Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 07:50
Static task
static1
Behavioral task
behavioral1
Sample
180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe
Resource
win7-20231129-en
General
-
Target
180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe
-
Size
62KB
-
MD5
180432d10e94a8d12670cdb5b83c3f60
-
SHA1
76c981ee49c093fd65412c167c9cebdc9bd2cdf1
-
SHA256
421bf5a06b27950edc9444f838e7c6a7fc05b6f7c7ee30957b9bf4d132edca4f
-
SHA512
5c756e4e3052065aca1657689d166a159794164d1b8b3216a770ca65b4c3a22a172c72083d372274e00b15897eeb881061b2537416a4ede971eedfe85de4e0fa
-
SSDEEP
768:QVyA+p4eAUf+aPoASIZjCxb0fo7c0oeS0:Qop4omMoASKeKo7c0oY
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Shohdi.hdi 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File opened for modification C:\Windows\SysWOW64\Shohdi.hdi 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Java\jre7\bin\ssvagent.sho 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File opened for modification \??\c:\Program Files\Microsoft Games\Minesweeper\MineSweeper.sho 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File opened for modification \??\c:\Program Files\Microsoft Office\Office14\MSOHTMED.sho 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File created \??\c:\Program Files\Mozilla Firefox\crashreporter.exe 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\WORDICON.sho 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File created \??\c:\Program Files\Google\Chrome\Application\chrome.exe 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.sho 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File created \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.sho 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File created \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.exe 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File created \??\c:\Program Files\Mozilla Firefox\uninstall\helper.exe 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.sho 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File created \??\c:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.sho 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File created \??\c:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File opened for modification \??\c:\Program Files\VideoLAN\VLC\vlc.sho 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.sho 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\OIS.sho 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File created \??\c:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.sho 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\vsta_ep32.sho 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.sho 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.sho 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File created \??\c:\Program Files\Microsoft Games\Hearts\Hearts.exe 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File created \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File created \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.EXE 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File created \??\c:\Program Files\Java\jre7\bin\javaw.exe 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File created \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.sho 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\MSOUC.EXE 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.sho 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Wordconv.sho 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File created \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.sho 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\private_browsing.sho 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File created \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.sho 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File created \??\c:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File created \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.sho 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.sho 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.sho 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.sho 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.sho 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File opened for modification \??\c:\Program Files\7-Zip\7zG.sho 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\SETLANG.sho 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.sho 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\default-browser-agent.sho 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.sho 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File created \??\c:\Program Files\7-Zip\7zG.exe 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File created \??\c:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.sho 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.sho 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File opened for modification \??\c:\Program Files\7-Zip\Uninstall.sho 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File created \??\c:\Program Files\Mozilla Firefox\firefox.exe 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.sho 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File created \??\c:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File created \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.sho 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1936 180432d10e94a8d12670cdb5b83c3f60_NEIKI.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD55f3f71e245d87b4b00d4fe52c242222e
SHA1b6de605c29699bbd4c57f251eb25495dca69d231
SHA256dfe26881179e0154ac854925c8110ed58763956b88adab831b392bc237afcfd9
SHA51285e5c18ce8c7b2bd54593785b0d02920a9c0b7bbbf32a9f5523b6d1c2ff28ad3218e39caad434b2b133c21cbb9e8481150a41a9a118cea41287a127e29385952