Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
29/06/2024, 13:31
General
-
Target
ad827a5cf1127f1cfb3af8ba55cc4de570404ee0a81edb74789788761c5e1f81_NeikiAnalytics.exe
-
Size
3.1MB
-
MD5
559392040209af04b36cb0c79cbaed20
-
SHA1
74ba5cc83f04f1752ae1068310d5a00a99e43741
-
SHA256
ad827a5cf1127f1cfb3af8ba55cc4de570404ee0a81edb74789788761c5e1f81
-
SHA512
a29fb8e075bbe03e390a85172245fa356c5a9f4228e28357d4af98756c5ab419a80e6f437aac33ff33c4d99416ad8cf2161dd4bd90dd18ed3e37c15c0034dc62
-
SSDEEP
49152:ZUuBTOjZwS1Ihk+hy7iHuaRZnt+NTNLiG97d:ZXRO0hkr2Rxt+eE
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 4 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
UAC bypass 3 TTPs 9 IoCs
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks whether UAC is enabled 1 TTPs 6 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
-
System policy modification 1 TTPs 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad827a5cf1127f1cfb3af8ba55cc4de570404ee0a81edb74789788761c5e1f81_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ad827a5cf1127f1cfb3af8ba55cc4de570404ee0a81edb74789788761c5e1f81_NeikiAnalytics.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
\??\c:\windows\wininit.exec:\windows\wininit.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
\??\c:\users\admin\appdata\local\svchost.exec:\users\admin\appdata\local\svchost.exe2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- System policy modification
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD5cfa8e4c2a8be38cd7eb3f12344ed771f
SHA113bef75ca1f550db86820d31f4ff234108b75b3c
SHA256f98c9a40b559438b3eb63c750d8f345d88233dfec6a399928a66a20adf9d8e09
SHA5127349bec73c36821193bdf38fe3fa5c5ca8933a78ea8440816594af74f0c39638e905e6da327e08e4a29a53d0f437d645d9316f1c418dde01bd166a38ef5cc1ef
-
Filesize
3.1MB
MD5559392040209af04b36cb0c79cbaed20
SHA174ba5cc83f04f1752ae1068310d5a00a99e43741
SHA256ad827a5cf1127f1cfb3af8ba55cc4de570404ee0a81edb74789788761c5e1f81
SHA512a29fb8e075bbe03e390a85172245fa356c5a9f4228e28357d4af98756c5ab419a80e6f437aac33ff33c4d99416ad8cf2161dd4bd90dd18ed3e37c15c0034dc62
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
4KB
-
Filesize
3.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB