Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
57s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
20/06/2024, 01:18
General
-
Target
22b586f97b11010cc55cd503043f180737052dca055c848178329f538c10ade0_NeikiAnalytics.exe
-
Size
741KB
-
MD5
cc2e1d95832a728f5477c23ce4e53d00
-
SHA1
79a42c64269f2b69b274fff866230e508845f7be
-
SHA256
22b586f97b11010cc55cd503043f180737052dca055c848178329f538c10ade0
-
SHA512
f6cdd1bbedfed9f51341a2de2c4f5fd31090d6855cc9f845279c928dce8899c3c9bed09c397780aa2e13cffb8939e91dc7e02bca0c2af9f6586f582ba20da52c
-
SSDEEP
12288:ltTuhrf45I8jWtJ8OgL27rd69bk5NCgGhSFB79gYhLIf6EQ9EYcw1Fh:lIt4kt0Kd6F6CNzYhUiEWEYcwp
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 4 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
-
Drops file in Windows directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 15 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\22b586f97b11010cc55cd503043f180737052dca055c848178329f538c10ade0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\22b586f97b11010cc55cd503043f180737052dca055c848178329f538c10ade0_NeikiAnalytics.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
741KB
MD534b44ffcab52d9691d4486f2e7cbdcad
SHA16ddd4f9931766a9231c9bb7d92ce67df0820614b
SHA25679b2c7629b97813e6f55c094bcb9675b00c5309a830df3cba3e33e82bc7a1578
SHA5123bd2f067f142817ad6b55be96df395b590addbdd7361fdcfbed3bf65913322879ff9f4795e0a9795e0c0d884729597feb86c7bf7e258b9ffd5bc060196778865
-
Filesize
741KB
MD5302b4de839627b0494c14ba7997a9fb8
SHA185a90368c039365dcbd2621ae8590b3343f460eb
SHA256e084fc04ea4dfdfd4c9a40679bb94737df52564c8aad020092d1c806a9d59dcd
SHA5123dc2004866d6413dea5abc527c741ecff84e8fea095930a35c05d46633937b50d20bef68ba4821759bfca707e630b644eefdcb2595fa9ab3270fde8bbe3620ca
-
Filesize
742KB
MD563dd3432e878fd227b3a70dce8e3d93e
SHA120c976ff9c4683236ca6c6f090d46ff79862515c
SHA2565a3d0da79fb96967161c247a8f3ceb59b32a80b84940a0dc2579ad58dc51317a
SHA512ede1fe22d5e17d82ff27ccf978c25fc07a282cf6645feeacc223aec999b96e6af99a3ba19cf987a26fdef2e386c70c1e6a783171723e2026372536d854a805ef
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB