Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

652e5c5ca8...cs.exe

windows7-x64

8

652e5c5ca8...cs.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    147s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    20/06/2024, 13:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    652e5c5ca83720cd9fb6902890af7af8776145352e4a9afa13e95a4161d07db8_NeikiAnalytics.exe

  • Size

    119KB

  • MD5

    1cd3aadd971541f7a5dcb5c714e4e0d0

  • SHA1

    135ed42948dd10a56f535218f6dabe5095d92bb3

  • SHA256

    652e5c5ca83720cd9fb6902890af7af8776145352e4a9afa13e95a4161d07db8

  • SHA512

    7f036f8a914ad45527de1c9ba6194fed2bb93a103a399dbd287ae68fb2bfd3127174fd7cf1f54179166cb207076e8870be8f023b035d76e94760ba27e5c999c1

  • SSDEEP

    3072:8OjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPh:8Is9OKofHfHTXQLzgvnzHPowYbvrjD/E

Score
8/10
persistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\652e5c5ca83720cd9fb6902890af7af8776145352e4a9afa13e95a4161d07db8_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\652e5c5ca83720cd9fb6902890af7af8776145352e4a9afa13e95a4161d07db8_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1956
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2592
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:2588

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\satornas.dll
    Filesize

    183B

    MD5

    a0f530126da9cb0ae44ada90f675d4cb

    SHA1

    f2dd287b28e3607a4299ade2c2b53bd734d25ce5

    SHA256

    af93821d87eb71a234b5d13c4973372f14ce1a606507051838a8dfc1cc565016

    SHA512

    6e929098854ea6bf416e36a67c26db6ebf71086ba54142ec1b6bdfb4570ccf140462fb836468a04d6875d6a53f90d43a20a95f171ce95293e60577ebc530bad5

    Download Submit

  • \Windows\SysWOW64\ctfmen.exe
    Filesize

    4KB

    MD5

    b491030c3cb95b3b43c6c7aec1b77791

    SHA1

    3209e3ad68d4e711f4f567110367e84c36423fe4

    SHA256

    0f140887dd8ea01a39f8f3c2c3418edd5cf230c81496adfa1e8e7688e7a0b038

    SHA512

    95bc088611bc0dea370ab15e42b4b72b016560dc3f2ec72d41de38e14f747e93b7eb794b4e6e938ffe15a580d3bc658543436ad3dc47d2857d688bc773306785

    Download Submit

  • \Windows\SysWOW64\shervans.dll
    Filesize

    8KB

    MD5

    6e7746e4ac3cb8a5e6e825c381e5c08e

    SHA1

    1c53bdbc752cce05a3f6dd504c92e7d860abdc30

    SHA256

    c6c8c8c0d6f0a2a3a2094473156686b7fd89bc6105b50813541deeb10919849d

    SHA512

    bd940c290298ac95a0df0a64abef30611b46e93c95550acc69536226a9dde262a555f2645e9cba5967725164d83074eff731ad7f5a856e99823f2970df6e30aa

    Download Submit

  • \Windows\SysWOW64\smnss.exe
    Filesize

    119KB

    MD5

    7223a99aed4dae2355511c96c9ca85eb

    SHA1

    bdb8ac3a1d970a34f62fa06dd5ead855d1f5cb7a

    SHA256

    29e8ca60e0c1bcc8d08bfc909e3573d82e20501f593981b7cc3c88e77f4c83e2

    SHA512

    39100e3a0c6cbe96f4632ca83abf94f0fa3a5e21a17c1121d7d10219a6c1d0f547847f0d5a28a9a5ff9d7e9d3db1604567ecf3817b27516b7400e7401eaf5da5

    Download Submit

  • memory/1956-26-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1956-25-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/1956-0-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1956-18-0x0000000000350000-0x0000000000359000-memory.dmp

    Filesize

    36KB

    Download

  • memory/1956-16-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2588-33-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2588-40-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2588-43-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2592-32-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download