Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

85d9cd8531...cs.exe

windows7-x64

7

85d9cd8531...cs.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    09/05/2024, 16:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    85d9cd8531c6f418fac7193652bae4c0_NeikiAnalytics.exe

  • Size

    4.1MB

  • MD5

    85d9cd8531c6f418fac7193652bae4c0

  • SHA1

    51fc88a6c1aa6c758bcb480572df6f4fb2f5ec13

  • SHA256

    b43b64f29bd25a0541f01d06826a88fc6d900cbf7e9fc039ca4effa2255059d4

  • SHA512

    cfd9433a11a7e075c5e5b9521b77c1ec218dfa5ab7fee5120fb7cdae77874bf64a42cc8056bad6571ccf460c3f92e9792a202afc38152548e15f15d6ebe7a2e7

  • SSDEEP

    98304:+R0pI/IQlUoMPdmpSpq4ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdmV5n9klRKN41v

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\85d9cd8531c6f418fac7193652bae4c0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\85d9cd8531c6f418fac7193652bae4c0_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2884
    • C:\UserDotJI\xoptisys.exe
      C:\UserDotJI\xoptisys.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:1196

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Mint8C\optidevsys.exe
    Filesize

    4.1MB

    MD5

    8054e1cac0ce4dd3c2ceffce190b32d8

    SHA1

    670f17a90113a2d37e972ea7caf7a1d2f70c9721

    SHA256

    f4711a70c693145580ff19d0399e07726ef67135f933a2ad757ff35bbc09f75f

    SHA512

    6cdd8c000e0e2f8f79915605159eead76a8ca097737357db69a756d816505fce347591c66ac67428fda5d937cf511e5525b490c8e137b28772ff2b4c0e66e573

    Download Submit

  • C:\Users\Admin\253086396416_6.1_Admin.ini
    Filesize

    208B

    MD5

    d46d452fb1ff6f172a3dbff61bcba318

    SHA1

    897358d151f328665a7510ccbf7824a94ba77ff6

    SHA256

    ce8acad91fda8ff9a64d5dc8e3d74c26478c7d8ec4d7ad57497ae878b77adbf0

    SHA512

    807a57217a2e9a4d481c2e3883479ca531c63dc937374ef382e5f76e0a159c5a41b222412247d41a7f6025f3b957d1f0cd99bc36bfcc1eb4d680a319fbd4cf82

    Download Submit

  • \UserDotJI\xoptisys.exe
    Filesize

    4.1MB

    MD5

    69e3a46e0149c93adf83514cc1ac323d

    SHA1

    1487442142c90929f233ea2b7e310e0611c9923d

    SHA256

    baab843186401cdbc1a5547320b1ded35e72f80d2636e09249e735f3c9fc1dd2

    SHA512

    ae1b215b876a5141a0fab4b044d2767a0f3406fdb29185ab059a96a685382d567d633f2b710ff69f5709e51b29ec80956db731e7275414cfbe607ed5c351606c

    Download Submit