Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    08/06/2024, 05:08

General

  • Target

    8e99fa4c549c5b7a39f45ebccffaaf40_NeikiAnalytics.exe

  • Size

    199KB

  • MD5

    8e99fa4c549c5b7a39f45ebccffaaf40

  • SHA1

    fe87036f5f877c7ea4c66bb17b370c3e90d1f668

  • SHA256

    77b3ea43e47635f9de0b05eb4c9dabe435b14a6a996675ec83b00c2234016481

  • SHA512

    111dff1969c02842613aa30927f88619856cfe644f1b54c92ba0bac392cbc3877c486545e3a46eac4a8264819fa5b77377138074efbde7d168322559357fd49f

  • SSDEEP

    3072:7vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6u4Pmu7:7vEN2U+T6i5LirrllHy4HUcMQY6B

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 8 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8e99fa4c549c5b7a39f45ebccffaaf40_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\8e99fa4c549c5b7a39f45ebccffaaf40_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2256
    • \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2692
      • \??\c:\windows\system\spoolsv.exe
        c:\windows\system\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2584
        • \??\c:\windows\system\svchost.exe
          c:\windows\system\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2620
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2548
          • C:\Windows\SysWOW64\at.exe
            at 05:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
              PID:1712
            • C:\Windows\SysWOW64\at.exe
              at 05:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              5⤵
                PID:1916
              • C:\Windows\SysWOW64\at.exe
                at 05:12 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                5⤵
                  PID:1972

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\mrsys.exe

          Filesize

          216KB

          MD5

          c27ce5db4ec30bce3a0178bcdc5b749e

          SHA1

          704185eb3df496058da9f1b65bd02703193dabbb

          SHA256

          ad806ea0e395bd62d8031cbf826fa0c469324dae96c7a7855b76c18bcea4fd42

          SHA512

          e960f779dc23789c7f35db0355bac2b1e0a3ca454d524cf83ec0aa07d5fe848a705714bcd2cdb21e2cf7a8ac430dadfeea3a161e2d6a46ca7a4628699339addd

        • \Windows\system\explorer.exe

          Filesize

          216KB

          MD5

          a96d73cbc2d439da452660e7cfa0d8a0

          SHA1

          40261df9d22113a68fed3107abc09c01406fc28b

          SHA256

          acf759cd9921900c1dd5cfd5689b2bf89d07ce8c677492372db926de7c1c8299

          SHA512

          d9a485136acfd51025069e7e9044ee06eafe65e808d2a558d7d1c861c6dd8f6b4a929c2737759a25b1962e25f2512c3d2ff851dca3da7c7c32afd4bb98486153

        • \Windows\system\spoolsv.exe

          Filesize

          216KB

          MD5

          bb4cabf95a99e00afa467ecec407fbac

          SHA1

          bfdba96411987c0d9741746c561b099046c97001

          SHA256

          34e3a1dd4731b6cf5de69f67079e7acb25a9d9b166499659be6632722ffd683c

          SHA512

          a390a6b4ce76a74840f2aa46e305c30a5427c2cf6b0654f8f8d8fdec9244564c28adb04277409f883da9635a26c12e2e7dc62eae79a80dc69e32ab3e6134e2f1

        • \Windows\system\svchost.exe

          Filesize

          216KB

          MD5

          3e2e6b76ba9f98806e1ec4aeab2832d1

          SHA1

          ce117648a74063a2693e27d042642d74f8901e52

          SHA256

          dda4bbe517022e6357cb622e6464dee821803722f035984731eddd044e93cd91

          SHA512

          5772d37dea19873baf3468a653db2a0508166e384ece94223682f2bf3f6ff4709e4e9b81f1eceeeec6cffc717423622ad8260542fef3f191a2dd4751971ef87c

        • memory/2256-12-0x00000000005D0000-0x0000000000601000-memory.dmp

          Filesize

          196KB

        • memory/2256-0-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2256-58-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2256-13-0x00000000005D0000-0x0000000000601000-memory.dmp

          Filesize

          196KB

        • memory/2548-50-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2548-54-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2584-41-0x00000000006F0000-0x0000000000721000-memory.dmp

          Filesize

          196KB

        • memory/2584-57-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2692-28-0x00000000026A0000-0x00000000026D1000-memory.dmp

          Filesize

          196KB