Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
04/06/2024, 11:26
General
-
Target
f5001c1df67bfa094b926d42dcc9a090_NeikiAnalytics.dll
-
Size
1.0MB
-
MD5
f5001c1df67bfa094b926d42dcc9a090
-
SHA1
9ef324afabe160afbf148e5b0427ae64bbae41cb
-
SHA256
f99ccad6f539e977685c4e6382623cb3e1e5d60a6977895009bc5cb92a9d23ee
-
SHA512
7c37238d3b58a11043359ecdf23bdfdedfdfa6ebf6bee642f0014ed9253c7adc5853bd7645465e45dee9fa56d71f8acc9db98881df66c2314a9a4a8d86000e1f
-
SSDEEP
6144:5i05kH9OyU2uv5SRf/FWgFgtLgqIRAUW9kVYeVprU4wfhTv5xD2ZP0GVGdXcukT+:crHGPv5SmptcDmUWuVZkxikdXcq
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 9 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 27 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f5001c1df67bfa094b926d42dcc9a090_NeikiAnalytics.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemPropertiesRemote.exeC:\Windows\system32\SystemPropertiesRemote.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\JEYYx.cmd1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Delete /F /TN "User_Feed_Synchronization-{7b98aa95-b212-23e5-3cc8-426819761c96}"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /TN "User_Feed_Synchronization-{7b98aa95-b212-23e5-3cc8-426819761c96}"2⤵
-
-
C:\Windows\system32\raserver.exeC:\Windows\system32\raserver.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\pEoXkio.cmd1⤵
- Drops file in System32 directory
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\LIAd.cmd2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /F /TN "Rkbail" /SC minute /MO 60 /TR "C:\Windows\system32\5284\raserver.exe" /RL highest3⤵
- Creates scheduled task(s)
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
245B
MD59fdca45bda7d12c1b1f6f6c739941378
SHA1beca906d86d0603bc5ed2b5a6c0d888d468680fd
SHA2569e1842c1397bb73fec91968d60ca7df5bf5535eb20079139c1bd0befba45fda7
SHA5128491bd4a44f5585294b0cd4ee13dd381c15683863694d99752908253a76c20e75b11d6f8cb1ece8e26bb1efae0b33c5368208d3d2f3f53fcf2665f3a6f62621a
-
Filesize
125B
MD5e74b57ae7336718bd9ac30cdf17bbdc6
SHA122f4f031e4d7c7ada953d6dac550f41d836fcf6a
SHA256c49648729476218b9eb787e6795764353cd6e9a05a2615c9b0f7e4d9bf0cd334
SHA51213b944f94516262344555021f8a2f1313de4351303afdb58595f989c3a91e42c716b904309f5a55cf847722d3963df8dbb53003008c70ad90628eface34d472e
-
Filesize
1.0MB
MD5a7b88e4cb43173afeb3a0eafcc5790de
SHA104bc113d6cd9fb8cafa840d98fb88590aa7b926c
SHA256473bd0a6f61b2147b7a9024056d4aa6880443dce5f693f8475f7f3f622f39889
SHA512f774ad33ab8373e52b784078bcc49f97a3aa545cf6b2463b81cae5262bec41eb483ea255055b841d996bb6b5cd9f9f2359730186385b5648580a0b9939ff9253
-
Filesize
1.0MB
MD59470694a870dfd1649ae01a78998ef78
SHA116a7ac45d6c403933aedf49ce7c1a622f22993d7
SHA2568b3507d6c841e40a7c0e3dea29bafd1eb9ab92dd1630b3e31f51a3a87d2b973f
SHA5125d8149ac5df9714a126b263eb3e3bad8d354a51a5fcbd00bdabaac48a3826a6dfdf99e33a31ed8a8ebad739334b3c1b4b9bada885469748d506134b813f0b9b2
-
Filesize
195B
MD5bf76fd5e5a8db4b5a4f6cf52b338b1b6
SHA1c9855034d45ea8f147ba504c3975293c964aa385
SHA256171a874c98de9d2b4be0ea313d12d1767a3bb250a2ff70d467a033e23d6aee73
SHA512c3ef1d492050f4b60bbc4b70ff97d2baf05d956f283bbca92168b7a1eb8b9433413242b5af378dde4eb5fc37d332132d3aef9d91360eff0273d7addf26b20eb3
-
Filesize
960B
MD5301ea9f12266a30e69a83d846602738b
SHA1c397d395bf71efd2356bd707dcbfae7535d24c72
SHA2560799a902493329497fa39892b70ab2481d2cc4d86da62f3f4edde53ae5a63a69
SHA5121ee27377ea6ee9851ddd0ef572f2e6b805328f3933c6dd52c025f08f2dd1e073b146470c9ec60c1986cde2ed61caeafc2569d8813106f23059e4fbb21b8228e9
-
Filesize
80KB
MD5d0d7ac869aa4e179da2cc333f0440d71
SHA1e7b9a58f5bfc1ec321f015641a60978c0c683894
SHA2565762e1570de6ca4ff4254d03c8f6e572f3b9c065bf5c78fd5a9ea3769c33818a
SHA5121808b10dc85f8755a0074d1ea00794b46b4254573b6862c2813a89ca171ad94f95262e8b59a8f9a596c9bd6a724f440a14a813eab93aa140e818ee97af106db7
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
4KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
28KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
4KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.0MB
-
Filesize
28KB
-
Filesize
1.0MB