Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/06/2024, 10:08
Static task
static1
Behavioral task
behavioral1
Sample
92953f88008d5dba6ddc488903522212efb3b97d14e95b7062538ea6298bd84a_NeikiAnalytics.dll
Resource
win7-20240221-en
General
-
Target
92953f88008d5dba6ddc488903522212efb3b97d14e95b7062538ea6298bd84a_NeikiAnalytics.dll
-
Size
120KB
-
MD5
36efb59d07bcd658a01e45ea2f13de50
-
SHA1
cb6cc928367c379430655f36d72f9402f3699d83
-
SHA256
92953f88008d5dba6ddc488903522212efb3b97d14e95b7062538ea6298bd84a
-
SHA512
8d1fd9d20c3f2fef6e7e7c71045eeb2d83f4af55d64ca894cf36d494ccc04205c83fb30a3952361099f696679521a4d15ad96008eea099c53e56065d7c0a4465
-
SSDEEP
3072:7rsg5tYdlv66AEOT1DBg/wGDtYVIHQPmKw0:cg5Wly6AEORDBJGDtYV
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f763faf.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f763faf.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f763faf.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f762433.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f762433.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f762433.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f762433.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f763faf.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f762433.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f762433.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f762433.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f762433.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f763faf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f763faf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f762433.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f762433.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f763faf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f763faf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f763faf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f763faf.exe -
Executes dropped EXE 3 IoCs
pid Process 2420 f762433.exe 2580 f762636.exe 1820 f763faf.exe -
Loads dropped DLL 6 IoCs
pid Process 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe -
resource yara_rule behavioral1/memory/2420-15-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2420-11-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2420-19-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2420-16-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2420-14-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2420-13-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2420-21-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2420-20-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2420-18-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2420-17-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2420-56-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2420-57-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2420-63-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2420-64-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2420-65-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2420-67-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2420-68-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2420-81-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2420-82-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2420-85-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2420-86-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2420-102-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2420-153-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/1820-165-0x0000000000910000-0x00000000019CA000-memory.dmp upx behavioral1/memory/1820-206-0x0000000000910000-0x00000000019CA000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f763faf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f762433.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f763faf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f763faf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f762433.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f762433.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f763faf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f762433.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f762433.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f762433.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f763faf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f762433.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f763faf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f763faf.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f762433.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f763faf.exe -
Enumerates connected drives 3 TTPs 16 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: f762433.exe File opened (read-only) \??\E: f763faf.exe File opened (read-only) \??\I: f762433.exe File opened (read-only) \??\N: f762433.exe File opened (read-only) \??\Q: f762433.exe File opened (read-only) \??\H: f762433.exe File opened (read-only) \??\L: f762433.exe File opened (read-only) \??\T: f762433.exe File opened (read-only) \??\K: f762433.exe File opened (read-only) \??\M: f762433.exe File opened (read-only) \??\O: f762433.exe File opened (read-only) \??\P: f762433.exe File opened (read-only) \??\S: f762433.exe File opened (read-only) \??\E: f762433.exe File opened (read-only) \??\G: f762433.exe File opened (read-only) \??\J: f762433.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f76759d f763faf.exe File created C:\Windows\f7624a0 f762433.exe File opened for modification C:\Windows\SYSTEM.INI f762433.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2420 f762433.exe 2420 f762433.exe 1820 f763faf.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 2420 f762433.exe Token: SeDebugPrivilege 2420 f762433.exe Token: SeDebugPrivilege 2420 f762433.exe Token: SeDebugPrivilege 2420 f762433.exe Token: SeDebugPrivilege 2420 f762433.exe Token: SeDebugPrivilege 2420 f762433.exe Token: SeDebugPrivilege 2420 f762433.exe Token: SeDebugPrivilege 2420 f762433.exe Token: SeDebugPrivilege 2420 f762433.exe Token: SeDebugPrivilege 2420 f762433.exe Token: SeDebugPrivilege 2420 f762433.exe Token: SeDebugPrivilege 2420 f762433.exe Token: SeDebugPrivilege 2420 f762433.exe Token: SeDebugPrivilege 2420 f762433.exe Token: SeDebugPrivilege 2420 f762433.exe Token: SeDebugPrivilege 2420 f762433.exe Token: SeDebugPrivilege 2420 f762433.exe Token: SeDebugPrivilege 2420 f762433.exe Token: SeDebugPrivilege 2420 f762433.exe Token: SeDebugPrivilege 2420 f762433.exe Token: SeDebugPrivilege 2420 f762433.exe Token: SeDebugPrivilege 1820 f763faf.exe Token: SeDebugPrivilege 1820 f763faf.exe Token: SeDebugPrivilege 1820 f763faf.exe Token: SeDebugPrivilege 1820 f763faf.exe Token: SeDebugPrivilege 1820 f763faf.exe Token: SeDebugPrivilege 1820 f763faf.exe Token: SeDebugPrivilege 1820 f763faf.exe Token: SeDebugPrivilege 1820 f763faf.exe Token: SeDebugPrivilege 1820 f763faf.exe Token: SeDebugPrivilege 1820 f763faf.exe Token: SeDebugPrivilege 1820 f763faf.exe Token: SeDebugPrivilege 1820 f763faf.exe Token: SeDebugPrivilege 1820 f763faf.exe Token: SeDebugPrivilege 1820 f763faf.exe Token: SeDebugPrivilege 1820 f763faf.exe Token: SeDebugPrivilege 1820 f763faf.exe Token: SeDebugPrivilege 1820 f763faf.exe Token: SeDebugPrivilege 1820 f763faf.exe Token: SeDebugPrivilege 1820 f763faf.exe Token: SeDebugPrivilege 1820 f763faf.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 1460 wrote to memory of 2412 1460 rundll32.exe 28 PID 1460 wrote to memory of 2412 1460 rundll32.exe 28 PID 1460 wrote to memory of 2412 1460 rundll32.exe 28 PID 1460 wrote to memory of 2412 1460 rundll32.exe 28 PID 1460 wrote to memory of 2412 1460 rundll32.exe 28 PID 1460 wrote to memory of 2412 1460 rundll32.exe 28 PID 1460 wrote to memory of 2412 1460 rundll32.exe 28 PID 2412 wrote to memory of 2420 2412 rundll32.exe 29 PID 2412 wrote to memory of 2420 2412 rundll32.exe 29 PID 2412 wrote to memory of 2420 2412 rundll32.exe 29 PID 2412 wrote to memory of 2420 2412 rundll32.exe 29 PID 2420 wrote to memory of 1124 2420 f762433.exe 19 PID 2420 wrote to memory of 1184 2420 f762433.exe 20 PID 2420 wrote to memory of 1212 2420 f762433.exe 21 PID 2420 wrote to memory of 1348 2420 f762433.exe 23 PID 2420 wrote to memory of 1460 2420 f762433.exe 27 PID 2420 wrote to memory of 2412 2420 f762433.exe 28 PID 2420 wrote to memory of 2412 2420 f762433.exe 28 PID 2412 wrote to memory of 2580 2412 rundll32.exe 30 PID 2412 wrote to memory of 2580 2412 rundll32.exe 30 PID 2412 wrote to memory of 2580 2412 rundll32.exe 30 PID 2412 wrote to memory of 2580 2412 rundll32.exe 30 PID 2412 wrote to memory of 1820 2412 rundll32.exe 31 PID 2412 wrote to memory of 1820 2412 rundll32.exe 31 PID 2412 wrote to memory of 1820 2412 rundll32.exe 31 PID 2412 wrote to memory of 1820 2412 rundll32.exe 31 PID 2420 wrote to memory of 1124 2420 f762433.exe 19 PID 2420 wrote to memory of 1184 2420 f762433.exe 20 PID 2420 wrote to memory of 1212 2420 f762433.exe 21 PID 2420 wrote to memory of 2580 2420 f762433.exe 30 PID 2420 wrote to memory of 2580 2420 f762433.exe 30 PID 2420 wrote to memory of 1820 2420 f762433.exe 31 PID 2420 wrote to memory of 1820 2420 f762433.exe 31 PID 1820 wrote to memory of 1124 1820 f763faf.exe 19 PID 1820 wrote to memory of 1184 1820 f763faf.exe 20 PID 1820 wrote to memory of 1212 1820 f763faf.exe 21 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f762433.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f763faf.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1124
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1184
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1212
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\92953f88008d5dba6ddc488903522212efb3b97d14e95b7062538ea6298bd84a_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\92953f88008d5dba6ddc488903522212efb3b97d14e95b7062538ea6298bd84a_NeikiAnalytics.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\f762433.exeC:\Users\Admin\AppData\Local\Temp\f762433.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2420
-
-
C:\Users\Admin\AppData\Local\Temp\f762636.exeC:\Users\Admin\AppData\Local\Temp\f762636.exe4⤵
- Executes dropped EXE
PID:2580
-
-
C:\Users\Admin\AppData\Local\Temp\f763faf.exeC:\Users\Admin\AppData\Local\Temp\f763faf.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1820
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1348
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD582752003f549353491fdc7bce8abf94d
SHA11349755ad9af8609ad13a9110c2dda543cb12f03
SHA256b6c045b4553241cac104866a42479c5ad117430a19a4f31c86e4018aeb64d608
SHA5128c4b6ebde439f1a81d7083eca3772b3c33eaf33cab55f1e6a69571d0f1ee7e3720a8fda5a0e8993acdcfcddffb09eec9ea5891f4a9579a3dc830024588f486fe
-
Filesize
97KB
MD55defac9f9654016876c3bd48782d8e73
SHA1b15669b9d4c04279b648254f4e2ba99ac6038976
SHA256d52f9a3ab17c8d40bc2e46d217a0eff134fd7efce6aa9258ef79885ea40baa6a
SHA5120592cc977965f1ea4a0dcff339585cbb9b2f72d94c8bcd42c1115874c774564473179090145f117eed440d51c5c9191b3b081eb18223b99b5834c7ad0add284b