Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    09/05/2024, 02:54

General

  • Target

    d64c03581bd942826c1985dabb1b86c0_NEIKI.exe

  • Size

    459KB

  • MD5

    d64c03581bd942826c1985dabb1b86c0

  • SHA1

    e5f7bc9daa641c5df80baff5272a5b08d1c1cedd

  • SHA256

    4ef68bc48aa8976b2e31f1331958032aa4fed083cc09de30291f50425619fe12

  • SHA512

    764bb706996f3fa4b42f5cf1e3ac88b900404082979b36438ee5d690ccfdc0621bc6fe5979c9e07f428bf9efe045c7a47cdf9d68863f4ec4bc28ef68dd500ca7

  • SSDEEP

    6144:l7s/MwGsmLrZNs/VKi/MwGsmLr5+Nod/MwGsmLrZNs/VKi/MwGsmLrRo68lS:lSMmmpNs/VXMmmg8MmmpNs/VXMmm

Score
10/10

Malware Config

Signatures

  • Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 14 IoCs
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 18 IoCs
  • Drops file in System32 directory 21 IoCs
  • Program crash 1 IoCs
  • Modifies registry class 24 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d64c03581bd942826c1985dabb1b86c0_NEIKI.exe
    "C:\Users\Admin\AppData\Local\Temp\d64c03581bd942826c1985dabb1b86c0_NEIKI.exe"
    1⤵
    • Adds autorun key to be loaded by Explorer.exe on startup
    • Loads dropped DLL
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1928
    • C:\Windows\SysWOW64\Hmlnoc32.exe
      C:\Windows\system32\Hmlnoc32.exe
      2⤵
      • Adds autorun key to be loaded by Explorer.exe on startup
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2200
      • C:\Windows\SysWOW64\Hckcmjep.exe
        C:\Windows\system32\Hckcmjep.exe
        3⤵
        • Adds autorun key to be loaded by Explorer.exe on startup
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:3036
        • C:\Windows\SysWOW64\Hellne32.exe
          C:\Windows\system32\Hellne32.exe
          4⤵
          • Adds autorun key to be loaded by Explorer.exe on startup
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in System32 directory
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:2552
          • C:\Windows\SysWOW64\Hhjhkq32.exe
            C:\Windows\system32\Hhjhkq32.exe
            5⤵
            • Adds autorun key to be loaded by Explorer.exe on startup
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in System32 directory
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:2724
            • C:\Windows\SysWOW64\Hodpgjha.exe
              C:\Windows\system32\Hodpgjha.exe
              6⤵
              • Adds autorun key to be loaded by Explorer.exe on startup
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in System32 directory
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:2564
              • C:\Windows\SysWOW64\Ioijbj32.exe
                C:\Windows\system32\Ioijbj32.exe
                7⤵
                • Adds autorun key to be loaded by Explorer.exe on startup
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in System32 directory
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:2432
                • C:\Windows\SysWOW64\Iagfoe32.exe
                  C:\Windows\system32\Iagfoe32.exe
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:1092
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 140
                    9⤵
                    • Loads dropped DLL
                    • Program crash
                    PID:2736

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\Hhjhkq32.exe

    Filesize

    459KB

    MD5

    47b4059f7b13438c65446b15484a7b76

    SHA1

    62f149bb432786999ee48a73f5de3a7cfcd1103e

    SHA256

    500c41eec27b239f07f6045ba40b28f12872b16e87a59902c0cd475b261cb127

    SHA512

    8240876ebfba2e82e806f1497595c4a08133aed244087049d040f517117a78313504dc4f997419a165dbbd53b6a30d4ca4daa96d267e8dc1d528fc6f0f12de1b

  • C:\Windows\SysWOW64\Iagfoe32.exe

    Filesize

    459KB

    MD5

    f978b05896729ec294e831d77ec34c71

    SHA1

    4ed44403a6a08717ac18ab064fa45e0c4d92fd7a

    SHA256

    de7aa79226f54b436da661ffef41089caeb81a0e699d3dfbfcc360fd84c79c61

    SHA512

    066e7983b6ab59a37cea9041b2a7a8ad7cfda5cdb8c28b4d6ccf723bb27e2832b1dd060bca75d743613c6f8f9e23c39134ddf63c65e63306c9ba12c975fbb39e

  • C:\Windows\SysWOW64\Ioijbj32.exe

    Filesize

    459KB

    MD5

    f075ec2a07a6b3cce6e2ab3a9c53566b

    SHA1

    002f1bb8ed934f09156ddf7ec854970c3664eacd

    SHA256

    0526db7b7e4580cfc85f563b2aa357f6118b35e58d82677d6b8832c31a2f287b

    SHA512

    8966a4bf438c03aeb232fe42c34c6a89ef93bafc1bcbdd0364ceba87c8b6dc74087379c326d50c587abce87b4355f8a8c133f552833f1dfc9fe971e2c6e4b712

  • \Windows\SysWOW64\Hckcmjep.exe

    Filesize

    459KB

    MD5

    4e75ba88aed6c6fd20e72d96312024d2

    SHA1

    55653ebc4f3bb8c9697a1351c7abc178e09fabb6

    SHA256

    801971bec4a6dc6973588fe04c0245b9ddf50ff93108ddb462ce1a982ffbad53

    SHA512

    eadd7f55eee81db038c21c7851df39e8ba2f4d8abbc7b4f8587c05d4a0d332970a11a7fd05b5f36ad7ef74387fe4c95fc5a1d72ba9082d69884e36069eea9685

  • \Windows\SysWOW64\Hellne32.exe

    Filesize

    459KB

    MD5

    e1c73eb8a6e1665f8cbe1123b382a14c

    SHA1

    0da3348fda6747161403bff2467f2d13e614a6dd

    SHA256

    6ec12a18aa948f3909f7d298b5458e53b44b74293e6c49c3d0dac4622398503c

    SHA512

    0f92d6f820cca31bc7d663159686123f4731d4d68389a6569e3fe41cd12c647bd69fd7b564afea4eb82fccf03ee85762017db37f08aeaefe74d03ef119e3abe2

  • \Windows\SysWOW64\Hmlnoc32.exe

    Filesize

    459KB

    MD5

    c9f2c908d73ae0e78cc305ef79822c28

    SHA1

    9f85b64b2440c4fb1ee3bc1271e1bc2ccb29fbc1

    SHA256

    57b5fd38cc87ce817313106e06b540b7494a2fcebcda4b38657481f972c901be

    SHA512

    11c858da1217be951a7233fdd04d7545a31cddb0e37f73f20f1736e57e12af01ef6a42e85fc2c48d59620a689a9a9c8df08cbec80857b961934067f5b1cd9f56

  • \Windows\SysWOW64\Hodpgjha.exe

    Filesize

    459KB

    MD5

    4a7c0de7a3d0bf662fd406bbca70bc09

    SHA1

    ab42534a23bf7a55e5c277febb6e2cc39e90767d

    SHA256

    69c6969fcdef882d1bb81ce7ef871b559c6570f53cb247f9aa576bd428c95c85

    SHA512

    74189ba0b392c29469428d297bdc15f2c7522630a5090a5ab9454070c448eb10ebd3e6d09ab48206ccc7313c6403d8d922912be022c505198a5ebf73f639e17e

  • memory/1092-107-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/1928-6-0x0000000000250000-0x0000000000283000-memory.dmp

    Filesize

    204KB

  • memory/1928-100-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/1928-0-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2200-25-0x0000000000260000-0x0000000000293000-memory.dmp

    Filesize

    204KB

  • memory/2200-26-0x0000000000260000-0x0000000000293000-memory.dmp

    Filesize

    204KB

  • memory/2200-101-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2432-90-0x0000000001F60000-0x0000000001F93000-memory.dmp

    Filesize

    204KB

  • memory/2432-82-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2432-106-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2552-47-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2564-81-0x00000000002E0000-0x0000000000313000-memory.dmp

    Filesize

    204KB

  • memory/2564-105-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2724-55-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/2724-63-0x0000000000250000-0x0000000000283000-memory.dmp

    Filesize

    204KB

  • memory/2724-104-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/3036-40-0x0000000000260000-0x0000000000293000-memory.dmp

    Filesize

    204KB

  • memory/3036-39-0x0000000000260000-0x0000000000293000-memory.dmp

    Filesize

    204KB

  • memory/3036-102-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/3036-27-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB