Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    57s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/06/2024, 01:18

General

  • Target

    22b586f97b11010cc55cd503043f180737052dca055c848178329f538c10ade0_NeikiAnalytics.exe

  • Size

    741KB

  • MD5

    cc2e1d95832a728f5477c23ce4e53d00

  • SHA1

    79a42c64269f2b69b274fff866230e508845f7be

  • SHA256

    22b586f97b11010cc55cd503043f180737052dca055c848178329f538c10ade0

  • SHA512

    f6cdd1bbedfed9f51341a2de2c4f5fd31090d6855cc9f845279c928dce8899c3c9bed09c397780aa2e13cffb8939e91dc7e02bca0c2af9f6586f582ba20da52c

  • SSDEEP

    12288:ltTuhrf45I8jWtJ8OgL27rd69bk5NCgGhSFB79gYhLIf6EQ9EYcw1Fh:lIt4kt0Kd6F6CNzYhUiEWEYcwp

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
  • Drops file in Windows directory 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\22b586f97b11010cc55cd503043f180737052dca055c848178329f538c10ade0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\22b586f97b11010cc55cd503043f180737052dca055c848178329f538c10ade0_NeikiAnalytics.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3412
    • \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4828
      • \??\c:\windows\resources\spoolsv.exe
        c:\windows\resources\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4468
        • \??\c:\windows\resources\svchost.exe
          c:\windows\resources\svchost.exe
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4044
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetWindowsHookEx
            PID:1820

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Resources\Themes\explorer.exe

    Filesize

    741KB

    MD5

    34b44ffcab52d9691d4486f2e7cbdcad

    SHA1

    6ddd4f9931766a9231c9bb7d92ce67df0820614b

    SHA256

    79b2c7629b97813e6f55c094bcb9675b00c5309a830df3cba3e33e82bc7a1578

    SHA512

    3bd2f067f142817ad6b55be96df395b590addbdd7361fdcfbed3bf65913322879ff9f4795e0a9795e0c0d884729597feb86c7bf7e258b9ffd5bc060196778865

  • C:\Windows\Resources\spoolsv.exe

    Filesize

    741KB

    MD5

    302b4de839627b0494c14ba7997a9fb8

    SHA1

    85a90368c039365dcbd2621ae8590b3343f460eb

    SHA256

    e084fc04ea4dfdfd4c9a40679bb94737df52564c8aad020092d1c806a9d59dcd

    SHA512

    3dc2004866d6413dea5abc527c741ecff84e8fea095930a35c05d46633937b50d20bef68ba4821759bfca707e630b644eefdcb2595fa9ab3270fde8bbe3620ca

  • \??\c:\windows\resources\svchost.exe

    Filesize

    742KB

    MD5

    63dd3432e878fd227b3a70dce8e3d93e

    SHA1

    20c976ff9c4683236ca6c6f090d46ff79862515c

    SHA256

    5a3d0da79fb96967161c247a8f3ceb59b32a80b84940a0dc2579ad58dc51317a

    SHA512

    ede1fe22d5e17d82ff27ccf978c25fc07a282cf6645feeacc223aec999b96e6af99a3ba19cf987a26fdef2e386c70c1e6a783171723e2026372536d854a805ef

  • memory/1820-31-0x0000000000400000-0x0000000000772000-memory.dmp

    Filesize

    3.4MB

  • memory/1820-36-0x0000000000400000-0x0000000000772000-memory.dmp

    Filesize

    3.4MB

  • memory/3412-39-0x0000000000400000-0x0000000000772000-memory.dmp

    Filesize

    3.4MB

  • memory/3412-0-0x0000000000400000-0x0000000000772000-memory.dmp

    Filesize

    3.4MB

  • memory/4044-61-0x0000000000400000-0x0000000000772000-memory.dmp

    Filesize

    3.4MB

  • memory/4044-26-0x0000000000400000-0x0000000000772000-memory.dmp

    Filesize

    3.4MB

  • memory/4044-53-0x0000000000400000-0x0000000000772000-memory.dmp

    Filesize

    3.4MB

  • memory/4044-59-0x0000000000400000-0x0000000000772000-memory.dmp

    Filesize

    3.4MB

  • memory/4044-41-0x0000000000400000-0x0000000000772000-memory.dmp

    Filesize

    3.4MB

  • memory/4044-57-0x0000000000400000-0x0000000000772000-memory.dmp

    Filesize

    3.4MB

  • memory/4044-49-0x0000000000400000-0x0000000000772000-memory.dmp

    Filesize

    3.4MB

  • memory/4468-38-0x0000000000400000-0x0000000000772000-memory.dmp

    Filesize

    3.4MB

  • memory/4828-44-0x0000000000400000-0x0000000000772000-memory.dmp

    Filesize

    3.4MB

  • memory/4828-52-0x0000000000400000-0x0000000000772000-memory.dmp

    Filesize

    3.4MB

  • memory/4828-50-0x0000000000400000-0x0000000000772000-memory.dmp

    Filesize

    3.4MB

  • memory/4828-54-0x0000000000400000-0x0000000000772000-memory.dmp

    Filesize

    3.4MB

  • memory/4828-46-0x0000000000400000-0x0000000000772000-memory.dmp

    Filesize

    3.4MB

  • memory/4828-40-0x0000000000400000-0x0000000000772000-memory.dmp

    Filesize

    3.4MB

  • memory/4828-9-0x0000000000400000-0x0000000000772000-memory.dmp

    Filesize

    3.4MB

  • memory/4828-64-0x0000000000400000-0x0000000000772000-memory.dmp

    Filesize

    3.4MB

  • memory/4828-66-0x0000000000400000-0x0000000000772000-memory.dmp

    Filesize

    3.4MB