Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
14/06/2024, 09:28
Static task
static1
Behavioral task
behavioral1
Sample
b46a12991a9135f8cfeeb503aadaa850_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
b46a12991a9135f8cfeeb503aadaa850_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
b46a12991a9135f8cfeeb503aadaa850_NeikiAnalytics.exe
-
Size
118KB
-
MD5
b46a12991a9135f8cfeeb503aadaa850
-
SHA1
6ccd9d6ab1d3315c05f84091ead34d55f297943f
-
SHA256
1093d454744c2fadb8f8744fdc03f9b8f70575deee13c162d7a5e76225c3c60f
-
SHA512
77152f905bd6707aac42851c430909136de7b174bad76b70c5f1cc4fc3b4655a64a1c37bf085c226b99e4edabb22687297fa357c23a958830da1e7723a8f4957
-
SSDEEP
3072:qJO248B0EMlISxbHPwYV/wlmNie0ROfOlX:qTLSzISxMYV/9i1b
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2776 winlgon.exe 2732 rgsvr32.exe -
Loads dropped DLL 4 IoCs
pid Process 2444 b46a12991a9135f8cfeeb503aadaa850_NeikiAnalytics.exe 2444 b46a12991a9135f8cfeeb503aadaa850_NeikiAnalytics.exe 2776 winlgon.exe 2776 winlgon.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\winlgon.exe = "c:\\users\\admin\\appdata\\local\\temp\\winlgon.exe" b46a12991a9135f8cfeeb503aadaa850_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlgon.exe = "c:\\users\\admin\\appdata\\local\\temp\\winlgon.exe" b46a12991a9135f8cfeeb503aadaa850_NeikiAnalytics.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2716 2444 WerFault.exe 27 -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2444 b46a12991a9135f8cfeeb503aadaa850_NeikiAnalytics.exe 2776 winlgon.exe 2776 winlgon.exe 2776 winlgon.exe 2776 winlgon.exe 2776 winlgon.exe 2776 winlgon.exe 2732 rgsvr32.exe 2732 rgsvr32.exe 2732 rgsvr32.exe 2732 rgsvr32.exe 2776 winlgon.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2444 wrote to memory of 2776 2444 b46a12991a9135f8cfeeb503aadaa850_NeikiAnalytics.exe 28 PID 2444 wrote to memory of 2776 2444 b46a12991a9135f8cfeeb503aadaa850_NeikiAnalytics.exe 28 PID 2444 wrote to memory of 2776 2444 b46a12991a9135f8cfeeb503aadaa850_NeikiAnalytics.exe 28 PID 2444 wrote to memory of 2776 2444 b46a12991a9135f8cfeeb503aadaa850_NeikiAnalytics.exe 28 PID 2776 wrote to memory of 2732 2776 winlgon.exe 30 PID 2776 wrote to memory of 2732 2776 winlgon.exe 30 PID 2776 wrote to memory of 2732 2776 winlgon.exe 30 PID 2776 wrote to memory of 2732 2776 winlgon.exe 30 PID 2444 wrote to memory of 2716 2444 b46a12991a9135f8cfeeb503aadaa850_NeikiAnalytics.exe 29 PID 2444 wrote to memory of 2716 2444 b46a12991a9135f8cfeeb503aadaa850_NeikiAnalytics.exe 29 PID 2444 wrote to memory of 2716 2444 b46a12991a9135f8cfeeb503aadaa850_NeikiAnalytics.exe 29 PID 2444 wrote to memory of 2716 2444 b46a12991a9135f8cfeeb503aadaa850_NeikiAnalytics.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\b46a12991a9135f8cfeeb503aadaa850_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b46a12991a9135f8cfeeb503aadaa850_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\users\admin\appdata\local\temp\winlgon.exec:\users\admin\appdata\local\temp\winlgon.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\rgsvr32.exeC:\Users\Admin\AppData\Local\Temp\rgsvr32.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2732
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 2002⤵
- Program crash
PID:2716
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
118KB
MD517edcf78d81bc0f63ec89bf3cefe25c3
SHA11d55053e3afdf5a916638a26009568069fdea57d
SHA256d94a17aa5cfd129aef365c87d1a5da210f31266b59967f6d7053e15f5903147d
SHA5124d52cbc8e01bc5c56b64d21978e6807a2fbe0bf05377b080bdb86e4b48243bc8c70fed80f7a83fb5f1a0874ad0321ebb702eed9c912d32a00c8bb7dd2a0843dc
-
Filesize
32KB
MD5a22518e8a73ec19da806817d825d8a9c
SHA16f99e1591e1ce68ac44cd760729b2aeb2cba3559
SHA2561ab5d2ea45fbff4444eabb45a3a31538730ce56f2b9c041bcab958e3c69db97b
SHA5128f56ea79eab4b2e1d6b81981a9cd4f9652821b1cf17337ff3abf5796654fef08859fe4fa186015507b00ac606eefade1541235fcc6202ebf5257a1311638511e