Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
16s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
07/06/2024, 03:12
Static task
static1
Behavioral task
behavioral1
Sample
322e5a0f773010dfd2165cd3b00986c0_NeikiAnalytics.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
322e5a0f773010dfd2165cd3b00986c0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
322e5a0f773010dfd2165cd3b00986c0_NeikiAnalytics.exe
-
Size
5.3MB
-
MD5
322e5a0f773010dfd2165cd3b00986c0
-
SHA1
e42b60b12ca5477920e447de087587eb9b3285fb
-
SHA256
cd0b5bf86e89959eaaa79ce2c1d30eb619a28850fdddab64bded9dfe7971fad2
-
SHA512
e101cda9f5a8fcf0e52489e385ffc88055fcc22792ebb6b7655b032f526d2002e52710ff1dd5a03b1f2b3a18e8b9ec0ee11f75ed431b308e37008186f90bc632
-
SSDEEP
98304:xRjPz9KDzUU8O5/B/LJ25E9SVh86sS3TRknQ3ss2MApp9meypA3cPDu7:xFKoU8O5/b2XViSjX310SeyGc7u7
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4804 powershell.exe 2784 powershell.exe -
Creates new service(s) 2 TTPs
-
Executes dropped EXE 1 IoCs
pid Process 616 lutlgidagtja.exe -
resource yara_rule behavioral2/memory/2940-57-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2940-58-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2940-65-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2940-66-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2940-68-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2940-64-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2940-67-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2940-62-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2940-60-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2940-61-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2940-59-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2940-56-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2940-69-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2940-71-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2940-72-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2940-73-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\MRT.exe 322e5a0f773010dfd2165cd3b00986c0_NeikiAnalytics.exe -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1432 sc.exe 3916 sc.exe 1164 sc.exe 2672 sc.exe 4384 sc.exe 2780 sc.exe 3104 sc.exe 1964 sc.exe 1880 sc.exe 524 sc.exe 4440 sc.exe 3956 sc.exe 4664 sc.exe 3296 sc.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 4048 322e5a0f773010dfd2165cd3b00986c0_NeikiAnalytics.exe 4804 powershell.exe 4804 powershell.exe 4048 322e5a0f773010dfd2165cd3b00986c0_NeikiAnalytics.exe 4048 322e5a0f773010dfd2165cd3b00986c0_NeikiAnalytics.exe 4048 322e5a0f773010dfd2165cd3b00986c0_NeikiAnalytics.exe 4048 322e5a0f773010dfd2165cd3b00986c0_NeikiAnalytics.exe 4048 322e5a0f773010dfd2165cd3b00986c0_NeikiAnalytics.exe 4048 322e5a0f773010dfd2165cd3b00986c0_NeikiAnalytics.exe 4048 322e5a0f773010dfd2165cd3b00986c0_NeikiAnalytics.exe 4048 322e5a0f773010dfd2165cd3b00986c0_NeikiAnalytics.exe 4048 322e5a0f773010dfd2165cd3b00986c0_NeikiAnalytics.exe 4048 322e5a0f773010dfd2165cd3b00986c0_NeikiAnalytics.exe 4048 322e5a0f773010dfd2165cd3b00986c0_NeikiAnalytics.exe 4048 322e5a0f773010dfd2165cd3b00986c0_NeikiAnalytics.exe 4048 322e5a0f773010dfd2165cd3b00986c0_NeikiAnalytics.exe 4048 322e5a0f773010dfd2165cd3b00986c0_NeikiAnalytics.exe 4048 322e5a0f773010dfd2165cd3b00986c0_NeikiAnalytics.exe 616 lutlgidagtja.exe 2784 powershell.exe 2784 powershell.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 4804 powershell.exe Token: SeShutdownPrivilege 1288 powercfg.exe Token: SeCreatePagefilePrivilege 1288 powercfg.exe Token: SeShutdownPrivilege 3892 powercfg.exe Token: SeCreatePagefilePrivilege 3892 powercfg.exe Token: SeShutdownPrivilege 1444 powercfg.exe Token: SeCreatePagefilePrivilege 1444 powercfg.exe Token: SeShutdownPrivilege 5108 powercfg.exe Token: SeCreatePagefilePrivilege 5108 powercfg.exe Token: SeDebugPrivilege 2784 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3364 wrote to memory of 2052 3364 cmd.exe 99 PID 3364 wrote to memory of 2052 3364 cmd.exe 99 PID 4348 wrote to memory of 1752 4348 cmd.exe 126 PID 4348 wrote to memory of 1752 4348 cmd.exe 126
Processes
-
C:\Users\Admin\AppData\Local\Temp\322e5a0f773010dfd2165cd3b00986c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\322e5a0f773010dfd2165cd3b00986c0_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:4048 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4804
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:2052
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:1880
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:4440
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:4384
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:1432
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:3296
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:1288
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:3892
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:5108
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:1444
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "JIOGRCSG"2⤵
- Launches sc.exe
PID:524
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "JIOGRCSG" binpath= "C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe" start= "auto"2⤵
- Launches sc.exe
PID:2780
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:3956
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "JIOGRCSG"2⤵
- Launches sc.exe
PID:3916
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\322e5a0f773010dfd2165cd3b00986c0_NeikiAnalytics.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵PID:1752
-
-
-
C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exeC:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:616 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2784
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵PID:4036
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:3452
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:4664
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:2672
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:1964
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:1164
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:3104
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵PID:756
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵PID:2824
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵PID:1696
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵PID:3472
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:3412
-
-
C:\Windows\system32\nslookup.exenslookup.exe2⤵PID:2940
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
MD5af1273490d335d5770d8be7c32382b49
SHA17fda952bbf059cb73206c59266216a829bed3d78
SHA256f733c2398a8fe112d6b4a0ee4c39083ac74496d8c27b337b2a0ab162393ae60b
SHA512318231c6408bbca11e43c4ff8c13b62b3788714ef229c4d2ba0a953705c2f21b1e3b9981b3af7a197a4d8f14567a40bf09efc4e2a029da53fc1ea7dcc573cb12
-
Filesize
576KB
MD544d0f03dc262325b83399f69727869f3
SHA13edd13183d1ccfd2f46f6bc387a12fe09ae6329d
SHA256ad2cdc6fcfaef90ef0160215c6b652c48206cfa1e84fccd981966165f4299fcd
SHA51292b5190c17efdf5d6c4a920a2dec29e32186dc6c4a308a4604f0f8e0edba9ca0ea497e03397e668522072f3e9cfe6b71f2a420d4cf893c7d4cff305da2584ed3
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82