Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
07/06/2024, 00:25
General
-
Target
281c18e8a521294e12700f0d705cc190_NeikiAnalytics.dll
-
Size
500KB
-
MD5
281c18e8a521294e12700f0d705cc190
-
SHA1
f7199b31f54c53f7cadfd8274bfafb84f963659b
-
SHA256
92fd5c4a7684b87c475dce2a21514927521446db995b70db5c1a42ad310724d8
-
SHA512
f5b33867bed7c5aac2cda9b2ab3973e1206b35ec905080d0f6a97da05bc7e78f59cd167b3b4c5bd206be3679768fcebda2be12be7136d998809a5e36fa4b42f1
-
SSDEEP
6144:hi05kH9OyU2uv5SRf/FWgFgt0gqIRAUW9kVYeVprU4wfhTv5xD2ZP0GVGdXcukT4:krHGPv5SmptZDmUWuVZkxikdXcq
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 10 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 22 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 50 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\281c18e8a521294e12700f0d705cc190_NeikiAnalytics.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\fixmapi.exeC:\Windows\system32\fixmapi.exe1⤵
-
C:\Windows\system32\RemotePosWorker.exeC:\Windows\system32\RemotePosWorker.exe1⤵
-
C:\Windows\system32\Utilman.exeC:\Windows\system32\Utilman.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\UQ4.cmd1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Delete /F /TN "User_Feed_Synchronization-{6fbc9e50-6a1b-17d9-5db5-133f618c672e}"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /TN "User_Feed_Synchronization-{6fbc9e50-6a1b-17d9-5db5-133f618c672e}"2⤵
-
-
C:\Windows\system32\xwizard.exeC:\Windows\system32\xwizard.exe1⤵
-
C:\Windows\system32\AppVShNotify.exeC:\Windows\system32\AppVShNotify.exe1⤵
-
C:\Windows\system32\wsmprovhost.exeC:\Windows\system32\wsmprovhost.exe1⤵
-
C:\Windows\system32\cleanmgr.exeC:\Windows\system32\cleanmgr.exe1⤵
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe1⤵
-
C:\Windows\system32\wiawow64.exeC:\Windows\system32\wiawow64.exe1⤵
-
C:\Windows\system32\CompPkgSrv.exeC:\Windows\system32\CompPkgSrv.exe1⤵
-
C:\Windows\system32\audiodg.exeC:\Windows\system32\audiodg.exe1⤵
-
C:\Windows\system32\DTUHandler.exeC:\Windows\system32\DTUHandler.exe1⤵
-
C:\Windows\system32\PkgMgr.exeC:\Windows\system32\PkgMgr.exe1⤵
-
C:\Windows\system32\DeviceCensus.exeC:\Windows\system32\DeviceCensus.exe1⤵
-
C:\Windows\system32\notepad.exeC:\Windows\system32\notepad.exe1⤵
-
C:\Windows\system32\omadmprc.exeC:\Windows\system32\omadmprc.exe1⤵
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe1⤵
-
C:\Windows\system32\omadmclient.exeC:\Windows\system32\omadmclient.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\vIj.cmd1⤵
- Drops file in System32 directory
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\TjAyv6F.cmd2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /F /TN "Lgeeulo" /SC minute /MO 60 /TR "C:\Windows\system32\3908\omadmclient.exe" /RL highest3⤵
- Creates scheduled task(s)
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3924,i,13640054265074968359,8146127767143474550,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:81⤵
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
504KB
MD58794fb567bae1a86cacc94ca0a67bb15
SHA13f9ede9c80a713d7e0eb9e648169b7c7a78cde2e
SHA256a22b26b7040fdcefd6af37e7dd77d852a35f50460e6c53c0b8d253d89cdd357e
SHA5126782cc4f74d81b8b8551a968269a96ce3fb5a97f71bff9924cec5627d3c8b64dfb5153a23d3c1accb93b176879b8dc349010428a873947053a2daba190dd6188
-
Filesize
129B
MD52a08edb3047cf2332658dc1c7bcc854b
SHA14430463d10564be7b536749f873251ab39bdf65c
SHA2563d52e91669fd973949b50325fec67bdaed71012e5876c2ef428b2e28762d1c7a
SHA512ba82975443169b7e5be14ac17aabd495bd56d93d847374f594525496607b9ff39da06e9819d4a2cdc6c773e4612964b345db2c385d90a3f5b891f415bf8892ec
-
Filesize
231B
MD50b0d210162ae23653b743294f0b48c66
SHA1fd0fda432122d397d968a40059860936a43ace3c
SHA256eb1070c6cb3834fefceeddbe312b4852bfdcf7099568be161cc56985afa2860c
SHA5129bbeb01998855fbcab9f606aca3c8852181ca5fa15e9d6b697bf9b3859629fb020fa7e1c16fa99a9bbf23e95313cd35cf2982301bfa073e3118f65697ec957dd
-
Filesize
504KB
MD54590c2d075437c9349d004156e1b516f
SHA162a0035f518da6f754f4ca7aa1820dcd1829eea9
SHA256519ea94700fbf2c6147552e353dc0db00db75905f5ff5b4929f9a998c080b1b6
SHA5123695334e820ca1dbe70c6c23ae93a1600ac735625636aab5975a887ac485ce76817945b8867615706dc652870e00ce5f0fcc313e1d97576667895c3db080763e
-
Filesize
198B
MD5c6f69350ab1bdaa763c792b8cbdff085
SHA116826ae62ebb1834acba3e99c77b4aecde2e2858
SHA2566c037a91fe2cf35ac93a4ba1fd709841d9c506d0db33956c60d91f753d068bf2
SHA512f630921ad29decc71cb13ed4e2656083be0bf4649bc926693814b561e2179ec81e56af6e41ec32d710c404e322e07fdc85bf37db344f85bbd9c3931f67a52f04
-
Filesize
123KB
MD5a117edc0e74ab4770acf7f7e86e573f7
SHA15ceffb1a5e05e52aafcbc2d44e1e8445440706f3
SHA256b5bc4fce58403ea554691db678e6c8c448310fe59990990f0e37cd4357567d37
SHA51272883f794ff585fe7e86e818d4d8c54fa9781cab6c3fac6f6956f58a016a91f676e70d14691cbe054ae7b7469c6b4783152fbb694e92b940d9e3595fe3f41d97
-
Filesize
908B
MD5c25088a7e9530a864287bf0dd21035bb
SHA1b6c2e8b229196aa8c0e7cedb8371bfb618b31dbf
SHA256653db550d632fb95a08e5d17c1dc0822b6b1b874881f34e876cd15e05a53be0b
SHA512c6a78dbab78145fba25ad80489e3933b7dad0079c7c2b300cbaf3d33886155b119c0cba24c0fdfa7effe7f651b91debb2bac063eeade48edd1b73b8cade707e0
-
Filesize
500KB
-
Filesize
500KB
-
Filesize
28KB
-
Filesize
500KB
-
Filesize
500KB
-
Filesize
500KB
-
Filesize
500KB
-
Filesize
500KB
-
Filesize
500KB
-
Filesize
64KB
-
Filesize
500KB
-
Filesize
4KB
-
Filesize
500KB
-
Filesize
500KB
-
Filesize
500KB
-
Filesize
500KB
-
Filesize
500KB
-
Filesize
500KB
-
Filesize
500KB
-
Filesize
500KB
-
Filesize
500KB
-
Filesize
500KB
-
Filesize
500KB
-
Filesize
500KB
-
Filesize
500KB
-
Filesize
500KB
-
Filesize
500KB
-
Filesize
4KB
-
Filesize
500KB
-
Filesize
500KB
-
Filesize
28KB