Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    08/05/2024, 01:25

General

  • Target

    9198e99962ea97239d07ff03a8fd45e0_NEIKI.exe

  • Size

    228KB

  • MD5

    9198e99962ea97239d07ff03a8fd45e0

  • SHA1

    7c1f972fa7077679652dfad341e542551c7a27ac

  • SHA256

    a9969bdd3c21839889fa9b2d9a5e5c72fb3518028d84f5cc435f0f74f51b3c28

  • SHA512

    c7b8bc2895433702c03b26b906ddde250ce77aa8a8d33383b6987aaf5c846e14f70c0c43ccb6f173a8e3d9b8adf878a0dfccd726e0c5418da60ea8c62eebcc77

  • SSDEEP

    6144:fuJKq3G5Li4VSaIHVhfo6YiBshMPWsAMy6WqzKaRJMCcCL:fuveLlVhGhwwBU+Wsg6WqPRGZY

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9198e99962ea97239d07ff03a8fd45e0_NEIKI.exe
    "C:\Users\Admin\AppData\Local\Temp\9198e99962ea97239d07ff03a8fd45e0_NEIKI.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1752
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\WINDOWS\Temp\ADSL.bat
      2⤵
        PID:2148

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1752-0-0x0000000000400000-0x000000000049B000-memory.dmp

      Filesize

      620KB

    • memory/1752-3-0x0000000000400000-0x000000000049B000-memory.dmp

      Filesize

      620KB