Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
28/06/2024, 00:30
Behavioral task
behavioral1
Sample
4c312c136c3d3630e6a7819073151abe2bec245e293fa02c864d455a8c5362f4_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4c312c136c3d3630e6a7819073151abe2bec245e293fa02c864d455a8c5362f4_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
4c312c136c3d3630e6a7819073151abe2bec245e293fa02c864d455a8c5362f4_NeikiAnalytics.exe
-
Size
2.6MB
-
MD5
cd5e3e4dae1c6a68f46963b0feb76770
-
SHA1
d2bac6409ec52448379093ba990f4edde2624eb7
-
SHA256
4c312c136c3d3630e6a7819073151abe2bec245e293fa02c864d455a8c5362f4
-
SHA512
b5c9596501801e896d6a49e8f65d0ecc5a721bfc4e5530d468560a9112c0623175012b7acfe18594fe8d0a647e2b89a9c20380305f14a78f2d824a329cff121e
-
SSDEEP
12288:qCMYGmkOqYYf01bInqzHWI9WFEeapp3TXn8YoWSXLGzEoqAb8/DjUHhsAennZ5/I:qCmIYSbEDJUrTDw6aZWjvFtta8BuOh
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2600 taskmgr.exe 2692 taskmgr.exe 2704 taskmgr.exe -
Loads dropped DLL 7 IoCs
pid Process 1924 4c312c136c3d3630e6a7819073151abe2bec245e293fa02c864d455a8c5362f4_NeikiAnalytics.exe 1924 4c312c136c3d3630e6a7819073151abe2bec245e293fa02c864d455a8c5362f4_NeikiAnalytics.exe 1924 4c312c136c3d3630e6a7819073151abe2bec245e293fa02c864d455a8c5362f4_NeikiAnalytics.exe 1924 4c312c136c3d3630e6a7819073151abe2bec245e293fa02c864d455a8c5362f4_NeikiAnalytics.exe 1924 4c312c136c3d3630e6a7819073151abe2bec245e293fa02c864d455a8c5362f4_NeikiAnalytics.exe 2600 taskmgr.exe 2600 taskmgr.exe -
resource yara_rule behavioral1/memory/1924-0-0x0000000000400000-0x0000000000699000-memory.dmp upx behavioral1/files/0x0007000000014b9e-27.dat upx behavioral1/memory/2704-62-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2704-61-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2600-58-0x0000000000400000-0x0000000000699000-memory.dmp upx behavioral1/memory/2704-57-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2600-44-0x0000000000400000-0x0000000000699000-memory.dmp upx behavioral1/memory/1924-43-0x0000000000400000-0x0000000000699000-memory.dmp upx behavioral1/memory/2704-76-0x0000000000400000-0x0000000000409000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Task Manager = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Task Manager\\taskmgr.exe" reg.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2600 set thread context of 2692 2600 taskmgr.exe 32 PID 2600 set thread context of 2704 2600 taskmgr.exe 33 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2692 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2692 taskmgr.exe Token: SeDebugPrivilege 2692 taskmgr.exe Token: SeDebugPrivilege 2704 taskmgr.exe Token: SeDebugPrivilege 3068 iexplore.exe Token: SeDebugPrivilege 3068 iexplore.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1924 4c312c136c3d3630e6a7819073151abe2bec245e293fa02c864d455a8c5362f4_NeikiAnalytics.exe 2600 taskmgr.exe 2704 taskmgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1924 wrote to memory of 2608 1924 4c312c136c3d3630e6a7819073151abe2bec245e293fa02c864d455a8c5362f4_NeikiAnalytics.exe 28 PID 1924 wrote to memory of 2608 1924 4c312c136c3d3630e6a7819073151abe2bec245e293fa02c864d455a8c5362f4_NeikiAnalytics.exe 28 PID 1924 wrote to memory of 2608 1924 4c312c136c3d3630e6a7819073151abe2bec245e293fa02c864d455a8c5362f4_NeikiAnalytics.exe 28 PID 1924 wrote to memory of 2608 1924 4c312c136c3d3630e6a7819073151abe2bec245e293fa02c864d455a8c5362f4_NeikiAnalytics.exe 28 PID 2608 wrote to memory of 2720 2608 cmd.exe 30 PID 2608 wrote to memory of 2720 2608 cmd.exe 30 PID 2608 wrote to memory of 2720 2608 cmd.exe 30 PID 2608 wrote to memory of 2720 2608 cmd.exe 30 PID 1924 wrote to memory of 2600 1924 4c312c136c3d3630e6a7819073151abe2bec245e293fa02c864d455a8c5362f4_NeikiAnalytics.exe 31 PID 1924 wrote to memory of 2600 1924 4c312c136c3d3630e6a7819073151abe2bec245e293fa02c864d455a8c5362f4_NeikiAnalytics.exe 31 PID 1924 wrote to memory of 2600 1924 4c312c136c3d3630e6a7819073151abe2bec245e293fa02c864d455a8c5362f4_NeikiAnalytics.exe 31 PID 1924 wrote to memory of 2600 1924 4c312c136c3d3630e6a7819073151abe2bec245e293fa02c864d455a8c5362f4_NeikiAnalytics.exe 31 PID 2600 wrote to memory of 2692 2600 taskmgr.exe 32 PID 2600 wrote to memory of 2692 2600 taskmgr.exe 32 PID 2600 wrote to memory of 2692 2600 taskmgr.exe 32 PID 2600 wrote to memory of 2692 2600 taskmgr.exe 32 PID 2600 wrote to memory of 2692 2600 taskmgr.exe 32 PID 2600 wrote to memory of 2692 2600 taskmgr.exe 32 PID 2600 wrote to memory of 2692 2600 taskmgr.exe 32 PID 2600 wrote to memory of 2692 2600 taskmgr.exe 32 PID 2600 wrote to memory of 2692 2600 taskmgr.exe 32 PID 2600 wrote to memory of 2692 2600 taskmgr.exe 32 PID 2600 wrote to memory of 2692 2600 taskmgr.exe 32 PID 2600 wrote to memory of 2692 2600 taskmgr.exe 32 PID 2600 wrote to memory of 2692 2600 taskmgr.exe 32 PID 2600 wrote to memory of 2692 2600 taskmgr.exe 32 PID 2600 wrote to memory of 2704 2600 taskmgr.exe 33 PID 2600 wrote to memory of 2704 2600 taskmgr.exe 33 PID 2600 wrote to memory of 2704 2600 taskmgr.exe 33 PID 2600 wrote to memory of 2704 2600 taskmgr.exe 33 PID 2600 wrote to memory of 2704 2600 taskmgr.exe 33 PID 2600 wrote to memory of 2704 2600 taskmgr.exe 33 PID 2600 wrote to memory of 2704 2600 taskmgr.exe 33 PID 2600 wrote to memory of 2704 2600 taskmgr.exe 33 PID 2600 wrote to memory of 2704 2600 taskmgr.exe 33 PID 2692 wrote to memory of 3068 2692 taskmgr.exe 34 PID 2692 wrote to memory of 3068 2692 taskmgr.exe 34 PID 2692 wrote to memory of 3068 2692 taskmgr.exe 34 PID 2692 wrote to memory of 3068 2692 taskmgr.exe 34 PID 2692 wrote to memory of 3068 2692 taskmgr.exe 34 PID 2692 wrote to memory of 3068 2692 taskmgr.exe 34 PID 2692 wrote to memory of 3068 2692 taskmgr.exe 34 PID 2692 wrote to memory of 3068 2692 taskmgr.exe 34 PID 2692 wrote to memory of 3068 2692 taskmgr.exe 34 PID 2692 wrote to memory of 3068 2692 taskmgr.exe 34 PID 2692 wrote to memory of 3068 2692 taskmgr.exe 34 PID 2692 wrote to memory of 3068 2692 taskmgr.exe 34 PID 2692 wrote to memory of 3068 2692 taskmgr.exe 34 PID 2692 wrote to memory of 3068 2692 taskmgr.exe 34 PID 2692 wrote to memory of 3068 2692 taskmgr.exe 34 PID 2692 wrote to memory of 3068 2692 taskmgr.exe 34 PID 2692 wrote to memory of 3068 2692 taskmgr.exe 34 PID 2692 wrote to memory of 3068 2692 taskmgr.exe 34 PID 2692 wrote to memory of 3068 2692 taskmgr.exe 34 PID 2692 wrote to memory of 3068 2692 taskmgr.exe 34 PID 2692 wrote to memory of 3068 2692 taskmgr.exe 34 PID 2692 wrote to memory of 3068 2692 taskmgr.exe 34 PID 2692 wrote to memory of 3068 2692 taskmgr.exe 34 PID 2692 wrote to memory of 3068 2692 taskmgr.exe 34 PID 2692 wrote to memory of 3068 2692 taskmgr.exe 34 PID 2692 wrote to memory of 3068 2692 taskmgr.exe 34 PID 2692 wrote to memory of 3068 2692 taskmgr.exe 34 PID 2692 wrote to memory of 3068 2692 taskmgr.exe 34 PID 2692 wrote to memory of 3068 2692 taskmgr.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c312c136c3d3630e6a7819073151abe2bec245e293fa02c864d455a8c5362f4_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4c312c136c3d3630e6a7819073151abe2bec245e293fa02c864d455a8c5362f4_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\sQuAx.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Task Manager" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Task Manager\taskmgr.exe" /f3⤵
- Adds Run key to start application
PID:2720
-
-
-
C:\Users\Admin\AppData\Roaming\Windows Task Manager\taskmgr.exe"C:\Users\Admin\AppData\Roaming\Windows Task Manager\taskmgr.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Roaming\Windows Task Manager\taskmgr.exe"C:\Users\Admin\AppData\Roaming\Windows Task Manager\taskmgr.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Roaming\Windows Task Manager\taskmgr.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3068
-
-
-
C:\Users\Admin\AppData\Roaming\Windows Task Manager\taskmgr.exe"C:\Users\Admin\AppData\Roaming\Windows Task Manager\taskmgr.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2704
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
170B
MD5e612e66a93150f09e419dc23aa6ad30b
SHA1aac69550ea153ff1b4550261675221c144b2da54
SHA256c505222bbd299a60df2b8c9049866bc49e355f117a12f55fb1f5406d882f14ce
SHA51251b236bc6b7c02a7babf61a1918a8f554f3d69762051943c8f712a68a7c1494e0a979efd6ebe49f1b4daae47d0e4c12652dcb16ac3e500565ba2dcbd16764e9f
-
Filesize
2.6MB
MD5595876b449f8cf940e16806c21d6ed5d
SHA1506308b49404462435890ab302f627c4717d0dfb
SHA256aa45311bf4b3d01138ac077175a47e261088182bba0eabbca07a8ae2363276f3
SHA51285a9fd522b96a0ff1cea84f561a263ec9b3595cdcbaa1cabdc22805ef7ae6b072fbcd44c0d9a1e018c10c98ccc0f39daeb1723e609c1dca8118b7428d0aa5345