Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    09/05/2024, 21:53

General

  • Target

    081c57cf1afd5820706b24c4da505f90_NeikiAnalytics.exe

  • Size

    32KB

  • MD5

    081c57cf1afd5820706b24c4da505f90

  • SHA1

    b902de824654e1cc4ef7c408a2f33c67c3ca8419

  • SHA256

    ab956036205ecb3d33f7a9cb2295fb8057aeb49c0f9e7541a9daf98e6d247cca

  • SHA512

    b5232cfc858ff286e010a3c0fdde27ccf228daebe11f7a1be50b911c43cbaa52163e75cdeeacbc2be9c310024c25e939e58dbde5e286fb3eed343e30679559d8

  • SSDEEP

    384:Q98xUHQSZltyujCcy4Ng8zLeiBerWd3daUS1lavv6JCoPuGXKHtB8g:TwjYuuc/gop3YJCoPuGX08g

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Runs .reg file with regedit 1 IoCs
  • Suspicious behavior: RenamesItself 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\081c57cf1afd5820706b24c4da505f90_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\081c57cf1afd5820706b24c4da505f90_NeikiAnalytics.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1548
    • C:\Windows\SysWOW64\regedit.exe
      regedit.exe /s C:\Users\Admin\AppData\Local\Temp\~dfds3.reg
      2⤵
      • Adds Run key to start application
      • Runs .reg file with regedit
      PID:1868

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\~dfds3.reg

    Filesize

    170B

    MD5

    c8aebc29cfc6cdec82d87f51eb5dc0f1

    SHA1

    24e73ad07558aa29dd9f3e5d3e8160467c2b4818

    SHA256

    ee0c518650d483498224e00e0e50a16d312c0c43e96ed1e8c627dfa6c649bd86

    SHA512

    93ea2cf3871efa7d4585162cd87782cf9f79764b077474047bea7c23fc3c89eb487a357dfb1f44f180d1bd55e8d3238b959b9ee2120f7285a609d9b5eb612ea6

  • C:\Users\Admin\AppData\Local\UI0Detect.exe

    Filesize

    32KB

    MD5

    f117bea9f25f712d030b69bc6a8a8b18

    SHA1

    643d8a0f4dbd5038345c3a8241e03d8fc1ff910f

    SHA256

    c7efe6156a061c80039b5e43803f484d66a5e56056fe313f3b372bf210933ab2

    SHA512

    8560fe72b7c8c7d7293fc0f5efe235711e3eecda8e7dbda059c64a18ad136156497bd613538ed61e9c914c7429658b38b36705a964b2e5b11cab8ce2867ddb46

  • memory/1548-0-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1548-1-0x0000000000020000-0x0000000000028000-memory.dmp

    Filesize

    32KB

  • memory/1548-2-0x0000000000020000-0x0000000000028000-memory.dmp

    Filesize

    32KB

  • memory/1548-13-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB