Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/06/2024, 05:20

General

  • Target

    0a4a2bdf1520ea368dda567ce423b1f0_NeikiAnalytics.exe

  • Size

    66KB

  • MD5

    0a4a2bdf1520ea368dda567ce423b1f0

  • SHA1

    43e8b4b62303f634d578027941d73ddb8850af59

  • SHA256

    bc37a8257d3abbce99147ba063fcdd36a635d5a2406218f01d5eaf64485aa659

  • SHA512

    b3d2ca5860d76158761e04181aad250d5ebc067aaf3b9bb6591defd6963aa05108f3111f519895da8092dc4ef11042ea2f52ab829b5ecef83650fdb940eebb9f

  • SSDEEP

    1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXiQ:IeklMMYJhqezw/pXzH9iQ

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0a4a2bdf1520ea368dda567ce423b1f0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\0a4a2bdf1520ea368dda567ce423b1f0_NeikiAnalytics.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1248
    • \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1776
      • \??\c:\windows\system\spoolsv.exe
        c:\windows\system\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3648
        • \??\c:\windows\system\svchost.exe
          c:\windows\system\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1204
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2684
          • C:\Windows\SysWOW64\at.exe
            at 05:22 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
              PID:1388
            • C:\Windows\SysWOW64\at.exe
              at 05:23 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              5⤵
                PID:1344
              • C:\Windows\SysWOW64\at.exe
                at 05:24 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                5⤵
                  PID:3816

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\mrsys.exe

          Filesize

          66KB

          MD5

          0f89cb47a9d243d37119358b17e7a986

          SHA1

          f7d48d3d456af685ee9a983ddc8f37b1d282c316

          SHA256

          b60698d5a14e206ecf5d7fe53a6478ca6342cd2f4d247ce60653165346f312e9

          SHA512

          68f6e2b0290c046c723286e844cafab86836df80698e18efdbae96c078132177bf667b0f712f80002598a035e6e0beb212c12ffe91c184bed97346ef76570dcd

        • C:\Windows\System\explorer.exe

          Filesize

          66KB

          MD5

          2a165bf570d2c00e4d6f92abd00f77af

          SHA1

          53626d33de3b37e1a6688a6583e15580e03b013a

          SHA256

          12b0261518709cfab846fafed09697578c11be913490dd4e5c23b9714b7d5290

          SHA512

          6261deef5687dccb2cf7e110d78128e2382c4d62d60cb25ca62a0422e621e0332495662aaac8a980d9f609e772687735a916ae18ce4d2195b60273841ce7fcf5

        • C:\Windows\System\spoolsv.exe

          Filesize

          66KB

          MD5

          74db2aed9c6fce6a0ca1282e5423fa73

          SHA1

          8442a7407edb1ee325725280463e7b4c6944e42a

          SHA256

          73a4b77cc662010c7f1f89d9589b0ce17e775ad2bf6e8cae444a5f68ccdc6c47

          SHA512

          8c24a195f63d9174ebbdc42dba20f497ac820e5c66a34354540d378bf2b4c94df3530b09e9499b80c111d47119d69c9cb9738c44bcdb00a4f9f160f0282d00fe

        • C:\Windows\System\svchost.exe

          Filesize

          66KB

          MD5

          9991f43d0b234a62396f0a51cf224468

          SHA1

          9c02ae02eaad3ce9b889bf2420e883f4e86abb55

          SHA256

          bca2e84feea534f2b5033232666664e709a63061db0fc74c60ec202040bc4c5d

          SHA512

          f3d2a7aa6cce5e57d370b9bfdee321d859be14c51a1a447f2f3f1f7c3735dfd66795812290eb6ce9580f24b35ad822bdeff79430c3d78297667f8f3a63660766

        • memory/1204-59-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/1204-36-0x0000000075370000-0x00000000754CD000-memory.dmp

          Filesize

          1.4MB

        • memory/1248-55-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/1248-2-0x0000000075370000-0x00000000754CD000-memory.dmp

          Filesize

          1.4MB

        • memory/1248-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

          Filesize

          16KB

        • memory/1248-0-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/1248-56-0x0000000000401000-0x000000000042E000-memory.dmp

          Filesize

          180KB

        • memory/1248-3-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/1248-7-0x0000000000401000-0x000000000042E000-memory.dmp

          Filesize

          180KB

        • memory/1776-17-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/1776-58-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/1776-68-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/1776-13-0x0000000075370000-0x00000000754CD000-memory.dmp

          Filesize

          1.4MB

        • memory/2684-42-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2684-43-0x0000000075370000-0x00000000754CD000-memory.dmp

          Filesize

          1.4MB

        • memory/2684-51-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/3648-28-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/3648-54-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/3648-25-0x0000000075370000-0x00000000754CD000-memory.dmp

          Filesize

          1.4MB

        • memory/3648-24-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB