Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
28/06/2024, 03:55
General
-
Target
7a75b1cc92be07d39bb5ac9464f8937151297eca335a43b00049331662c67bcf_NeikiAnalytics.exe
-
Size
60KB
-
MD5
13f9a0a94e67d51f5cb576ecd70a3330
-
SHA1
d01e658c4ce97b89d71f95aeb56ba9e7a7a44a75
-
SHA256
7a75b1cc92be07d39bb5ac9464f8937151297eca335a43b00049331662c67bcf
-
SHA512
1a7e8996badebf786d1ae839daafc94746de8ad1fc0ac7f70ea90535d8b6de4cbac1ef133b33b82edf1f58f6dd1133f90bb8f4cc8ea6cbb16a10304c68134bbe
-
SSDEEP
384:vbLwOs8AHsc4sMfwhKQLrod4/CFsrdHWMZo:vvw9816vhKQLrod4/wQpWMZo
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a75b1cc92be07d39bb5ac9464f8937151297eca335a43b00049331662c67bcf_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7a75b1cc92be07d39bb5ac9464f8937151297eca335a43b00049331662c67bcf_NeikiAnalytics.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2EC891AB-D0F2-4ecb-A909-5AF79FFBE723}.exeC:\Windows\{2EC891AB-D0F2-4ecb-A909-5AF79FFBE723}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{61717503-22B4-4745-9B85-DF31000DF3DB}.exeC:\Windows\{61717503-22B4-4745-9B85-DF31000DF3DB}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{951441A9-4806-496f-AD6D-72AAC3883898}.exeC:\Windows\{951441A9-4806-496f-AD6D-72AAC3883898}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DBD494BD-7CFD-4f3d-8F3E-9D6FEEAB8093}.exeC:\Windows\{DBD494BD-7CFD-4f3d-8F3E-9D6FEEAB8093}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D03A3F73-38EF-4eec-B665-979E5066669A}.exeC:\Windows\{D03A3F73-38EF-4eec-B665-979E5066669A}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2E5D46EC-5E29-44e6-AB1F-F2543332C35E}.exeC:\Windows\{2E5D46EC-5E29-44e6-AB1F-F2543332C35E}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2518A077-B4BB-437c-9B70-0CD092A178DF}.exeC:\Windows\{2518A077-B4BB-437c-9B70-0CD092A178DF}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4B074888-C716-4881-8FE6-9921723B23CE}.exeC:\Windows\{4B074888-C716-4881-8FE6-9921723B23CE}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A134DE76-36E4-4398-91B0-AE78BCC13268}.exeC:\Windows\{A134DE76-36E4-4398-91B0-AE78BCC13268}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{57BCC0CA-36B1-45ea-A760-4BC17484D7F4}.exeC:\Windows\{57BCC0CA-36B1-45ea-A760-4BC17484D7F4}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CAAA724A-130D-4250-8FE5-1D5A61F2C3E1}.exeC:\Windows\{CAAA724A-130D-4250-8FE5-1D5A61F2C3E1}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{F2B22915-56F4-4cc7-8E00-5A3BF84C532A}.exeC:\Windows\{F2B22915-56F4-4cc7-8E00-5A3BF84C532A}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CAAA7~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{57BCC~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A134D~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4B074~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2518A~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2E5D4~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D03A3~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DBD49~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{95144~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{61717~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2EC89~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\7A75B1~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD5e8e01dddaa04dad4602b5f8fc97442f3
SHA119c8c37c2f1bb09e037cf9245a53a9e2d9b81f44
SHA2568ff2f0785ed180959043192fa181dec87fbb463244c653a16fa98a479b0d677b
SHA5129b47fab472bae9c08874625293ce1bd7ab6ef3a082ae2be0150ddcdf81bbc07fb3f2cbee651d2bba7063c0ca79af9561e573d94347df284552eb71f92e848f30
-
Filesize
60KB
MD51b363137230eddd96d2e7f5896a1c149
SHA17e823b4f5c789665b9f0bc64ca10bada69dfb643
SHA2566423173e888e72bc42214d15fce0d13958f0776e9b922a0df8435f13efe35336
SHA512e4a002a33ff06227e43cdfb0290b1ada791a14ba3c028b32f50e21ea3422278d5906823772c714d47996fc5435aa0f5ee032342d96fa2f039c8c91f43c51dc76
-
Filesize
60KB
MD56e78fce7c1cd1578e47e4d1c574913f6
SHA197d6db6a7820ec7001975aa3e038196ff045c818
SHA256eb6d93cec7f0cfb6c6eb8124dc7b1ffbed70c1f9669aab069cd06c5ec1deebd4
SHA512a2dd41b6ce0f174b4665125bc833b7afa49514b2490554efcd71b0118bc9e7d90dc423e6754788ae34c2d668a5568cd17acd9618be9e3071ba2c683753f55745
-
Filesize
60KB
MD54c1a1e75e93f5fea67252f9b9e655a54
SHA1e9aecb493ae328ae7db8337a0b545e23bb383be5
SHA256383b5e414356be4eb72aa138a72d57c8beeccf93c731c2b8ac4097d4a6566f70
SHA512fa3d8ed3e459217d6bc7ab459edfbb713490e02b4b31a66e04b6ecb2e1657e5b92f3a58c68eb898a559c9b7fb69a8f648dfaca9c8f5136bbd9893fceab768990
-
Filesize
60KB
MD5f11c9adc673e875b733a3869f7dc1b4f
SHA15406f2c63533fd9676d1b1791311911edb45c52f
SHA2562627c38a4e4c55be41278b10b807fb1a9908c88109a69060a360deb47cf6aab4
SHA5121042bbeaad98db8f645f569ae0419e75609e2e3f8e60f119969a30a0435767888fb419d0d16f3d381626c87630bf211b2dce4bcbcab87988d0eb08e086915ce5
-
Filesize
60KB
MD5fb64fc8823963b184152852da8c14431
SHA134d7bab9d56610a92677cbf06e39486e004320e7
SHA2560dcdfbec87e7518cf875259c6007b61ade4f8ced4dcd600cd58e20a8d3950276
SHA51204052bf3cd5fd09b50e8521afdf461fb88748de908a552ffc0dc53f974a16848ad89fcdef34cfdf2f6e9fdea8bd6491d499c5600f5468cc86a5173c56def1dfa
-
Filesize
60KB
MD56df1a0055bc3f551cb4f1e07ff56ae83
SHA1031a89cecc6fc3449d0669a5fb6948961473d836
SHA2567f1382e01c4192225149f640f803c4efeb8dd4056efe1d9722546cd2018a66c3
SHA5126f4a104f23bda2f1965816ab2b9724a5daecf4b8f966fbd7fc9c59996067fe9048364074cacbe13af601f37c198a5643833ab9c03720711b404d1b0f074fa205
-
Filesize
60KB
MD5a332193f52b9104f9b8548cfeb5091be
SHA117ccd49fed5d0dc923c5415300a3ba55a9429518
SHA256dff0087f911c7890182fdb099a8f60a74355619eacfb77ee54e3dca0f2ab9233
SHA51278b8d9c54a53ea5374b243efb2d67af675376087b1970ac23829f69daca5524c0f13062ebf1028a7ef2e70369ed7c83f05517ac66f48a3735d47fa324d733d2c
-
Filesize
60KB
MD507126ee88d890b9ab4996563349899f9
SHA1a083e2f398bf2311772e5233d2bb62ea8c82ce9c
SHA25668cd9341ce5f8733c261d44c44fb84c097400113efdf73e32d70643a7ca6c00e
SHA512ce725aa67c7e08aa00eb9b436dd659666c7f2a873a7973efa317a1b68162662e9547f2b6fd872057ad1d20b9255dd6a67a74c07bdb148073cda83846d5efb298
-
Filesize
60KB
MD588c7c23f2f3accd3846a63ccd864c9f5
SHA1d9fec62375eca8f6deab766aee94ceb45ad8914f
SHA25688b6a8f02582af006f6bd030a2524203ed3e2bb18b0eeca7619e6649c1a7077b
SHA51283a6612ca304f0d6646f0b4f5b3991332046cd9d00b5e4bdda80c0ed9c6c19530e375aad7e42fa677d2294735a2bac0bef45387912f9fb5431b9f82a886eb3c3
-
Filesize
60KB
MD5b3e86e391cf5b0a1cdfe4e7458996fe2
SHA1af4e900b7a238b291960ca528ae1a1f3100c123a
SHA25681dd191f49e2f60da1f667f44ad5d03b853e44193c77b3de6e62c6eb6a3b0fa9
SHA5128ac07ccde39d786971588ccffc67c56f4ee224652a1b2aa4182ae16de6e89f3805583eed5e5d2ae2ac41f7a4c711a8fa43531d4fe1cf6b17f4040bc78ca1bd39
-
Filesize
60KB
MD5b1e0a6a88b5201e813fc2a24486ddee6
SHA122990d08e63eadb404036dee999cd663ab4992af
SHA256f42cd933fae2588fec6c0e31feca411857b2e970a39dda5c8bd0b1e921889e21
SHA512588fda12c7883ff101d2173d050d5dc94153ca8c022926cf720b211d630a6b75dcf7d44ee9d9a9652575dd8a02cdec6075971ed907105fc4ea5f27777ed175ba