Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07/05/2024, 20:49
Static task
static1
Behavioral task
behavioral1
Sample
2d69aa1a205225f27dda27e59c0f1890_NEIKI.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2d69aa1a205225f27dda27e59c0f1890_NEIKI.exe
Resource
win10v2004-20240419-en
General
-
Target
2d69aa1a205225f27dda27e59c0f1890_NEIKI.exe
-
Size
717KB
-
MD5
2d69aa1a205225f27dda27e59c0f1890
-
SHA1
3a3755dbd71428a0b094ab4ccef9a87365180e29
-
SHA256
0c4fd187f1ed90125c70e5d39664900d84c3dfe85e3401c8282f8b51ff19d3d1
-
SHA512
3af2086e3b80a5cd9039e005a104ff6dd0e37560cc599204003006e1092d5b14ccaf8d6148f09fe9b38381e1ec97d6525f78b94aebf01f320c71fdb599e0f7dd
-
SSDEEP
12288:2pR3MqWOKw7yWMJFLubMNfntcanU+SH7:iR84fmX8ItHnXI
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation 2d69aa1a205225f27dda27e59c0f1890_NEIKI.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation ~DFA255.tmp -
Executes dropped EXE 3 IoCs
pid Process 4368 niymioq.exe 4608 ~DFA255.tmp 2704 kufidoq.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 2704 kufidoq.exe 2704 kufidoq.exe 2704 kufidoq.exe 2704 kufidoq.exe 2704 kufidoq.exe 2704 kufidoq.exe 2704 kufidoq.exe 2704 kufidoq.exe 2704 kufidoq.exe 2704 kufidoq.exe 2704 kufidoq.exe 2704 kufidoq.exe 2704 kufidoq.exe 2704 kufidoq.exe 2704 kufidoq.exe 2704 kufidoq.exe 2704 kufidoq.exe 2704 kufidoq.exe 2704 kufidoq.exe 2704 kufidoq.exe 2704 kufidoq.exe 2704 kufidoq.exe 2704 kufidoq.exe 2704 kufidoq.exe 2704 kufidoq.exe 2704 kufidoq.exe 2704 kufidoq.exe 2704 kufidoq.exe 2704 kufidoq.exe 2704 kufidoq.exe 2704 kufidoq.exe 2704 kufidoq.exe 2704 kufidoq.exe 2704 kufidoq.exe 2704 kufidoq.exe 2704 kufidoq.exe 2704 kufidoq.exe 2704 kufidoq.exe 2704 kufidoq.exe 2704 kufidoq.exe 2704 kufidoq.exe 2704 kufidoq.exe 2704 kufidoq.exe 2704 kufidoq.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4608 ~DFA255.tmp -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4092 wrote to memory of 4368 4092 2d69aa1a205225f27dda27e59c0f1890_NEIKI.exe 83 PID 4092 wrote to memory of 4368 4092 2d69aa1a205225f27dda27e59c0f1890_NEIKI.exe 83 PID 4092 wrote to memory of 4368 4092 2d69aa1a205225f27dda27e59c0f1890_NEIKI.exe 83 PID 4368 wrote to memory of 4608 4368 niymioq.exe 85 PID 4368 wrote to memory of 4608 4368 niymioq.exe 85 PID 4368 wrote to memory of 4608 4368 niymioq.exe 85 PID 4092 wrote to memory of 1156 4092 2d69aa1a205225f27dda27e59c0f1890_NEIKI.exe 86 PID 4092 wrote to memory of 1156 4092 2d69aa1a205225f27dda27e59c0f1890_NEIKI.exe 86 PID 4092 wrote to memory of 1156 4092 2d69aa1a205225f27dda27e59c0f1890_NEIKI.exe 86 PID 4608 wrote to memory of 2704 4608 ~DFA255.tmp 103 PID 4608 wrote to memory of 2704 4608 ~DFA255.tmp 103 PID 4608 wrote to memory of 2704 4608 ~DFA255.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d69aa1a205225f27dda27e59c0f1890_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\2d69aa1a205225f27dda27e59c0f1890_NEIKI.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\niymioq.exeC:\Users\Admin\AppData\Local\Temp\niymioq.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\~DFA255.tmpC:\Users\Admin\AppData\Local\Temp\~DFA255.tmp OK3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\kufidoq.exe"C:\Users\Admin\AppData\Local\Temp\kufidoq.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2704
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uninsep.bat" "2⤵PID:1156
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
289B
MD543ebfa4d990c781e55d810d40122aad9
SHA1facb964611b151dbe0effa79ff04d86534076e4c
SHA256e61571a4650b26d962d67308276b7462f2208dc685448441dd705213c52a04fc
SHA5126e64dc3f0cc516f17df1f2ed9d5493f06c1b8e26b4491c5701225a962b5768ca8af7136feaa8965fc7e1556620d1a11686b549f2ac31bbb76b50f8dc2cd4171a
-
Filesize
104B
MD586bb2dbeaef655893262f3c041f6afe2
SHA11b26ff1241c1353bd506c18bd0c11878076ba65d
SHA2564a57643d2c59d1235bc0926f845583f39345839e3e9428ad619eb4b6baf96ad2
SHA51258294cfaa5882a4c5625c03fe6f9e4882912b31f7169241f95626745d66c0a746083a9044365943d66ae7a420113d28c0ddd642c4ed697c683deb63796a13d31
-
Filesize
480B
MD57292c66ec7809a17a6e9741006ce600a
SHA13b58def8983c7c4a578a1eb9f75529cb9acbd187
SHA256ee8cbc78d4ccf7554f41d53741d5e67fc858f283468e9db6f5d13378121abf2e
SHA5120a6e08b8459f9c76758cee5f3a6226b917f0c55c0233017f079878feb9994d108cf396f5821d480b46a2e0818c2f450fd4a73eca649f88e537af295e52d96592
-
Filesize
393KB
MD58d12ed32719c1ea3510f818766d7459f
SHA1890eed05f362cb06edd58c579396e1abf5466570
SHA2564f5b6edf44520101919216e6990295a3f5bfb3f5226c08abc84b14c29a36fe88
SHA51272c65ae31c09ca46d453380d0b134e9e76e6c67f49b00281eb0ac12775bf03db7cbbb8090ba8c9eb2149b63fb3ecfde2c85f154eddccfc54851d69b0879d671f
-
Filesize
724KB
MD552644d83dbcfa617060b9720868cf531
SHA18e9bc6c5f5ce261d4e0ac5affeae860bffb3feb3
SHA25608f43f5275b666b980aba055db2b8c8f0494b665f1e51fe52d867a202bd1f8bf
SHA512e1b775f4974e4c2805b65e14b04f26b671b1e38a7826af41741b86e223663604fab44d3ae6149664ec3ce2f28178808d7ac79d5c11d19fffaa91e029ca8aea6f
-
Filesize
731KB
MD50c44a29e178391c1042b867a656b188e
SHA15e33b7a83ecea9816ef4e0ef267f4d8c85a6692a
SHA25657615ff587cb9262bd479e94f0a2686811d4073116a27e5e333fa2f1610141e3
SHA512d1850d75b70a91c88f3dcdfe3f171bf6325ace49b90258105b34f1ad86495305dfe6d7c8e70c39be9ebd454aa6ba0a1ecaa2f2374ff4f7f314ce0dd5d3257091