA1

    e54e6e076f415d97e80240067d5aeb091861fe86

  • SHA256

    c858155a0f5b576b927ff5888932d66b22b1b1c794c65b6f178ed9e46231b26a

  • SHA512

    119e4eb0fec31450c8585dba772dadb6b9c0afd53fe46dac8a85693951fb752f1dd69b36e2f70046a936aef4dae553fddc55eb6f63483fa3d2acbd8517d56938

  • SSDEEP

    6144:/7++Jbojf5Vq5OC4qZhZcKYhc/ZfUozY:K+cff22qZhZcKYhc/

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Program Files directory 52 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9c830d51d65dd354bf08339d7c5e30f0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\9c830d51d65dd354bf08339d7c5e30f0_NeikiAnalytics.exe"
    1⤵
    • Modifies WinLogon
    • Drops file in Windows directory
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:3440
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • Modifies WinLogon
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      PID:2520

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Windows Defender\galyqaz.com

    Filesize

    42KB

    MD5

    b727cd3ab840aea466b8a881f16469e2

    SHA1

    90f1c2d42176650f1bbd91f0d7806f9a64c1b042

    SHA256

    28c14d6333ce6661dc98255b23c1124c39211e0fbb095e62ac9ea58d6ee4367e

    SHA512

    2bec3689eb7968590c7ae656e64c043b2f6d3a9440c3136db282890281b035a47253e9696ed6dd7f35b22eafd687ea76ad507e0b6094313469ef63e2422f7cea

  • C:\Program Files (x86)\Windows Defender\qegyval.com

    Filesize

    457B

    MD5

    531ec87a0b2f9477a52d88b111d0d46a

    SHA1

    50a72e5752075309f91c062e0282a7e7cd1e751e

    SHA256

    4875b451859b1eb8d0d3b040b1bb8d654d212edb6d9c721cf0f4372129579385

    SHA512

    07994963fd76b31ef0ba2c7f418dcb3ee0290f6baca2d8ec63a6e6b861557b13fbc20d2f0a10a66f35c4d72d4d2c1920ac88b96174604f2f8856868912327da1

  • C:\Program Files (x86)\Windows Defender\qetyhyg.com

    Filesize

    593B

    MD5

    926512864979bc27cf187f1de3f57aff

    SHA1

    acdeb9d6187932613c7fa08eaf28f0cd8116f4b5

    SHA256

    b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f

    SHA512

    f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b

  • C:\Program Files (x86)\Windows Defender\qexyhuv.com

    Filesize

    114B

    MD5

    bfde1e9e9c32c1681a16139450c6909d

    SHA1

    7e669b927e6a75a10a0ca29e38e58ddcb49b725e

    SHA256

    e0d020ba1cb6506cee234903a44c747ee0cfa7e2d1e60029e4cd8de9a431512a

    SHA512

    781fd54f155442dd34f9919b3cd063ee399db411bbfe15f2bdc43d3ab8ac2d04e1011b2c99fab42bebf7b903a94e09aaaef71b7a465d2d04b417f6dad8e8e396

  • C:\Program Files (x86)\Windows Defender\vofycot.com

    Filesize

    23KB

    MD5

    9b5b7d6a4b2dcdeb7d2d5eddc8d45e11

    SHA1

    c3be2138b67cdf7c24114cb528f2af4b2bb16b34

    SHA256

    c727fa07f0f3d9740addc711dcf9d53d7b3bc22a61abfc395d311c3bbafc0407

    SHA512

    5079e6d04784e2dd536d235fb9bb3618f1eafbffd22fbd5b354bf954ffb5ffc2101ae1678b78a2ea4641abaa70068e9f5bcdb23dd6b3472fd9207e9713022db4

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AKI8W8FH\login[3].htm

    Filesize

    114B

    MD5

    e89f75f918dbdcee28604d4e09dd71d7

    SHA1

    f9d9055e9878723a12063b47d4a1a5f58c3eb1e9

    SHA256

    6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023

    SHA512

    8df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NA35E2FV\login[3].htm

    Filesize

    593B

    MD5

    3b03d93d3487806337b5c6443ce7a62d

    SHA1

    93a7a790bb6348606cbdaf5daeaaf4ea8cf731d0

    SHA256

    7392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30

    SHA512

    770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W5OVUPOF\login[3].htm

    Filesize

    168B

    MD5

    d57e3a550060f85d44a175139ea23021

    SHA1

    2c5cb3428a322c9709a34d04dd86fe7628f8f0a6

    SHA256

    43edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c

    SHA512

    0364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063

  • C:\Windows\apppatch\svchost.exe

    Filesize

    213KB

    MD5

    42011f5b9ffb3a852e50874de91f9a13

    SHA1

    7aed40a519f57a861ace43f7bb313ae002be2392

    SHA256

    436d2a8d868cdccc1d8516376dda7f24f75e155b981f8a51d598f2c9c2c91571

    SHA512

    9ac02924b0f4138ef231fafe0e21e3823c17fbfaf40ef90cab9309e839d20355948fb607e834eafc9478914f76ca69b0d24b56abc5c4fcdedea84c34229bb67a

  • memory/2520-55-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-49-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-26-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-24-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-28-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-81-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-80-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-79-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-78-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-77-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-75-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-74-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-73-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-72-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-71-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-70-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-69-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-68-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-67-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-66-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-65-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-64-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-63-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-62-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-60-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-59-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-58-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-57-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-56-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-22-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-54-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-53-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-52-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-51-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-50-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-21-0x0000000000400000-0x0000000000494000-memory.dmp

    Filesize

    592KB

  • memory/2520-48-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-47-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-46-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-44-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-43-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-42-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-41-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-40-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-39-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-38-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-37-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-36-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-35-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-34-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-33-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-32-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-31-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-30-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-27-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-76-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-61-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-45-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-29-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

    Filesize

    712KB

  • memory/2520-18-0x0000000000400000-0x0000000000494000-memory.dmp

    Filesize

    592KB

  • memory/2520-15-0x0000000000400000-0x0000000000494000-memory.dmp

    Filesize

    592KB

  • memory/2520-19-0x0000000000400000-0x0000000000494000-memory.dmp

    Filesize

    592KB

  • memory/2520-20-0x0000000002A40000-0x0000000002AE4000-memory.dmp

    Filesize

    656KB

  • memory/3440-0-0x0000000000400000-0x0000000000494000-memory.dmp

    Filesize

    592KB

  • memory/3440-1-0x0000000000400000-0x0000000000494000-memory.dmp

    Filesize

    592KB

  • memory/3440-2-0x00000000021F0000-0x000000000223F000-memory.dmp

    Filesize

    316KB

  • memory/3440-3-0x0000000000400000-0x000000000045C000-memory.dmp

    Filesize

    368KB

  • memory/3440-14-0x00000000021F0000-0x000000000223F000-memory.dmp

    Filesize

    316KB

  • memory/3440-16-0x0000000000400000-0x0000000000494000-memory.dmp

    Filesize

    592KB

  • memory/3440-17-0x0000000000400000-0x000000000045C000-memory.dmp

    Filesize

    368KB