Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
05/06/2024, 08:06
General
-
Target
4a8e5a3af4ea20df121c53aef8131e60_NeikiAnalytics.dll
-
Size
472KB
-
MD5
4a8e5a3af4ea20df121c53aef8131e60
-
SHA1
95052233e658df40c50e241bdb8bc0af96964642
-
SHA256
cf056eef42c6c29e6f04e592c0a01fd04224e19dc2e3920e6631d7b1061d74a4
-
SHA512
955dd4091944792842f51de3006f9313e2e4a740fd71db28f169b87c7144876246255d293c0b2fc70a1c605710d1f94a2fec1ff3e17ca0dc86ae6446ee93ba1a
-
SSDEEP
6144:4i05kH9OyU2uv5SRf/FWgFgtH+gqIRAUW9kVYeVprU4wfhTv5xD2ZP0GVGdXcukE:LrHGPv5SmptHDDmUWuVZkxikdXcq
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 10 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 14 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4a8e5a3af4ea20df121c53aef8131e60_NeikiAnalytics.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\AppHostRegistrationVerifier.exeC:\Windows\system32\AppHostRegistrationVerifier.exe1⤵
-
C:\Windows\system32\DataExchangeHost.exeC:\Windows\system32\DataExchangeHost.exe1⤵
-
C:\Windows\system32\RemotePosWorker.exeC:\Windows\system32\RemotePosWorker.exe1⤵
-
C:\Windows\system32\quickassist.exeC:\Windows\system32\quickassist.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\NgQHVtz.cmd1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Delete /F /TN "User_Feed_Synchronization-{c8fa0120-b654-32d4-0e47-613d2c4281e9}"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /TN "User_Feed_Synchronization-{c8fa0120-b654-32d4-0e47-613d2c4281e9}"2⤵
-
-
C:\Windows\system32\dxgiadaptercache.exeC:\Windows\system32\dxgiadaptercache.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\REFgl.cmd1⤵
- Drops file in System32 directory
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\OIN.cmd2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /F /TN "Arqdxytqgr" /SC minute /MO 60 /TR "C:\Windows\system32\8619\dxgiadaptercache.exe" /RL highest3⤵
- Creates scheduled task(s)
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
476KB
MD5553058ed9c9a8ec828bb4326de16d121
SHA1673b358279b38adbdc5415c41fc37a8b12f41985
SHA2562e6463e2d2fc455049a30066ccebd59eb737ce43dfd51815eb07ecad238b8dc5
SHA5129aa695a5a00555032989f143f192738f3297d722c3d0c204b10b1eb815978a4cdb2cc3c12bd382fc84944143e67042a4dae75bf0e4c07fdbc9672f1ee2d63a05
-
Filesize
476KB
MD59775be1278f63e7c02b5d273b1a6a256
SHA1e2125b8a4ff0c5d0db382d2e8ab39045056142ee
SHA256e15eafaab00a10c9cb214c6d3eaba830b5af0332c41cf45994008f46a4e5ab48
SHA5121aef4da8f0fadad5427e462101110548ab52264f0aa3ef94d146e4d8f0f7915ff593a2ae7929196e4e736e8f8d1fbe0b267ef87494af94c5ba3d3d189ef57741
-
Filesize
235B
MD5d7041c194caa607e0eba6d8354674cbd
SHA17eeb94e486fc7aa831531409c2c45af8f9077662
SHA256952089be9491565a4c8b3c5aaf7311c8c2999b0615c36c41e868bbb93e301409
SHA512eae8e470fb867423f904a2f5f6dd930b780b49191d7dfd0e9aa3517ab882b0a7db7b5f30d8f911eefb6698df37f259dd05da16ca375e9c16723bac40006cc15f
-
Filesize
137B
MD554b51e509f4cec9fb727c778a9714f02
SHA11e29748712c91e5238c09fb659c6352735f88552
SHA2562d6f83ed49170a36f11328327b05e5ff0fb56c3e4bf958ec9e0d5479cba808b3
SHA512c4cd9f7cd32917ecec2e8ef30aca812c41e376fc46ba00549ebfc9bb4480261d865dfb1e94cbc50f93e23f79ea0fe044d68fefb05a35c51ed68c8f524936ce35
-
Filesize
200B
MD5eb22012ff44002baba2f977d9260b34b
SHA10d9ebd418a00a497c0f47efafebfdaf4911bfa5c
SHA256414e2e7016a94cb151ac8ffead6a25805412e4feac9b84d1aa39ae196ede3382
SHA5125a6f990293693f70fedb5ef75f2b8e57025abe76063168f76282257cf50dfaedb4477eda86e8ad5d0975d2b060ea958fef7159d4e7329d7dd7cee1b3ff4c6e8a
-
Filesize
924B
MD5e99eacac38ad5da4344b9c1b5b478fe2
SHA1883fdb01a5bd0314c00586dcaaa974fd63c95199
SHA2569997c2cb3e56d065290a2bb23cfb9ed96452a23cb53a90243d5682f5b79d929e
SHA51238a8a26e1b9500c10b67abe47daed3ad8331e31945b7553d50b4c7c88886236daa6b654b9810269ba690e63fea47476c6f60e6584e4fa93e6d5ea2757e817b2b
-
Filesize
665KB
MD5d1216f9b9a64fd943539cc2b0ddfa439
SHA16fad9aeb7780bdfd88a9a5a73b35b3e843605e6c
SHA256c1e8fda00da574e8759ba262d76b6edc1d5f4a80620730ef0be7527e0d803db2
SHA512c5fd7d81d1d478056fcbed0ba887ce551832f0104e7c31753c3c8760b4d63f38324f74e996684042acc8f9682fce8a8c85172741a868257e87d5e0f988c4e567
-
Filesize
472KB
-
Filesize
28KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
28KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
64KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
472KB
-
Filesize
4KB
-
Filesize
4KB