Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/06/2024, 06:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
934c6395fdbfaf3618cd75df51678720_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
934c6395fdbfaf3618cd75df51678720_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
934c6395fdbfaf3618cd75df51678720_NeikiAnalytics.exe
-
Size
206KB
-
MD5
934c6395fdbfaf3618cd75df51678720
-
SHA1
c24a012dc29e5d927a0ce107c5b68357faa4404e
-
SHA256
8c1446154d9ff5adfad2e4cbccf641b5e105e4cb820feb842c2d793e70b0e6f7
-
SHA512
86c1dbe6a66ffa7e81495891f56d84a2e93cb9c21ece76fc72f436a581558d5c92fe1bb2e2c87c41b76021f8c4d0f4350ad14fb9d7cbdf2aa58bcd446e1e794b
-
SSDEEP
3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unY:5vEN2U+T6i5LirrllHy4HUcMQY67
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Executes dropped EXE 4 IoCs
pid Process 2736 explorer.exe 2672 spoolsv.exe 2740 svchost.exe 2692 spoolsv.exe -
Loads dropped DLL 8 IoCs
pid Process 1312 934c6395fdbfaf3618cd75df51678720_NeikiAnalytics.exe 1312 934c6395fdbfaf3618cd75df51678720_NeikiAnalytics.exe 2736 explorer.exe 2736 explorer.exe 2672 spoolsv.exe 2672 spoolsv.exe 2740 svchost.exe 2740 svchost.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe 934c6395fdbfaf3618cd75df51678720_NeikiAnalytics.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1312 934c6395fdbfaf3618cd75df51678720_NeikiAnalytics.exe 2736 explorer.exe 2736 explorer.exe 2736 explorer.exe 2740 svchost.exe 2740 svchost.exe 2736 explorer.exe 2740 svchost.exe 2736 explorer.exe 2740 svchost.exe 2736 explorer.exe 2740 svchost.exe 2736 explorer.exe 2740 svchost.exe 2736 explorer.exe 2740 svchost.exe 2736 explorer.exe 2740 svchost.exe 2736 explorer.exe 2740 svchost.exe 2736 explorer.exe 2740 svchost.exe 2736 explorer.exe 2740 svchost.exe 2736 explorer.exe 2740 svchost.exe 2736 explorer.exe 2740 svchost.exe 2736 explorer.exe 2740 svchost.exe 2736 explorer.exe 2740 svchost.exe 2736 explorer.exe 2740 svchost.exe 2736 explorer.exe 2740 svchost.exe 2736 explorer.exe 2740 svchost.exe 2736 explorer.exe 2740 svchost.exe 2736 explorer.exe 2740 svchost.exe 2736 explorer.exe 2740 svchost.exe 2736 explorer.exe 2740 svchost.exe 2736 explorer.exe 2740 svchost.exe 2736 explorer.exe 2740 svchost.exe 2736 explorer.exe 2740 svchost.exe 2736 explorer.exe 2740 svchost.exe 2736 explorer.exe 2740 svchost.exe 2736 explorer.exe 2740 svchost.exe 2736 explorer.exe 2740 svchost.exe 2736 explorer.exe 2740 svchost.exe 2736 explorer.exe 2740 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2736 explorer.exe 2740 svchost.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 1312 934c6395fdbfaf3618cd75df51678720_NeikiAnalytics.exe 1312 934c6395fdbfaf3618cd75df51678720_NeikiAnalytics.exe 2736 explorer.exe 2736 explorer.exe 2672 spoolsv.exe 2672 spoolsv.exe 2740 svchost.exe 2740 svchost.exe 2692 spoolsv.exe 2692 spoolsv.exe 2736 explorer.exe 2736 explorer.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1312 wrote to memory of 2736 1312 934c6395fdbfaf3618cd75df51678720_NeikiAnalytics.exe 28 PID 1312 wrote to memory of 2736 1312 934c6395fdbfaf3618cd75df51678720_NeikiAnalytics.exe 28 PID 1312 wrote to memory of 2736 1312 934c6395fdbfaf3618cd75df51678720_NeikiAnalytics.exe 28 PID 1312 wrote to memory of 2736 1312 934c6395fdbfaf3618cd75df51678720_NeikiAnalytics.exe 28 PID 2736 wrote to memory of 2672 2736 explorer.exe 29 PID 2736 wrote to memory of 2672 2736 explorer.exe 29 PID 2736 wrote to memory of 2672 2736 explorer.exe 29 PID 2736 wrote to memory of 2672 2736 explorer.exe 29 PID 2672 wrote to memory of 2740 2672 spoolsv.exe 30 PID 2672 wrote to memory of 2740 2672 spoolsv.exe 30 PID 2672 wrote to memory of 2740 2672 spoolsv.exe 30 PID 2672 wrote to memory of 2740 2672 spoolsv.exe 30 PID 2740 wrote to memory of 2692 2740 svchost.exe 31 PID 2740 wrote to memory of 2692 2740 svchost.exe 31 PID 2740 wrote to memory of 2692 2740 svchost.exe 31 PID 2740 wrote to memory of 2692 2740 svchost.exe 31 PID 2740 wrote to memory of 2468 2740 svchost.exe 32 PID 2740 wrote to memory of 2468 2740 svchost.exe 32 PID 2740 wrote to memory of 2468 2740 svchost.exe 32 PID 2740 wrote to memory of 2468 2740 svchost.exe 32 PID 2740 wrote to memory of 1804 2740 svchost.exe 36 PID 2740 wrote to memory of 1804 2740 svchost.exe 36 PID 2740 wrote to memory of 1804 2740 svchost.exe 36 PID 2740 wrote to memory of 1804 2740 svchost.exe 36 PID 2740 wrote to memory of 1760 2740 svchost.exe 38 PID 2740 wrote to memory of 1760 2740 svchost.exe 38 PID 2740 wrote to memory of 1760 2740 svchost.exe 38 PID 2740 wrote to memory of 1760 2740 svchost.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\934c6395fdbfaf3618cd75df51678720_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\934c6395fdbfaf3618cd75df51678720_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2692
-
-
C:\Windows\SysWOW64\at.exeat 06:17 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:2468
-
-
C:\Windows\SysWOW64\at.exeat 06:18 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:1804
-
-
C:\Windows\SysWOW64\at.exeat 06:19 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe5⤵PID:1760
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
206KB
MD560db2f15985ce0291254334bb967268c
SHA169c82f8049802614bbb255cfae4c7f4c16f88742
SHA256c5bbf51d2f500ef9c497de4dcb591c523be5122bb415b970bd57ff53409fd778
SHA5121432924d8ba847a0ca323702afe21a646a05ebed8a85696cfb895d4cc8b747cc7d43e619d4d4b83dbcd8a9ff4930ff7081b9bc5adc73160bd314fc865d831a8e
-
Filesize
206KB
MD58e701a89da54ff2480f3b8f3e6710d24
SHA1a881f48e73d6a881d3d27d4d50a6b17e02c70dae
SHA256f34c31d19860cc0cc8269920d36ba8452a9c3dbc60748bbbfb521669f613ede8
SHA512255d643af7ade428cdec5dd4687ff1a56f94173f735ba054226e97b72b717016b458fc675c454fa5ea582f2234563901a3c6f93aaee23599643d6250c3e672ad
-
Filesize
207KB
MD5e7237fb343777e049ceea296a4e8a26e
SHA141d5377f71c1a08d56abaa652fa169ea5013c40f
SHA25686d97928ae425441dbee5a9692179febe41a9dd608d621ea9ba05072f1287f44
SHA512f21b7f882e35c5da7bb45b06aaaef5847ddd8464bcedc752d9ecfcc0f71bd81707db9e45346da1d8b79eb16caae4aa8f8722e0455fce7f93c93025ab7d122835
-
Filesize
206KB
MD58d8019c744f0da92222f23823c4a56e7
SHA15b308ae28cc0fe2918a9640d620a1f0892abc4d6
SHA25691ba2ffbe126814547cfe68777c54e71ef5460220787bdc6f009f3a3cfb0ac02
SHA5126b4c7447a49c1758a373634e67cd9d4a4e0f37be192818c473367dbc93add926c5431c41ac4731d566050e05ca17a1b88172a26c8a50be3f4016cbbe4fd84e76