Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
03/06/2024, 17:56
General
-
Target
e9c77ff857afd14fe12e4ba6067a3b60_NeikiAnalytics.dll
-
Size
540KB
-
MD5
e9c77ff857afd14fe12e4ba6067a3b60
-
SHA1
6ab740ea7f433a7bbbcf9bf2210c0c6178696540
-
SHA256
7727cfd67763fc7715091d501c592054d94e4714b02338d394b4aadc63ad538d
-
SHA512
21a1a685103b861996b0c1f1b8c98ab8b64c8136286d2357338bdb504baaa6c12a4534077d4f1eb9a731446a66eece54a9b5aca82b1763bad30933e66ce38ce6
-
SSDEEP
6144:Bi05kH9OyU2uv5SRf/FWgFgt0gqIRAUW9kVYeVprU4wfhTv5xD2ZP0GVGdXcukT4:ErHGPv5SmptZDmUWuVZkxikdXcq
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 9 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 30 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e9c77ff857afd14fe12e4ba6067a3b60_NeikiAnalytics.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cleanmgr.exeC:\Windows\system32\cleanmgr.exe1⤵
-
C:\Windows\system32\irftp.exeC:\Windows\system32\irftp.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\FDd.cmd1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Delete /F /TN "User_Feed_Synchronization-{33819f3b-2f8d-cfcb-0a23-a942879f9636}"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /TN "User_Feed_Synchronization-{33819f3b-2f8d-cfcb-0a23-a942879f9636}"2⤵
-
-
C:\Windows\system32\msinfo32.exeC:\Windows\system32\msinfo32.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\bNZvHy.cmd1⤵
- Drops file in System32 directory
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\YBnY7Uo.cmd2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /F /TN "Vmvmshnity" /SC minute /MO 60 /TR "C:\Windows\system32\2313\msinfo32.exe" /RL highest3⤵
- Creates scheduled task(s)
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
568KB
MD54d5bc9c77021cfa0ce52be8310d5a46a
SHA14a0cf1695df519b6f433e34d2ce494970dc6ac92
SHA25626f417e4fda01e1da812ff2146e20194eed4382edd3be215124b00020471211a
SHA5120df6c2b14519b1d80a6c4d61231d59ddf1941196f21cf7938322b2e4c38bfdc58d202791883feb88b6ece9710cd8ab611d301e8ae9f101753b7e1567e6ca8f3a
-
Filesize
225B
MD58bfac86f5f28d57d6812167b847ec6f5
SHA1b17c150aaf2d25820dc52485add7b0ddcf727490
SHA25697b4ada649d8011093b6c7004a64c1c361b6f90a79071445656126077ce862af
SHA5128772276a04717fe20b5f2f18a2169d145999e86d025bf40bd7b6cc0f9482dca26b0bbdbba678bc9233cf1f74ff761b1de674893a562ff9465596473f22898b2c
-
Filesize
568KB
MD53ba34b20ed8b2006dd20c078788cc105
SHA15769fbf966651d05c5b0f64e9e873885f51cbb93
SHA256264f08fc385bc210505d0142bbbc6dbf8de6884741d5506a64ef5eeafa41d09f
SHA512e71bbf5f3ac2cdf9971aaa49ea7a02e25fcd71ff41a2e0ba1d9dba826649f161f98676b3247b248d215ffa70042c37c4645793893d53405efbb39fd3da0b4a43
-
Filesize
129B
MD5ada5996d0589481682a46ca7bde5bad5
SHA14de98e762713a3001cbe41662b5c7bfce8846da9
SHA2563a41f11d76b2d4554019fb894fa87e69707bf13fdd647129eeaa49b2f6e8bb03
SHA512ace91f571c071c9b57c495faa1756b159c0f4ef3e4abb3f11858dd74974685d6b9ce860e5b026daecc48d03cf803e474db1982ecede9df0372cc4f513c37ef22
-
Filesize
192B
MD5cb8f235b4d0c38e8896b1aa47a7b4666
SHA19ba1e163c003af86e7b2d8e44eedab9305340c17
SHA256cfbe30f897687079535b546245569bc84d29674dd9a84c17cb2796bc9c49eb0f
SHA512e227433d1b1f04e12e484146c648b9ac39f421f1cf45aff85feb0c1f086a7b442997f3c992450f607f38cec112e2fe3f265475f7aca94516ae3ff67ae2fa3823
-
Filesize
192KB
MD50cae1fb725c56d260bfd6feba7ae9a75
SHA1102ac676a1de3ec3d56401f8efd518c31c8b0b80
SHA256312f4107ff37dc988d99c5f56178708bb74a3906740cff4e337c0dde8f1e151d
SHA512db969064577c4158d6bf925354319766b0d0373ddefb03dbfc9a9d2cadf8ddcd50a7f99b7ddf2ffad5e7fdbb6f02090b5b678bdf792d265054bff3b56ee0b8ec
-
Filesize
864B
MD599c2437bf174ccfb70dc8b6379575587
SHA1a348af40bdb0f00aaadafd573175a9e1ac88000f
SHA2561960c8460dcb721857167da25931ad8171be0d9a6706e03d8db6598e12186185
SHA5129de952df5d7aff4b301d8a10a2d5d52cde293320b98b1b499c7fa569fad963df9c55308b63ab9aae4fd3cb91a69e358408a04cc825cc86b4cef2c8db1e7be963
-
Filesize
540KB
-
Filesize
540KB
-
Filesize
540KB
-
Filesize
540KB
-
Filesize
540KB
-
Filesize
540KB
-
Filesize
540KB
-
Filesize
540KB
-
Filesize
540KB
-
Filesize
540KB
-
Filesize
540KB
-
Filesize
4KB
-
Filesize
540KB
-
Filesize
28KB
-
Filesize
540KB
-
Filesize
540KB
-
Filesize
540KB
-
Filesize
540KB
-
Filesize
540KB
-
Filesize
4KB
-
Filesize
540KB
-
Filesize
8KB
-
Filesize
540KB
-
Filesize
540KB
-
Filesize
540KB
-
Filesize
540KB
-
Filesize
540KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
540KB
-
Filesize
540KB
-
Filesize
28KB