Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 21:17
Static task
static1
Behavioral task
behavioral1
Sample
58a864870bbb5a528c18ec7f6d4cee10_NEIKI.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
58a864870bbb5a528c18ec7f6d4cee10_NEIKI.exe
Resource
win10v2004-20240426-en
General
-
Target
58a864870bbb5a528c18ec7f6d4cee10_NEIKI.exe
-
Size
889KB
-
MD5
58a864870bbb5a528c18ec7f6d4cee10
-
SHA1
849318b56c93793e19b3138f6690417960608808
-
SHA256
f74489eebecd78ab5f35750ba56cc236d542be635225e0165a2d5a0de0b4e4f7
-
SHA512
1ae65642ddc87094ca0839c8b8e5e302c801cee9daf2c6c2a979465250f4aa0baa1669b5502ea4999703612c0189ffece3be47474d8628feee1efb2a4551d78b
-
SSDEEP
3072:MGjhaq5iL0beJQZt32wLji5DlsODxRPNDkjmHzW9hUd56JsuBSjwGPmO12i1Dzby:Hha8iAx+1zwjmHd6vB/jO11zBd8qJG
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\GGAAAG_LOADER = "C:\\Windows\\system32\\GAAG.exe" 58a864870bbb5a528c18ec7f6d4cee10_NEIKI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FifefoxUpdater = "C:\\Windows\\system32\\FifefoxUpdater.scr" 58a864870bbb5a528c18ec7f6d4cee10_NEIKI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinSevenUpdater = "C:\\Windows\\system32\\AVSCANNER.EXE" 58a864870bbb5a528c18ec7f6d4cee10_NEIKI.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\FifefoxUpdater.scr 58a864870bbb5a528c18ec7f6d4cee10_NEIKI.exe File opened for modification C:\Windows\SysWOW64\FifefoxUpdater.scr 58a864870bbb5a528c18ec7f6d4cee10_NEIKI.exe File created C:\Windows\SysWOW64\AVSCANNER.EXE 58a864870bbb5a528c18ec7f6d4cee10_NEIKI.exe File opened for modification C:\Windows\SysWOW64\AVSCANNER.EXE 58a864870bbb5a528c18ec7f6d4cee10_NEIKI.exe File created C:\Windows\SysWOW64\GAAG.exe 58a864870bbb5a528c18ec7f6d4cee10_NEIKI.exe File opened for modification C:\Windows\SysWOW64\GAAG.exe 58a864870bbb5a528c18ec7f6d4cee10_NEIKI.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
899KB
MD5e0db87cbd1d2912bc0bd5358b7df8b2f
SHA117ac0f0ff6d029c26edad884e24657ee8485ad6f
SHA2569a6fe67c3a7ccc2bc265e16fc680130ff7b7d095908b0350aec407d897e9ded8
SHA5121b033b62b1e167aa17dcc4f4bf38cd620ec41b94b083d2f17994c4913c78488ff999b5fbf8963120f7325444f019b4c1abf8ce1993b5d95dc7d0ebdacb53a10d