Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/05/2024, 22:08

General

  • Target

    15666f7b3fd21e01cad2fe513aae5de0_NeikiAnalytics.exe

  • Size

    36KB

  • MD5

    15666f7b3fd21e01cad2fe513aae5de0

  • SHA1

    28cb122266be8b229337893c84e20a303395cade

  • SHA256

    4f162850cff0988fda1dc0c937da3fbe03116d6e0523a8c2088c9307a5de43d6

  • SHA512

    ef7139c70926687003e1a726a6150321d656bfd96529db2dbf1adafbeefd4704a957141860f1e589afc3224b33822ecb48f002435a5b661d551460d24082b5ef

  • SSDEEP

    384:tYsx9c1H0QxeM6bcsu+je3ReNaa7Y9uziy9LsTLW1jJfm0DP20A48f/XeNaDK/:mszc5ejogavDyoOA0DTAheAK/

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\15666f7b3fd21e01cad2fe513aae5de0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\15666f7b3fd21e01cad2fe513aae5de0_NeikiAnalytics.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3192
    • C:\Users\Admin\AppData\Local\Temp\budha.exe
      "C:\Users\Admin\AppData\Local\Temp\budha.exe"
      2⤵
      • Executes dropped EXE
      PID:1116

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\budha.exe

    Filesize

    36KB

    MD5

    da6abb95517e8cb58716bbd760fad27b

    SHA1

    c235126a2afbfd38d2fb493b50d7b1e68f2c507b

    SHA256

    25968eefa7ecd6b67c6445ae328725abad771f46f8c1d216ca2d44ca5845cd3b

    SHA512

    fc4f4ea0cd7d4bb38b9b490f474a246e8b26bc022391dbb26c473fcec2cf64c12572abca1f475410b9c488da4659e3d06534f17563538e3964f31cd8dc5d59a1

  • memory/1116-13-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/1116-14-0x0000000002290000-0x0000000002291000-memory.dmp

    Filesize

    4KB

  • memory/1116-15-0x00000000025E0000-0x00000000029E0000-memory.dmp

    Filesize

    4.0MB

  • memory/1116-16-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/3192-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/3192-2-0x0000000002340000-0x0000000002341000-memory.dmp

    Filesize

    4KB

  • memory/3192-3-0x0000000002690000-0x0000000002A90000-memory.dmp

    Filesize

    4.0MB

  • memory/3192-12-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB