Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07/05/2024, 21:22
Static task
static1
Behavioral task
behavioral1
Sample
39ce1a9e6ea14eef61f4785fa5725b10_NEIKI.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
39ce1a9e6ea14eef61f4785fa5725b10_NEIKI.exe
Resource
win10v2004-20240419-en
General
-
Target
39ce1a9e6ea14eef61f4785fa5725b10_NEIKI.exe
-
Size
4.1MB
-
MD5
39ce1a9e6ea14eef61f4785fa5725b10
-
SHA1
8168d378ab9761de383659128816892e1ab0fc26
-
SHA256
f5030a7c68a0d63ba7c6aebf321466c9705e64bfb615235bbf56f778220c3ea2
-
SHA512
a45388c2fae2b88f52beba7dd49dd888a11b07037617297364335c93e60152044a77daee903003f7fada626210e747e6d8309fe5045eef556a901503e1c85595
-
SSDEEP
98304:+R0pI/IQlUoMPdmpSpG4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdm95n9klRKN41v
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3476 devdobec.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesDD\\devdobec.exe" 39ce1a9e6ea14eef61f4785fa5725b10_NEIKI.exe Set value (str) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\VidCJ\\dobaloc.exe" 39ce1a9e6ea14eef61f4785fa5725b10_NEIKI.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3088 39ce1a9e6ea14eef61f4785fa5725b10_NEIKI.exe 3088 39ce1a9e6ea14eef61f4785fa5725b10_NEIKI.exe 3088 39ce1a9e6ea14eef61f4785fa5725b10_NEIKI.exe 3088 39ce1a9e6ea14eef61f4785fa5725b10_NEIKI.exe 3476 devdobec.exe 3476 devdobec.exe 3088 39ce1a9e6ea14eef61f4785fa5725b10_NEIKI.exe 3088 39ce1a9e6ea14eef61f4785fa5725b10_NEIKI.exe 3476 devdobec.exe 3476 devdobec.exe 3088 39ce1a9e6ea14eef61f4785fa5725b10_NEIKI.exe 3088 39ce1a9e6ea14eef61f4785fa5725b10_NEIKI.exe 3476 devdobec.exe 3476 devdobec.exe 3088 39ce1a9e6ea14eef61f4785fa5725b10_NEIKI.exe 3088 39ce1a9e6ea14eef61f4785fa5725b10_NEIKI.exe 3476 devdobec.exe 3476 devdobec.exe 3088 39ce1a9e6ea14eef61f4785fa5725b10_NEIKI.exe 3088 39ce1a9e6ea14eef61f4785fa5725b10_NEIKI.exe 3476 devdobec.exe 3476 devdobec.exe 3088 39ce1a9e6ea14eef61f4785fa5725b10_NEIKI.exe 3088 39ce1a9e6ea14eef61f4785fa5725b10_NEIKI.exe 3476 devdobec.exe 3476 devdobec.exe 3088 39ce1a9e6ea14eef61f4785fa5725b10_NEIKI.exe 3088 39ce1a9e6ea14eef61f4785fa5725b10_NEIKI.exe 3476 devdobec.exe 3476 devdobec.exe 3088 39ce1a9e6ea14eef61f4785fa5725b10_NEIKI.exe 3088 39ce1a9e6ea14eef61f4785fa5725b10_NEIKI.exe 3476 devdobec.exe 3476 devdobec.exe 3088 39ce1a9e6ea14eef61f4785fa5725b10_NEIKI.exe 3088 39ce1a9e6ea14eef61f4785fa5725b10_NEIKI.exe 3476 devdobec.exe 3476 devdobec.exe 3088 39ce1a9e6ea14eef61f4785fa5725b10_NEIKI.exe 3088 39ce1a9e6ea14eef61f4785fa5725b10_NEIKI.exe 3476 devdobec.exe 3476 devdobec.exe 3088 39ce1a9e6ea14eef61f4785fa5725b10_NEIKI.exe 3088 39ce1a9e6ea14eef61f4785fa5725b10_NEIKI.exe 3476 devdobec.exe 3476 devdobec.exe 3088 39ce1a9e6ea14eef61f4785fa5725b10_NEIKI.exe 3088 39ce1a9e6ea14eef61f4785fa5725b10_NEIKI.exe 3476 devdobec.exe 3476 devdobec.exe 3088 39ce1a9e6ea14eef61f4785fa5725b10_NEIKI.exe 3088 39ce1a9e6ea14eef61f4785fa5725b10_NEIKI.exe 3476 devdobec.exe 3476 devdobec.exe 3088 39ce1a9e6ea14eef61f4785fa5725b10_NEIKI.exe 3088 39ce1a9e6ea14eef61f4785fa5725b10_NEIKI.exe 3476 devdobec.exe 3476 devdobec.exe 3088 39ce1a9e6ea14eef61f4785fa5725b10_NEIKI.exe 3088 39ce1a9e6ea14eef61f4785fa5725b10_NEIKI.exe 3476 devdobec.exe 3476 devdobec.exe 3088 39ce1a9e6ea14eef61f4785fa5725b10_NEIKI.exe 3088 39ce1a9e6ea14eef61f4785fa5725b10_NEIKI.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3088 wrote to memory of 3476 3088 39ce1a9e6ea14eef61f4785fa5725b10_NEIKI.exe 90 PID 3088 wrote to memory of 3476 3088 39ce1a9e6ea14eef61f4785fa5725b10_NEIKI.exe 90 PID 3088 wrote to memory of 3476 3088 39ce1a9e6ea14eef61f4785fa5725b10_NEIKI.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\39ce1a9e6ea14eef61f4785fa5725b10_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\39ce1a9e6ea14eef61f4785fa5725b10_NEIKI.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\FilesDD\devdobec.exeC:\FilesDD\devdobec.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3476
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.1MB
MD5c0fd33c1adef1fde7eaf1f0bfba17005
SHA1c57af43e9b27cb1e5da7a2cfd6b4d383ad4b8c31
SHA256090986937a00d97cd876a63b9777b61f99ffe7ccb09805ad27130fd0069d8ca6
SHA512cd6d8901ac934078a687f6dfee134d1f15732242f2bae801e56a5face19cc17856b82de2b8166c3cb1d0066f18a398b2eafd29f72c2a9c9bc52aa7b5d75b12c3
-
Filesize
200B
MD581b80853529ae5faa97d810f6a41078d
SHA1aa374f19a02d83aa25af4e9d13429d2728c7afe0
SHA25687b2745ed9a239992373fd7cbec179324cf40747f12898afb92f63633fa670b0
SHA5128ec5207e45dd40435532035e8542e71d126716f245406bac94c6771029568e03d2a62aad1741a100201aa0d00c857bb22a18f94c505b68c9bdfbc0cc742e3762
-
Filesize
21KB
MD588c4193a34bc33ed642c08b873d8f01d
SHA109090721da01bb4de69a935354eb91e434b18f1b
SHA256885ae505ce1d9fe457313dec50b16b13a0467d754c98013814cc7e643b27ce0e
SHA512bd78e8ee2067c7a441769636d628685fd84921ccd58e82b05257dd862af095dba0fbe9642b38d161c7bad148f749c65592c682bad75a7ad362ae9514d2c6dc50
-
Filesize
4.1MB
MD5d2f6cb00c31fe4a4d0f8601cd7baa934
SHA17044304543e1fed3c39cd417bccd0d21e2bb2b36
SHA2567fa712f313df1ac035d7daa45450b50138b5fd23f5c5b1320deb8beaf83559cf
SHA512f6d353d8d7a4ce9dc8eeab04a06737fe6c74538d2e04001bb8801357bee273f9e0dbe676deb4c8d86d0ac2b4c09225203fdc14db2f9af02b2b554cb30debcb68