Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    09/05/2024, 20:13

General

  • Target

    e877518128cf87d1ba0331e86fae93c0_NeikiAnalytics.exe

  • Size

    73KB

  • MD5

    e877518128cf87d1ba0331e86fae93c0

  • SHA1

    e6636ce3d518aa5bd1917be328a9dab032fcedb4

  • SHA256

    9e8123b7355aece1c48ad55899c17f0fd78aca0b877148f2895241a4776e8852

  • SHA512

    af597456020183a9d4bc37acbdbddf2dc6d68b9a65ae6966ad97d5a151a36bbf252a3bf4c65ef578ddf0ac479e41342e4cc3817e52bef7876218fa434d1aa35f

  • SSDEEP

    1536:gjIewPQsrz8haFpmqr76/Y3WLptb4yzwC132n6sLDDO:gjIpPN8QFda/2Yb4yzjsLXO

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 43 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1256
      • C:\Users\Admin\AppData\Local\Temp\e877518128cf87d1ba0331e86fae93c0_NeikiAnalytics.exe
        "C:\Users\Admin\AppData\Local\Temp\e877518128cf87d1ba0331e86fae93c0_NeikiAnalytics.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2904
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3016
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
              PID:2860
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c C:\Users\Admin\AppData\Local\Temp\$$a98B7.bat
            3⤵
            • Deletes itself
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:2588
            • C:\Users\Admin\AppData\Local\Temp\e877518128cf87d1ba0331e86fae93c0_NeikiAnalytics.exe
              "C:\Users\Admin\AppData\Local\Temp\e877518128cf87d1ba0331e86fae93c0_NeikiAnalytics.exe"
              4⤵
              • Executes dropped EXE
              PID:2544
          • C:\Windows\Logo1_.exe
            C:\Windows\Logo1_.exe
            3⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2648
            • C:\Windows\SysWOW64\net.exe
              net stop "Kingsoft AntiVirus Service"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:2380
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                5⤵
                  PID:2408
              • C:\Windows\SysWOW64\net.exe
                net stop "Kingsoft AntiVirus Service"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:2472
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                  5⤵
                    PID:2428

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

            Filesize

            265KB

            MD5

            4cc64235c6003981db1ea177c2b87212

            SHA1

            38502de6b6e9736e40c6b2123112453445961173

            SHA256

            74e78dde7778e26c94f9ce2be244d2ee190f32974634758a1e4ff04cd9ef5c11

            SHA512

            f15285baa9d7cff9185babd79a58450b7bb543abd29de183541f87a056ac80ca8c96e37fd0c487a6eae56092e49847aab279842642e4767c67e5087785d1cf55

          • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

            Filesize

            485KB

            MD5

            3ac7773258fe0684e8a28f3793a74ed3

            SHA1

            316fba91c21ea13e4576a5eeec832fd585c31ca0

            SHA256

            9f41dbbbdf4edcf63ba6262af0ae0d9a13874d0e008522af866f12f3e71b198f

            SHA512

            8d2647018107b940fe80b5ab979570b9f255764195976272b8c2ee8640b0e91493d5e7fa598b4ce29bda8f87cf495c6c71fd62734d51761b04bb5127eb5b2b4a

          • C:\Users\Admin\AppData\Local\Temp\$$a98B7.bat

            Filesize

            620B

            MD5

            7e29cf549f2f9dad6939943be653584e

            SHA1

            223c6735608d8f24e00a7fef1bab1d3c7c4cab04

            SHA256

            2b121977c411ab1bf92edfc33df0e1acab31b0d17a3fa16e7915acc61d27357d

            SHA512

            df703fc810b77c92e78db97971ed95aa661a2ac54fa82e5fbfe437c5748d37c279a75e939d5ca53b9941055a3456abbd895c5bd2628c0cb5984b077f30f7af97

          • C:\Users\Admin\AppData\Local\Temp\e877518128cf87d1ba0331e86fae93c0_NeikiAnalytics.exe.exe

            Filesize

            33KB

            MD5

            f8b1348f68d380115f37de85ca68d3b4

            SHA1

            1e2977c49dd8d52d1db3c1f14e32205c7efacfa6

            SHA256

            9cbd9a06aba24333d873174149ca30fe5c64c767586cec1a3c833eb6880c53ee

            SHA512

            0de9ddb66b52baa31a57689f781676839ca45a7d5e9cde9f57e96aa5c2c1118187dd1948e719b0c0fcbbe01da5c3ecdfc7caa6f32ba2dad940a4b2db668a384a

          • C:\Windows\Logo1_.exe

            Filesize

            40KB

            MD5

            631ddb32cedc061b61ddc87286d637de

            SHA1

            4b316a4dcd624e1d66f520900800d3944c805fdf

            SHA256

            c75da8fb42e45cd655454114f62c3b039a20cf4ffa58658e7d7eebb69e50e3ea

            SHA512

            a4ef8392c6d75a3fd31f0cb1aff66ea12a37fecf131547d78607331eca6406348c1964318f5baa1a20289fb5930ece7ab64b7c490a002ef8ef7c16b2a9913a77

          • F:\$RECYCLE.BIN\S-1-5-21-330940541-141609230-1670313778-1000\_desktop.ini

            Filesize

            8B

            MD5

            d970a2bfcaa076939c06270d1a48dec8

            SHA1

            7a558f4d64c3e98bcfd2af83f28e6fbd207a39e1

            SHA256

            bdc6872f9a0a011a670907f0fedad9b88e283c5af545cf9f6bd73c3709967d44

            SHA512

            ea4c16930628455852ce343f8ae248b6df869b8da10b10928ebb802129f73d9761971811de317c7d3121b815340027782ec15d385d1d2d7df8fd0a46b62974c2

          • memory/1256-29-0x0000000002140000-0x0000000002141000-memory.dmp

            Filesize

            4KB

          • memory/2648-2299-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

          • memory/2648-4081-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

          • memory/2648-20-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

          • memory/2648-33-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

          • memory/2904-16-0x0000000000230000-0x000000000026F000-memory.dmp

            Filesize

            252KB

          • memory/2904-18-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

          • memory/2904-17-0x0000000000230000-0x000000000026F000-memory.dmp

            Filesize

            252KB

          • memory/2904-0-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB