Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    133s
  • max time network
    101s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/05/2024, 03:15

General

  • Target

    b6bc1f927a099e8a5092dc71f346d620_NEIKI.exe

  • Size

    159KB

  • MD5

    b6bc1f927a099e8a5092dc71f346d620

  • SHA1

    261c1a4ad4ab811628b9a96d6051cc923b74083e

  • SHA256

    2e35f1767d54a88658591bcf958cf72caf4500d5c803c551052e3194a4299432

  • SHA512

    04584d2d68815354a4287d673294c99ee27404e19ed835fae205174c5f278f1f7649e07bf17e0590711668c9cee14e2ea79406c1b07c4d469846a9dc82f0c4f6

  • SSDEEP

    1536:8iVlUPlfHeARjOsOAe2zBN7lE4U1sgzAom8JsuPIclSXsWjcdd6YGJYwYcDp:nVlUPZRxfxE9Vs5cfdd6YGGIF

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b6bc1f927a099e8a5092dc71f346d620_NEIKI.exe
    "C:\Users\Admin\AppData\Local\Temp\b6bc1f927a099e8a5092dc71f346d620_NEIKI.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1436
    • C:\Users\Admin\AppData\Local\Temp\biudfw.exe
      "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
      2⤵
      • Executes dropped EXE
      PID:2660
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
      2⤵
        PID:1528

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\biudfw.exe

      Filesize

      159KB

      MD5

      06339c6c70932935de4cc3591da66f92

      SHA1

      f2f268ea5e17d377d981ee2797b0f7291c35bb3a

      SHA256

      05c563fab694da131f9eec0f0405a081aa49cdbbb82764271fe518c4fa1b1867

      SHA512

      586b440250d115fc61d8ee7484d9eba325dba1b949e8cd4ed33f3ac48a4f88045fc4926a9f50e6dcbf3ffbfcd50ebe53a88b29b1d6b6007feae1730681da102a

    • C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

      Filesize

      512B

      MD5

      a250860c0687ed9dda488805c025a2d2

      SHA1

      0c181ed3b46463d35631ca169f0928c33a1da389

      SHA256

      3947c34dfc780b424a3207c6ebe12f667bcb839733107f7a94fe495ec705cb37

      SHA512

      0286fcd24203ef574c9fc37200e4b0e65d58296162aa89b5424ab48b814bd237e609ab7eaf42a69bdad2ab6414bfbbfaec4757e28b29c69752e0e65a653f665a

    • C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

      Filesize

      286B

      MD5

      40b13f0286f3458c05288653db628d71

      SHA1

      c4cd9ed6086ad518f45aa3ee4e1b406c2e38bc47

      SHA256

      e0f361aa04d9680e76035e631d8762094379d454ce4882c7a234e146a1152cbf

      SHA512

      f156b6775b8410ad628607c253f5ec138f73ab708d7fc37cafa2191806ee27ea50bc6f8aa4519659cc6abc7689801607229d178b3094f795f4cc855ed89f3d95