Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    25/06/2024, 11:59

General

  • Target

    5d12265ad38ba929bf154d1f1d7739da75ff67529b029deaec3ebe7c8b40d9c0_NeikiAnalytics.exe

  • Size

    27KB

  • MD5

    c73e8ff083a44af790736524a00926e0

  • SHA1

    4eea58174191d6922b7bb10f7a04b41d8ae00449

  • SHA256

    5d12265ad38ba929bf154d1f1d7739da75ff67529b029deaec3ebe7c8b40d9c0

  • SHA512

    151af59dfcca932664063f5044a37ad9036a5234172f3b2a9dec8a0c74506ef18e3609e78e6eb1ba2e69b791b3bd2d5eb7d9bba2764906ed6dc471b6c6e5204e

  • SSDEEP

    768:PVEHJqjHyGvwFylDpulVSQJrE/2QmlCYZU7W:PH2nylslwHCCLy

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies system executable filetype association 2 TTPs 5 IoCs
  • Drops file in System32 directory 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5d12265ad38ba929bf154d1f1d7739da75ff67529b029deaec3ebe7c8b40d9c0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\5d12265ad38ba929bf154d1f1d7739da75ff67529b029deaec3ebe7c8b40d9c0_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2172
    • C:\Windows\system\rundll32.exe
      C:\Windows\system\rundll32.exe
      2⤵
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:1276

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\notepad¢¬.exe

    Filesize

    29KB

    MD5

    f5a0d0e143d716bfcbaa27a734adfa56

    SHA1

    bb9cfa3b0c45afc0ee77cff84326622f1f7c4788

    SHA256

    42ead3710dd517fafeafd69479f8339b8ae95a9770b446fb985cdcd1830052cd

    SHA512

    37bda790edff2808f3d261fcb3c5e6400863da09bd4f1b8f3491bc0d3c06a1cd3f670d6d60a5f15b9a404907d6a7064a0c04edaf01f838896e8e67b84e8c4d1c

  • \Windows\system\rundll32.exe

    Filesize

    29KB

    MD5

    e89e611aa4c73a3a6493ad3d56b92e5b

    SHA1

    d6c4c3dc68824b13448a6addc34fa26e4c8f7ff8

    SHA256

    9a6fffab4f6f0805faf76be8de37161d67301af8fd654f0264db70eedb14e8ad

    SHA512

    117457f2c84f72ef59b3923b2da91a348484a27811b512a29c4eb0eeb9be32421502f1ad651451497dffede0e7ed9827b8d99dfda5a8d16cbf4aa5bb7399a04d

  • memory/1276-28-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/1276-27-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/1276-34-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/1276-33-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/1276-21-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/1276-23-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/1276-24-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/1276-25-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/1276-26-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/1276-19-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/1276-32-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/1276-29-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/1276-30-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/1276-31-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/2172-0-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/2172-20-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/2172-18-0x0000000001BB0000-0x0000000001BC5000-memory.dmp

    Filesize

    84KB