Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
05/06/2024, 04:29
General
-
Target
3a1ea64a35150d3b801385aa1420e0c0_NeikiAnalytics.dll
-
Size
484KB
-
MD5
3a1ea64a35150d3b801385aa1420e0c0
-
SHA1
ab832ada796e2a83a8e1331bc59a0ae75b195d89
-
SHA256
b34ef1aeed03e2cf0ec4b61d6906c2efa890d1c306094959bb43cf51ed2ae935
-
SHA512
8407d84d402151055d96d45c2d6286274b4d55e3313063def90ea3edf612c1ce8b5ddf422ef1885f3dbbd8034955e606e2447977c1edff647c933d02b76a9660
-
SSDEEP
6144:ti05kH9OyU2uv5SRf/FWgFgtbgqIRAUW9kVYeVprU4wfhTv5xD2ZP0GVGdXcukT4:YrHGPv5SmptsDmUWuVZkxikdXcq
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 13 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 22 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a1ea64a35150d3b801385aa1420e0c0_NeikiAnalytics.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
-
C:\Windows\system32\browserexport.exeC:\Windows\system32\browserexport.exe1⤵
-
C:\Windows\system32\audiodg.exeC:\Windows\system32\audiodg.exe1⤵
-
C:\Windows\system32\cmstp.exeC:\Windows\system32\cmstp.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\ACnYWGO.cmd1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Delete /F /TN "User_Feed_Synchronization-{3a9698a7-8b59-5789-8186-33aeee771cee}"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /TN "User_Feed_Synchronization-{3a9698a7-8b59-5789-8186-33aeee771cee}"2⤵
-
-
C:\Windows\system32\sdchange.exeC:\Windows\system32\sdchange.exe1⤵
-
C:\Windows\system32\PasswordOnWakeSettingFlyout.exeC:\Windows\system32\PasswordOnWakeSettingFlyout.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\PYO.cmd1⤵
- Drops file in System32 directory
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\9y7Qzf.cmd2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /F /TN "Niazd" /SC minute /MO 60 /TR "C:\Windows\system32\3268\PasswordOnWakeSettingFlyout.exe" /RL highest3⤵
- Creates scheduled task(s)
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
143B
MD511825e326510756daea0d29c78ae2851
SHA1057a4c6a0ac31862df4b0e0b8d8ec0e879ec142f
SHA256b22f231931bb9e2ded05af660c23eae1e17c9291413eb59d318fb8e8437822f8
SHA512f4e483650c259a9bf5dcbbb936cf23317ad9f4655d0b73d1cb72e95ee43f48305d2753bd08aa68e57e8a8cd7de336f81c7f5aadfdfc8f16d062780999e8e8af5
-
Filesize
234B
MD5a3208d8899ddcd3a3773bddcd2b92c2f
SHA14dfd3e0ef3b917dc9e956f33622759eb12afdf9c
SHA256ae680d55183b60674167e90e7edc17ae7aa53aa376e2a428c2259ee09f1e041b
SHA512762add706ba08b3b8755a3ceaaa23bd98fb3ec7b1b88124c61df6030167bbb7910979723739bbbb8d1149bc89c42a884c7a8e34e0cb294dcadb2db101299956a
-
Filesize
488KB
MD58549a94b5508273a69cc26781cbdcb21
SHA1a0feb2926787e6edb227346fba80fd678ceec59b
SHA25632238df5ff30dcba7fccf1d33398e40b0645669144a9acc17afcce11de37f931
SHA512210b9ebec2634b46ae14e518df4686809ed629e81115667958f926a1f4dc06513ee1a3c4c6e8a1097b6ba9be709fa8e7f73b3e3d90902da074f33aab73a87fc0
-
Filesize
212B
MD58e41f35fcc9948866f0697ec114f6029
SHA12dce4c8d48d87271f6caba342b44b47b80b877ef
SHA25659ae54f1c79e11b1cace69be7ddd20dd0bc646f001cf9dcd142149e8457dbb60
SHA5122138db6bbd13b27e87b7b275aa7efc310ea676ca571a8b408834df4efe608c9318254683c58afb939dfda959d03aeba24090709e39dab1420e64e36b3f84c529
-
Filesize
488KB
MD58273378fd5c7aacfe22b6a1555ab7ca4
SHA11252b3c4f37d10b3a10ee59195c087d21a3784f6
SHA256b63cf97b57916b7932f20c4a4fbd15d9ca5348b0458edb69fd7a3d98a0b15d1a
SHA512dc2515ca87d424baccf05ef234883622defb220326e155cdb4facb92c99a86629d3759cb480ee2ef73da4265972565b1c76854a2ecdeeaa59b62020d8885d03b
-
Filesize
902B
MD520a96eeb16a357d69677bf9a6c74f820
SHA1f4b44e0a3fe1c029789041bc893f1116cd4b8056
SHA256903482ea72ed1435a7508ba8a6fdfb288434c523056a7603d1f8546961246eb4
SHA51255b11000bc0758052e41d081ed1798ccab1d8225981fa883673a204304fc787c29ffdfb1b49e806303f2f7f56fdd9ac979d73f8e48b4b5f0cd2fb275fd7eabf7
-
Filesize
96KB
MD54cc43fe4d397ff79fa69f397e016df52
SHA18fd6cf81ad40c9b123cd75611860a8b95c72869c
SHA256f2d3905ee38b2b5c0b724d582f14eb1db7621ffb8f3826df686a20784341614c
SHA512851ef9fa5a03ec8b9fea0094c6e4bfa0b9e71cee3412ee86b2dfc34682aa5fb6455fefe7fc0092b711956d7c880cf8a5761b63ee990aa8e72f3473086ac0f157
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
28KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
64KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
4KB