Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
08/05/2024, 21:17
Static task
static1
Behavioral task
behavioral1
Sample
58a864870bbb5a528c18ec7f6d4cee10_NEIKI.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
58a864870bbb5a528c18ec7f6d4cee10_NEIKI.exe
Resource
win10v2004-20240426-en
General
-
Target
58a864870bbb5a528c18ec7f6d4cee10_NEIKI.exe
-
Size
889KB
-
MD5
58a864870bbb5a528c18ec7f6d4cee10
-
SHA1
849318b56c93793e19b3138f6690417960608808
-
SHA256
f74489eebecd78ab5f35750ba56cc236d542be635225e0165a2d5a0de0b4e4f7
-
SHA512
1ae65642ddc87094ca0839c8b8e5e302c801cee9daf2c6c2a979465250f4aa0baa1669b5502ea4999703612c0189ffece3be47474d8628feee1efb2a4551d78b
-
SSDEEP
3072:MGjhaq5iL0beJQZt32wLji5DlsODxRPNDkjmHzW9hUd56JsuBSjwGPmO12i1Dzby:Hha8iAx+1zwjmHd6vB/jO11zBd8qJG
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FifefoxUpdater = "C:\\Windows\\system32\\FifefoxUpdater.scr" 58a864870bbb5a528c18ec7f6d4cee10_NEIKI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinSevenUpdater = "C:\\Windows\\system32\\AVSCANNER.EXE" 58a864870bbb5a528c18ec7f6d4cee10_NEIKI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GGAAAG_LOADER = "C:\\Windows\\system32\\GAAG.exe" 58a864870bbb5a528c18ec7f6d4cee10_NEIKI.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\GAAG.exe 58a864870bbb5a528c18ec7f6d4cee10_NEIKI.exe File opened for modification C:\Windows\SysWOW64\GAAG.exe 58a864870bbb5a528c18ec7f6d4cee10_NEIKI.exe File created C:\Windows\SysWOW64\FifefoxUpdater.scr 58a864870bbb5a528c18ec7f6d4cee10_NEIKI.exe File opened for modification C:\Windows\SysWOW64\FifefoxUpdater.scr 58a864870bbb5a528c18ec7f6d4cee10_NEIKI.exe File created C:\Windows\SysWOW64\AVSCANNER.EXE 58a864870bbb5a528c18ec7f6d4cee10_NEIKI.exe File opened for modification C:\Windows\SysWOW64\AVSCANNER.EXE 58a864870bbb5a528c18ec7f6d4cee10_NEIKI.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
899KB
MD5697ea9772623f65d70ce2a0a850b0a1a
SHA1ee3d06a9493dc8c8a1122b38476eb664bc9abf29
SHA256643b9fbe395b91f44def5ea0d142e2998f07ddfbb9cfa2cb3ac975a972bce68c
SHA512cb0eda230986d0e49edd603374aecfb4bc6f99f0aee2474fe0de9c09e501f303acb033ea8f5793af63b0727cae5eea07b5a059a342ba4c2edfc86451898c8c0f