Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    20/06/2024, 01:18

General

  • Target

    22b586f97b11010cc55cd503043f180737052dca055c848178329f538c10ade0_NeikiAnalytics.exe

  • Size

    741KB

  • MD5

    cc2e1d95832a728f5477c23ce4e53d00

  • SHA1

    79a42c64269f2b69b274fff866230e508845f7be

  • SHA256

    22b586f97b11010cc55cd503043f180737052dca055c848178329f538c10ade0

  • SHA512

    f6cdd1bbedfed9f51341a2de2c4f5fd31090d6855cc9f845279c928dce8899c3c9bed09c397780aa2e13cffb8939e91dc7e02bca0c2af9f6586f582ba20da52c

  • SSDEEP

    12288:ltTuhrf45I8jWtJ8OgL27rd69bk5NCgGhSFB79gYhLIf6EQ9EYcw1Fh:lIt4kt0Kd6F6CNzYhUiEWEYcwp

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 19 IoCs
  • Drops file in Windows directory 4 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\22b586f97b11010cc55cd503043f180737052dca055c848178329f538c10ade0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\22b586f97b11010cc55cd503043f180737052dca055c848178329f538c10ade0_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2044
    • \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3008
      • \??\c:\windows\resources\spoolsv.exe
        c:\windows\resources\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2672
        • \??\c:\windows\resources\svchost.exe
          c:\windows\resources\svchost.exe
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2744
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetWindowsHookEx
            PID:2456
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 01:20 /f
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:2912
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 01:21 /f
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:996
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 01:22 /f
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:908
      • C:\Windows\Explorer.exe
        C:\Windows\Explorer.exe
        3⤵
          PID:2520

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\Resources\spoolsv.exe

      Filesize

      741KB

      MD5

      16ad4068ab5a76d98d225e759ee1eacf

      SHA1

      12e3b32f7f10b7a76272fb63ed009669ee6dcf03

      SHA256

      5a28997363dfd11e7bb4a8bdfd07982c266013b3946886577c279a26b51ce9f0

      SHA512

      5c5d857e7ae4ec36eb7f92b7714c7439a03e77fd6d781e5e3e3309a3a5a549758e7e310879f50549d5cc9b0cd96efd570fc9b01452ba9f2f31f1087e50bec088

    • \Windows\Resources\Themes\explorer.exe

      Filesize

      741KB

      MD5

      25e1606ef0c6929805329336ff8826bb

      SHA1

      24986d35e58f224058d5ac4ad20449bbb8545aa1

      SHA256

      204b2ecd3c5e7fabe294b6d91d48b791d49aafe4ee3fe43b25c35e9d263911e0

      SHA512

      b00f83b88811d6d3ec0a6e10c51be323c4c3d96a04659e0f006c061445a7a67679138947925dc7790bd8e41ec93bae9cebd46e69e760915b7a0a28473fd6c21a

    • \Windows\Resources\svchost.exe

      Filesize

      741KB

      MD5

      63ab80f53525d870fd49c04e410d0399

      SHA1

      2c160bb29fd9822e9a8f4e3a6f86845981142e78

      SHA256

      e14430f41bf5c84d791cfa480df03300bb5c12a7fe9d39faead6338a741ae141

      SHA512

      7c977d8d60a8afdb7775bf94aebf93b672b8c211741d4ceb36c898d9dccb8139aa451e61f7b7ff49671df920453c58eb1af456ab219225a78f050ceff88f1c6f

    • memory/2044-52-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB

    • memory/2044-10-0x0000000003CA0000-0x0000000004012000-memory.dmp

      Filesize

      3.4MB

    • memory/2044-0-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB

    • memory/2456-48-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB

    • memory/2456-43-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB

    • memory/2672-23-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB

    • memory/2672-34-0x0000000003D50000-0x00000000040C2000-memory.dmp

      Filesize

      3.4MB

    • memory/2672-50-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB

    • memory/2744-54-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB

    • memory/2744-42-0x0000000003990000-0x0000000003D02000-memory.dmp

      Filesize

      3.4MB

    • memory/2744-35-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB

    • memory/2744-77-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB

    • memory/2744-75-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB

    • memory/2744-73-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB

    • memory/2744-65-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB

    • memory/2744-57-0x0000000003990000-0x0000000003D02000-memory.dmp

      Filesize

      3.4MB

    • memory/2744-61-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB

    • memory/3008-64-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB

    • memory/3008-55-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB

    • memory/3008-66-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB

    • memory/3008-68-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB

    • memory/3008-70-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB

    • memory/3008-72-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB

    • memory/3008-21-0x0000000003D70000-0x00000000040E2000-memory.dmp

      Filesize

      3.4MB

    • memory/3008-53-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB

    • memory/3008-11-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB

    • memory/3008-80-0x0000000000400000-0x0000000000772000-memory.dmp

      Filesize

      3.4MB