Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
05/06/2024, 02:28
Static task
static1
Behavioral task
behavioral1
Sample
2c99aab9e3d6bcc85720cbec53641f00_NeikiAnalytics.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
2c99aab9e3d6bcc85720cbec53641f00_NeikiAnalytics.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
General
-
Target
2c99aab9e3d6bcc85720cbec53641f00_NeikiAnalytics.dll
-
Size
10.0MB
-
MD5
2c99aab9e3d6bcc85720cbec53641f00
-
SHA1
ea52b70e08386fdfc9115abd09ba6b3e8e9e9838
-
SHA256
8ef202906116e43b8cec82b85b21f24c3fbe499b0e5880c6d30781723326bf73
-
SHA512
bd0eb3bf74b7edbbacb0fd06c76d8da0e0dfc66e60313d46cff62e6b6c2a3b6a1636af0a9d6f601319077568aa3e3396a565429fd421f801983f3a59002ab39b
-
SSDEEP
3072:p2LK9Gj4b+XQcVc0Uci3HBBjxRd40suk/nX4wjpGI:c/cNThTRmrJX4wj
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1204 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Lhij\Qhijklmno.bmp rundll32.exe File created C:\Program Files (x86)\Lhij\Qhijklmno.bmp rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 2564 rundll32.exe Token: SeRestorePrivilege 2564 rundll32.exe Token: SeBackupPrivilege 2564 rundll32.exe Token: SeRestorePrivilege 2564 rundll32.exe Token: SeBackupPrivilege 2564 rundll32.exe Token: SeRestorePrivilege 2564 rundll32.exe Token: SeBackupPrivilege 2564 rundll32.exe Token: SeRestorePrivilege 2564 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2032 wrote to memory of 2564 2032 rundll32.exe 81 PID 2032 wrote to memory of 2564 2032 rundll32.exe 81 PID 2032 wrote to memory of 2564 2032 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2c99aab9e3d6bcc85720cbec53641f00_NeikiAnalytics.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2c99aab9e3d6bcc85720cbec53641f00_NeikiAnalytics.dll,#12⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2564
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1204
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16.2MB
MD595905bb3b998c56d6805a379ed966959
SHA191125c13362040c411f0db36d6a8b3b895f22eb7
SHA256f0310f2337e5d8a43588d1f5071278897eb3204436b202333ce8004a562d8ae4
SHA51223c042c7f8dc9d36375ee1020d2b329e7437e50d53dc21ce4ac5d32a83ac0d0752274c898716b8ed49645f78ce2ff84b957d7e1215d039d15133aca32d77a5c6
