Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/06/2024, 05:16

General

  • Target

    9cbc65a627d76a1b569a87dac366fbc0_NeikiAnalytics.exe

  • Size

    362KB

  • MD5

    9cbc65a627d76a1b569a87dac366fbc0

  • SHA1

    566e46ec048751ac74e3d149393884a5b278269b

  • SHA256

    a9571263f1e9762aa338e9c1b272afd3d02aa41fe57990042a9b2b953d3aed6a

  • SHA512

    e186800d136accf8c0cdb4226cf6489f4178021bc1c08bd1cc4546ea8ea150b9a3d6f5a67ebe230919e2c5eb469f44d40ac753958a5860f29b4e35b577b6fa8a

  • SSDEEP

    3072:VBI5ArKGCnhgU1XA+ArXjeaMoh6lgUaVwQ+/76bSSN+PS7VyoCeJ6ikE8gdkSLF2:VK5ArKjbAxXSaegUqGeGpBohMERx

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of UnmapMainImage
    PID:3404
    • C:\Users\Admin\AppData\Local\Temp\9cbc65a627d76a1b569a87dac366fbc0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\9cbc65a627d76a1b569a87dac366fbc0_NeikiAnalytics.exe"
      2⤵
      • Checks computer location settings
      • Adds Run key to start application
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2812
      • C:\Users\Admin\AppData\Roaming\bitsstnm\Devitall.exe
        "C:\Users\Admin\AppData\Roaming\bitsstnm\Devitall.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1984
        • C:\Users\Admin\AppData\Local\Temp\~5B6E.tmp
          "C:\Users\Admin\AppData\Local\Temp\~5B6E.tmp"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1112
      • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
        "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\~5B7E.tmp.xls"
        3⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        PID:4068
  • C:\Windows\SysWOW64\cttureg.exe
    C:\Windows\SysWOW64\cttureg.exe -k
    1⤵
    • Executes dropped EXE
    • Suspicious behavior: EnumeratesProcesses
    PID:3868

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\~5B6E.tmp

    Filesize

    6KB

    MD5

    3381df7bf7b83408f3906756a8302ff4

    SHA1

    5103ad8f72f63167234aa7b81af518cd686606f4

    SHA256

    a142b561777536b9327e09a678797d72a9ea5c2dc1a6b02bda961fa9258f07ae

    SHA512

    e78dfaf3d8d9b5f3b8349616f1086fe9075126061a3a6fa5bd6d4b4dbe9f447d5e695e3c7fe918dfdd6f294fae2e6d0ad642c05e814d9bab147bbb6b704cf9d9

  • C:\Users\Admin\AppData\Local\Temp\~5B7E.tmp.xls

    Filesize

    71KB

    MD5

    6186c22cc888081ecf6f584e5d4f6aa7

    SHA1

    d6d75f24ed318dd6d00cc780b2926d49d4abf48c

    SHA256

    db1590fa28b91a615d939fa430cd59d60cfc12d7da9b2fee8acbb7e7d72ffc3c

    SHA512

    17d295231474ca7f43ee1e2b14c821f7107170a03169750114ae534d996394d0d4ba268b4438d38dadda7d169e54b55a9f6f363e7923049d97f524b4c43e97e2

  • C:\Users\Admin\AppData\Roaming\bitsstnm\Devitall.exe

    Filesize

    172KB

    MD5

    957d44ac5f6ee048d794eb28091e6ebd

    SHA1

    43d41297909d1e94485ac0326d3ff5602042d52e

    SHA256

    4ca4310bdea02659b55597b5a786f5eb07cb4327d1c38e59a6f075948dc53a7c

    SHA512

    a5ecb584b6cecaf9998ac7957c4a2bd7d2ca954c5bd7d5dcaf49bd1f202b4286e71d48779ca6fde36e2649cc09696bcebf3e7306cb6595c8aa31dd567183dfdd

  • C:\Windows\SysWOW64\cttureg.exe

    Filesize

    362KB

    MD5

    9cbc65a627d76a1b569a87dac366fbc0

    SHA1

    566e46ec048751ac74e3d149393884a5b278269b

    SHA256

    a9571263f1e9762aa338e9c1b272afd3d02aa41fe57990042a9b2b953d3aed6a

    SHA512

    e186800d136accf8c0cdb4226cf6489f4178021bc1c08bd1cc4546ea8ea150b9a3d6f5a67ebe230919e2c5eb469f44d40ac753958a5860f29b4e35b577b6fa8a

  • memory/1984-7-0x0000000000C80000-0x0000000000CBE000-memory.dmp

    Filesize

    248KB

  • memory/2812-0-0x0000000001290000-0x00000000012FD000-memory.dmp

    Filesize

    436KB

  • memory/3404-14-0x00000000028F0000-0x0000000002931000-memory.dmp

    Filesize

    260KB

  • memory/3404-13-0x00000000028F0000-0x0000000002931000-memory.dmp

    Filesize

    260KB

  • memory/3868-21-0x00000000006B0000-0x000000000071D000-memory.dmp

    Filesize

    436KB

  • memory/3868-20-0x00000000006B0000-0x000000000071D000-memory.dmp

    Filesize

    436KB

  • memory/3868-22-0x00000000006B0000-0x000000000071D000-memory.dmp

    Filesize

    436KB

  • memory/4068-32-0x00007FF81FEF0000-0x00007FF81FF00000-memory.dmp

    Filesize

    64KB

  • memory/4068-31-0x00007FF81FEF0000-0x00007FF81FF00000-memory.dmp

    Filesize

    64KB

  • memory/4068-30-0x00007FF81FEF0000-0x00007FF81FF00000-memory.dmp

    Filesize

    64KB

  • memory/4068-28-0x00007FF81FEF0000-0x00007FF81FF00000-memory.dmp

    Filesize

    64KB

  • memory/4068-29-0x00007FF81FEF0000-0x00007FF81FF00000-memory.dmp

    Filesize

    64KB

  • memory/4068-33-0x00007FF81D780000-0x00007FF81D790000-memory.dmp

    Filesize

    64KB

  • memory/4068-34-0x00007FF81D780000-0x00007FF81D790000-memory.dmp

    Filesize

    64KB

  • memory/4068-65-0x00007FF81FEF0000-0x00007FF81FF00000-memory.dmp

    Filesize

    64KB

  • memory/4068-68-0x00007FF81FEF0000-0x00007FF81FF00000-memory.dmp

    Filesize

    64KB

  • memory/4068-67-0x00007FF81FEF0000-0x00007FF81FF00000-memory.dmp

    Filesize

    64KB

  • memory/4068-66-0x00007FF81FEF0000-0x00007FF81FF00000-memory.dmp

    Filesize

    64KB