Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08/05/2024, 19:12
Static task
static1
Behavioral task
behavioral1
Sample
17bb9b3783bb996e17d5854d14601750_NEIKI.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
17bb9b3783bb996e17d5854d14601750_NEIKI.exe
Resource
win10v2004-20240226-en
General
-
Target
17bb9b3783bb996e17d5854d14601750_NEIKI.exe
-
Size
896KB
-
MD5
17bb9b3783bb996e17d5854d14601750
-
SHA1
8a64e908e0c91dff7287aba80837b56b00a90ea2
-
SHA256
a328a8e8c47de645f74907105df17d8a46b719a90aea073bff04a18d119a45fe
-
SHA512
2bfb2e0ba057e4f8d23da29283d8de3c82402a81210b01b1458a0cd1cf794f6745a57d39730d9f073cffba0c904561411810545b23999c61669058dc0faa5c48
-
SSDEEP
24576:B0cTRTGryZ5d9TRTGryaITRTGryZ5d9TRTGryeLTRTGryZ5d9TRTGryaITRTGryb:B0c9bD99wI9bD99e9bD99wI9bD99
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" 17bb9b3783bb996e17d5854d14601750_NEIKI.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pfojdh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pfojdh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bbfmgd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bbfmgd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cmbgdl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cmbgdl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 17bb9b3783bb996e17d5854d14601750_NEIKI.exe -
Executes dropped EXE 4 IoCs
pid Process 4576 Pfojdh32.exe 3088 Bbfmgd32.exe 4536 Cmbgdl32.exe 3584 Diqnjl32.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\Cmbgdl32.exe Bbfmgd32.exe File opened for modification C:\Windows\SysWOW64\Cmbgdl32.exe Bbfmgd32.exe File created C:\Windows\SysWOW64\Dcjdilmf.dll Bbfmgd32.exe File created C:\Windows\SysWOW64\Diqnjl32.exe Cmbgdl32.exe File opened for modification C:\Windows\SysWOW64\Diqnjl32.exe Cmbgdl32.exe File opened for modification C:\Windows\SysWOW64\Pfojdh32.exe 17bb9b3783bb996e17d5854d14601750_NEIKI.exe File opened for modification C:\Windows\SysWOW64\Bbfmgd32.exe Pfojdh32.exe File created C:\Windows\SysWOW64\Afjpan32.dll Pfojdh32.exe File created C:\Windows\SysWOW64\Qahlom32.dll Cmbgdl32.exe File created C:\Windows\SysWOW64\Pfojdh32.exe 17bb9b3783bb996e17d5854d14601750_NEIKI.exe File created C:\Windows\SysWOW64\Kjmgil32.dll 17bb9b3783bb996e17d5854d14601750_NEIKI.exe File created C:\Windows\SysWOW64\Bbfmgd32.exe Pfojdh32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3324 3584 WerFault.exe 94 -
Modifies registry class 15 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cmbgdl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID 17bb9b3783bb996e17d5854d14601750_NEIKI.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pfojdh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bbfmgd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dcjdilmf.dll" Bbfmgd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pfojdh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cmbgdl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 17bb9b3783bb996e17d5854d14601750_NEIKI.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738} 17bb9b3783bb996e17d5854d14601750_NEIKI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" 17bb9b3783bb996e17d5854d14601750_NEIKI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Afjpan32.dll" Pfojdh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 17bb9b3783bb996e17d5854d14601750_NEIKI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjmgil32.dll" 17bb9b3783bb996e17d5854d14601750_NEIKI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bbfmgd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qahlom32.dll" Cmbgdl32.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4764 wrote to memory of 4576 4764 17bb9b3783bb996e17d5854d14601750_NEIKI.exe 91 PID 4764 wrote to memory of 4576 4764 17bb9b3783bb996e17d5854d14601750_NEIKI.exe 91 PID 4764 wrote to memory of 4576 4764 17bb9b3783bb996e17d5854d14601750_NEIKI.exe 91 PID 4576 wrote to memory of 3088 4576 Pfojdh32.exe 92 PID 4576 wrote to memory of 3088 4576 Pfojdh32.exe 92 PID 4576 wrote to memory of 3088 4576 Pfojdh32.exe 92 PID 3088 wrote to memory of 4536 3088 Bbfmgd32.exe 93 PID 3088 wrote to memory of 4536 3088 Bbfmgd32.exe 93 PID 3088 wrote to memory of 4536 3088 Bbfmgd32.exe 93 PID 4536 wrote to memory of 3584 4536 Cmbgdl32.exe 94 PID 4536 wrote to memory of 3584 4536 Cmbgdl32.exe 94 PID 4536 wrote to memory of 3584 4536 Cmbgdl32.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\17bb9b3783bb996e17d5854d14601750_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\17bb9b3783bb996e17d5854d14601750_NEIKI.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\SysWOW64\Pfojdh32.exeC:\Windows\system32\Pfojdh32.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\SysWOW64\Bbfmgd32.exeC:\Windows\system32\Bbfmgd32.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Windows\SysWOW64\Cmbgdl32.exeC:\Windows\system32\Cmbgdl32.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\SysWOW64\Diqnjl32.exeC:\Windows\system32\Diqnjl32.exe5⤵
- Executes dropped EXE
PID:3584 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3584 -s 4006⤵
- Program crash
PID:3324
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3584 -ip 35841⤵PID:2944
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3644 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:81⤵PID:3944
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
896KB
MD58617ffc5d8305dc333be25e479545ef2
SHA112349868e0d7716626694b4256630c0e593fe0f5
SHA25641bb9b953c4b1f5266132ed433dc4fd86617a2e526237bf72b3be32a8735d971
SHA51235c29ef9f839c6ad6222d824c8111f8ccb56215144ea8b361a711457fa444f70e144565cba49e6f549b8f0622edf3dc73db253be70d4ec9347d9c57d0cddde3c
-
Filesize
896KB
MD5ad11e1bf7e7514a12b2fe9c9a01db34f
SHA1ff54084101e445e43a8b775e9007c93bd978affe
SHA2566a50b96e569e3ff3bde8e2ad2690431bccab5f925df4225dc939d2a682d6a256
SHA512d3a4fbe7ee0c2d72fc823956b400c16f7b7320d67a23013ebb94ab2f2b62b25669410e0ee32f545f8a7e89eee7de349a8c8dab956222478fb57c339d1592aceb
-
Filesize
896KB
MD55412b80a12dfe46c76050759bb0fed4e
SHA12edbe0ca2555e49dc7b2af542c0a96c516ba14b3
SHA256c5acfa3b92b85f27dd338ee62a67f96ec3adea3603e2d268e79d34fe93ba8a62
SHA512b328e2a5f4a652843a70c9900d70daa8eeb640d891226d11b97c4720e2648df85a7d030219fc804fd584329b051e698bbd45728f476373a15c89bcbba594c23d
-
Filesize
896KB
MD5a999f6a0a309b8f140b72e5e7b220979
SHA1c2af7e57b7e02ab4f681865522a8f105d7184795
SHA256c574882b807127a5d4f0b674b6c5488103fa6b9d85d66051941325139e87fd4e
SHA512b4ecdc642403480e5531077fa7a17a3ef53a7d93556147313d34203cfdd80bf899d2ef719b9ecfd0b2a4014c14ddc020b0eb7bd2b66f29e4dac7263eb1cf7985