Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

0f1a32d075...KI.exe

windows7-x64

7

0f1a32d075...KI.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    108s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/05/2024, 19:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0f1a32d075a96c284587335f18c2c7e0_NEIKI.exe

  • Size

    2.7MB

  • MD5

    0f1a32d075a96c284587335f18c2c7e0

  • SHA1

    335d02beebd788397e1f4f7acae2820e2577c723

  • SHA256

    242dadc4e334c183859a0bea67d55e9eb1965dd40e2c9850b596697961872479

  • SHA512

    293ea8d3991e617907d338052568add2aca096b91903d32a649fa9da8368f569bf168459b14aaf561b96c900fb4faffa48ddc05f299fcd5bf080a12ca0be64d0

  • SSDEEP

    49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBf9w4Sx:+R0pI/IQlUoMPdmpSpf4

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0f1a32d075a96c284587335f18c2c7e0_NEIKI.exe
    "C:\Users\Admin\AppData\Local\Temp\0f1a32d075a96c284587335f18c2c7e0_NEIKI.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2748
    • C:\IntelprocWZ\devbodloc.exe
      C:\IntelprocWZ\devbodloc.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:4380

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\IntelprocWZ\devbodloc.exe
    Filesize

    2.7MB

    MD5

    f2120e6e0243431adbeba12c2aa77b0d

    SHA1

    ae97fbdeeffcbe5c493a9274c3e6ffb8838c735e

    SHA256

    cbb1058657e0ad26582fd38e4ae9fbb8b48f231f006bf5412ec04f4ba1345476

    SHA512

    e711dc46f34e2f72c575992c39b991fe5a90fb92d182cec47181484afbd85bf444c13e719076cbdbe6e842efb6cc3a17ab6b8656bcb0c49b7ecf32313c716fe1

    Download Submit

  • C:\Users\Admin\253086396416_10.0_Admin.ini
    Filesize

    205B

    MD5

    e5fe97c6529e171fd925e69e1d450525

    SHA1

    d99b3e3a131d95c80158debd222f6b23f3025103

    SHA256

    802a9b88da1dea8d042f0ceb995c65ad3ba73ded847b4c62799d3989c4caf8c4

    SHA512

    724fd9787431ef45d4d412a5fbf61a672eb0b065819d9ff1403eed76064bd4e59eb7ba9a7c44354d947cceec851ebe51f9ba418738fdb871b4c9ae996892bca8

    Download Submit

  • C:\Vid1Y\dobxloc.exe
    Filesize

    31KB

    MD5

    76f2392f4644d3df0bea775361ad02f1

    SHA1

    1e6d7c0ff116b955490e05cadbb381bbe14c0783

    SHA256

    2e56ad0b152fc024bdcfb0dbcdabce493d8edfb04d7a6bd1ba0af5abcdcbc66b

    SHA512

    1e915195b94382c2102259a0432beac01f7b84a506340390921051ea5a550ac40f6c9b3ef4a203982b56c7b8cb0cfdfc019a8bc71d9b80b170b09558182e050b

    Download Submit