Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
08/05/2024, 15:50
Static task
static1
Behavioral task
behavioral1
Sample
f78ee97212ae68a44bad45d5c2711880_NEIKI.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
f78ee97212ae68a44bad45d5c2711880_NEIKI.exe
Resource
win10v2004-20240426-en
General
-
Target
f78ee97212ae68a44bad45d5c2711880_NEIKI.exe
-
Size
1.5MB
-
MD5
f78ee97212ae68a44bad45d5c2711880
-
SHA1
6aff4b9b5c86a79a0cf3a161bad342fad1f174e1
-
SHA256
e5fe5466f3541bb926edda6cbd30d4cac346fb3e05d2d7a9a42b4e3c2f10d3ef
-
SHA512
975a1a04e601f811f463c38de945ff9e5523afc050f99d1db3875c0595d811149c9a60a01021836167620b620d9febdd01c2ef6517998fe146a48bdd9846e63a
-
SSDEEP
3072:xR4jdNqTqHL+3phRrbhsEExMusExvQF4ExM0ExMt:/afYphYq
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: f78ee97212ae68a44bad45d5c2711880_NEIKI.exe File opened (read-only) \??\I: f78ee97212ae68a44bad45d5c2711880_NEIKI.exe File opened (read-only) \??\L: f78ee97212ae68a44bad45d5c2711880_NEIKI.exe File opened (read-only) \??\N: f78ee97212ae68a44bad45d5c2711880_NEIKI.exe File opened (read-only) \??\G: f78ee97212ae68a44bad45d5c2711880_NEIKI.exe File opened (read-only) \??\H: f78ee97212ae68a44bad45d5c2711880_NEIKI.exe File opened (read-only) \??\J: f78ee97212ae68a44bad45d5c2711880_NEIKI.exe File opened (read-only) \??\K: f78ee97212ae68a44bad45d5c2711880_NEIKI.exe File opened (read-only) \??\M: f78ee97212ae68a44bad45d5c2711880_NEIKI.exe File opened (read-only) \??\O: f78ee97212ae68a44bad45d5c2711880_NEIKI.exe -
Drops file in Program Files directory 21 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe f78ee97212ae68a44bad45d5c2711880_NEIKI.exe File created C:\Program Files\7-Zip\7z.cab f78ee97212ae68a44bad45d5c2711880_NEIKI.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe f78ee97212ae68a44bad45d5c2711880_NEIKI.exe File opened for modification C:\Program Files\7-Zip\RCX76AC.tmp f78ee97212ae68a44bad45d5c2711880_NEIKI.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab f78ee97212ae68a44bad45d5c2711880_NEIKI.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe f78ee97212ae68a44bad45d5c2711880_NEIKI.exe File opened for modification C:\Program Files\7-Zip\RCX7678.tmp f78ee97212ae68a44bad45d5c2711880_NEIKI.exe File opened for modification C:\Program Files\7-Zip\RCX76AA.tmp f78ee97212ae68a44bad45d5c2711880_NEIKI.exe File created C:\Program Files\7-Zip\7z.exe f78ee97212ae68a44bad45d5c2711880_NEIKI.exe File created C:\Program Files\7-Zip\7zFM.cab f78ee97212ae68a44bad45d5c2711880_NEIKI.exe File opened for modification C:\Program Files\7-Zip\7zFM.cab f78ee97212ae68a44bad45d5c2711880_NEIKI.exe File created C:\Program Files\7-Zip\7zFM.exe f78ee97212ae68a44bad45d5c2711880_NEIKI.exe File opened for modification C:\Program Files\7-Zip\RCX7699.tmp f78ee97212ae68a44bad45d5c2711880_NEIKI.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX76BC.tmp f78ee97212ae68a44bad45d5c2711880_NEIKI.exe File created C:\Program Files\readme.1xt f78ee97212ae68a44bad45d5c2711880_NEIKI.exe File opened for modification C:\Program Files\7-Zip\7z.cab f78ee97212ae68a44bad45d5c2711880_NEIKI.exe File opened for modification C:\Program Files\7-Zip\RCX76AB.tmp f78ee97212ae68a44bad45d5c2711880_NEIKI.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab f78ee97212ae68a44bad45d5c2711880_NEIKI.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX76BD.tmp f78ee97212ae68a44bad45d5c2711880_NEIKI.exe File opened for modification C:\Program Files\7-Zip\RCX7689.tmp f78ee97212ae68a44bad45d5c2711880_NEIKI.exe File opened for modification C:\Program Files\7-Zip\7z.exe f78ee97212ae68a44bad45d5c2711880_NEIKI.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4164 1196 WerFault.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\f78ee97212ae68a44bad45d5c2711880_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\f78ee97212ae68a44bad45d5c2711880_NEIKI.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
PID:1196 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 6882⤵
- Program crash
PID:4164
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1196 -ip 11961⤵PID:1620
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
544KB
MD59a1dd1d96481d61934dcc2d568971d06
SHA1f136ef9bf8bd2fc753292fb5b7cf173a22675fb3
SHA2568cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525
SHA5127ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa
-
Filesize
1.5MB
MD59066926b5fdf4a68cb58b7ed9b1dc57b
SHA1f1366d4b8bd39849b942206f2c2bd6f9bf905e0b
SHA2567c4372481deec7f6cc6de32e94c731630dc4af2bfe8a8fd6fdf34bc23ca61b7c
SHA512b07a055087d16786d0b634e4593b2455e2e5b909debcd4b04d01dd8202f55406f0f5cf1dd4f7dd5abe4ba2344b1d38a227e4e5d35896cd21ab39200554e7bc11
-
Filesize
930KB
MD530ac0b832d75598fb3ec37b6f2a8c86a
SHA16f47dbfd6ff36df7ba581a4cef024da527dc3046
SHA2561ea0839c8dc95ad2c060af7d042c40c0daed58ce8e4524c0fba12fd73e4afb74
SHA512505870601a4389b7ed2c8fecf85835adfd2944cbc10801f74bc4e08f5a0d6ecc9a52052fc37e216304cd1655129021862294a698ed36b3b43d428698f7263057
-
Filesize
168KB
MD5c40cd71c7601387b53c0e59d62880d1e
SHA19b09305e0cb7a85c823d514d9dd1e2a431c8a5db
SHA25690da536777201b8bffd0c2667e3cf8c1781eba777c010e434e85e0e0c5d1c0a1
SHA512fcaff627a38cc412e0c62e2aec0c7ebc04192f3beab642b0dc237eb11722712ed0141d4e8b4d28f03d191ea7047e7647e5c95c04ffd22633fb0333514e2c70e6
-
Filesize
2.1MB
MD5b8d69fa2755c3ab1f12f8866a8e2a4f7
SHA18e3cdfb20e158c2906323ba0094a18c7dd2aaf2d
SHA2567e0976036431640ae1d9f1c0b52bcea5dd37ef86cd3f5304dc8a96459d9483cd
SHA5125acac46068b331216978500f67a7fa5257bc5b05133fab6d88280b670ae4885ef2d5d1f531169b66bf1952e082f56b1ad2bc3901479b740f96c53ea405adda18