Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/06/2024, 11:59

General

  • Target

    5d12265ad38ba929bf154d1f1d7739da75ff67529b029deaec3ebe7c8b40d9c0_NeikiAnalytics.exe

  • Size

    27KB

  • MD5

    c73e8ff083a44af790736524a00926e0

  • SHA1

    4eea58174191d6922b7bb10f7a04b41d8ae00449

  • SHA256

    5d12265ad38ba929bf154d1f1d7739da75ff67529b029deaec3ebe7c8b40d9c0

  • SHA512

    151af59dfcca932664063f5044a37ad9036a5234172f3b2a9dec8a0c74506ef18e3609e78e6eb1ba2e69b791b3bd2d5eb7d9bba2764906ed6dc471b6c6e5204e

  • SSDEEP

    768:PVEHJqjHyGvwFylDpulVSQJrE/2QmlCYZU7W:PH2nylslwHCCLy

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 5 IoCs
  • Drops file in System32 directory 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5d12265ad38ba929bf154d1f1d7739da75ff67529b029deaec3ebe7c8b40d9c0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\5d12265ad38ba929bf154d1f1d7739da75ff67529b029deaec3ebe7c8b40d9c0_NeikiAnalytics.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4152
    • C:\Windows\system\rundll32.exe
      C:\Windows\system\rundll32.exe
      2⤵
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:3148

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\notepad¢¬.exe

    Filesize

    27KB

    MD5

    2413ee08ae8370e666690ecec48ee8dc

    SHA1

    95682fc85d8a2df8d005132446e35aa771e24d75

    SHA256

    4f019fe276761b4cf8fe950be19b5335eb24a9e36349fcf00146fd63a9a9c1ba

    SHA512

    40577bf2618a5c2e65610f5aaa876d559fea1052caff6ba8bba6febadfa84218b1fd7aa57c45c367e2905021ce0ae2776841d9de7299115912a96ce790a0723d

  • C:\Windows\System\rundll32.exe

    Filesize

    30KB

    MD5

    15d39823e6bf841923db9cd1d83f5154

    SHA1

    84168a9e18bc154e1578d889ed8714b7848dbfab

    SHA256

    99ae95b1404964abd4f30a1b42d31a49795b290ea6bd6dd22c447794fa68003f

    SHA512

    674616c832903fe10a14fe48329470d6a1378c216a6c3539dce143cd636b9caae5ca5b2edfdb51f72a9a21496fe26442e4d487ce7eccdd79fd01962a7669f8e8

  • memory/3148-18-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/3148-19-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/3148-14-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/3148-15-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/3148-16-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/3148-17-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/3148-27-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/3148-26-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/3148-20-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/3148-21-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/3148-22-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/3148-23-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/3148-24-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/3148-25-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/4152-13-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/4152-0-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB