Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
04/06/2024, 11:26
General
-
Target
f5001c1df67bfa094b926d42dcc9a090_NeikiAnalytics.dll
-
Size
1.0MB
-
MD5
f5001c1df67bfa094b926d42dcc9a090
-
SHA1
9ef324afabe160afbf148e5b0427ae64bbae41cb
-
SHA256
f99ccad6f539e977685c4e6382623cb3e1e5d60a6977895009bc5cb92a9d23ee
-
SHA512
7c37238d3b58a11043359ecdf23bdfdedfdfa6ebf6bee642f0014ed9253c7adc5853bd7645465e45dee9fa56d71f8acc9db98881df66c2314a9a4a8d86000e1f
-
SSDEEP
6144:5i05kH9OyU2uv5SRf/FWgFgtLgqIRAUW9kVYeVprU4wfhTv5xD2ZP0GVGdXcukT+:crHGPv5SmptcDmUWuVZkxikdXcq
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 12 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 30 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f5001c1df67bfa094b926d42dcc9a090_NeikiAnalytics.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\Utilman.exeC:\Windows\system32\Utilman.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\I3fdqw.cmd1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Delete /F /TN "User_Feed_Synchronization-{662183c3-7773-ee8a-f0a9-0ccd273a9b7a}"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /TN "User_Feed_Synchronization-{662183c3-7773-ee8a-f0a9-0ccd273a9b7a}"2⤵
-
-
C:\Windows\system32\DsmUserTask.exeC:\Windows\system32\DsmUserTask.exe1⤵
-
C:\Windows\system32\ie4uinit.exeC:\Windows\system32\ie4uinit.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\3UkPWKM.cmd1⤵
- Drops file in System32 directory
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\vtUwO.cmd2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /F /TN "Fdxhngjjnp" /SC minute /MO 60 /TR "C:\Windows\system32\8649\ie4uinit.exe" /RL highest3⤵
- Creates scheduled task(s)
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
193B
MD539b8d50a7d74240949661b2019b9c8e3
SHA1306e087e40d80ef5116fd31f9c249ad64b2c9463
SHA256196f5c7454b82604c53a48ada3499d18f181e4b57321e9e8f0d8262196820670
SHA512f30551f0c5778e0c1efaaf17e68b125bbd059e8e25bbbba1d16d3da3f4d52a8da2f0d1c7a2143d4b825400b9ac4a9cfd488a8347942184cb36b06fd911ddea2f
-
Filesize
1.3MB
MD57cfdb4db33ab43784700889e740e6319
SHA13bb49aef408a3b20097c3424f2ffca86b07af924
SHA2566d8cdb13ed76762aa27a30659019c5cbdc0068b16db92d5ef7e2df3a652e7af2
SHA512514674c5f1c251d74250e31e71da447ff326a6c24188988917f1d8555c1f4647af3607aedd1c0d2b1d2ddd701d1d8125e439eb22ca922b9880cec66efb921e66
-
Filesize
234B
MD5c9bfebcfc6347abe3168da554147be63
SHA1b126d06ebd36440184ef43945936b8f5b89b93c2
SHA256e18d3cd46bea5b348034cf594154e0908b672bb986d4899c99e4b42c17148a4b
SHA512357f201ec5696fce6739dc4b84b29826b78985eab3f572ffb0c757b7f2d883e53a346094c5fd792e50a20e8328e3c29344a3a2c1774c7192e6b6eebaced40253
-
Filesize
1.0MB
MD5e014407cab6bc409b9a7df11385dddfe
SHA1a2dbf3ed79ff8a3ddaac9c101639747adb99ac89
SHA256ef66d853963df4e009ebbe17a4175d02b9dd247cddc51a7ac1c0f72b052afbd1
SHA512d8e43c1b1155b0bf24a25e3e6f757c4525913a3272c4856815c546ccf07c02f8a8b5cab8623d2a70282e9071f2fbb56de8467cb4265693d716a4c3eb58532b55
-
Filesize
129B
MD59a96252a3eaf06699e0a71bcebe14fd5
SHA15a62940d91db242898620c4c2d385bc6f5d463a5
SHA256c3c1ca85412509f982c18ad768b4a454f4e49d4c26e88a214fbbc1def2368a31
SHA512efc6896c9c7aa3e059dec724903e988eb54342c2d12d78c236e3669b7d953e10ed07a508b79697e1f9fe92be4f6634121381a4a9911aedf11de65748e082352d
-
Filesize
123KB
MD5a117edc0e74ab4770acf7f7e86e573f7
SHA15ceffb1a5e05e52aafcbc2d44e1e8445440706f3
SHA256b5bc4fce58403ea554691db678e6c8c448310fe59990990f0e37cd4357567d37
SHA51272883f794ff585fe7e86e818d4d8c54fa9781cab6c3fac6f6956f58a016a91f676e70d14691cbe054ae7b7469c6b4783152fbb694e92b940d9e3595fe3f41d97
-
Filesize
912B
MD572d4bfec6bd3446749f879ee83bef5cf
SHA15a8304759e0e874400c2619949879444afa365f7
SHA25638f4a3d4a383dc08980923cc9081303fff21537b03355ae97b14db4dde406adf
SHA5122203e7b714f7b489e69d2e758fbce73a896c09e007aafdf6fc00aaeeccf1aad8e8a60aeb2a4930b43063e537caee22adfc85bf33ebedfb3d3ad199c4fab419f3
-
Filesize
1.0MB
-
Filesize
28KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
4KB
-
Filesize
4KB