Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10/05/2024, 00:54

General

  • Target

    33f29e78e4b373ddba693876dc8d7a10_NeikiAnalytics.exe

  • Size

    55KB

  • MD5

    33f29e78e4b373ddba693876dc8d7a10

  • SHA1

    18df4d6a9b48f95b98859e05d4fb6700c97eb0ff

  • SHA256

    e4f3d41b25c585bda52d889c7a23eca7140053bb4669134eb4b4bc8cd9949e94

  • SHA512

    46ee6847e03e9fcd5d3deb170676d8d2d01ca7538f0f91d9bb7ff0ec9003995e8b34bdb2614d69847602b820ce0efeaa72386fd1f303553d549b5f74c50fe723

  • SSDEEP

    768:kSDAnyAiIbhn+nLTGqSxjquEDFAnA1tLRNk2djaYoCMHosQhW/3by8:kSDAndGLpqq2uBNdSCM/PO8

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\33f29e78e4b373ddba693876dc8d7a10_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\33f29e78e4b373ddba693876dc8d7a10_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1732
    • C:\Users\Admin\AppData\Local\Temp\hcbnaf.exe
      "C:\Users\Admin\AppData\Local\Temp\hcbnaf.exe"
      2⤵
      • Executes dropped EXE
      PID:2496

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\hcbnaf.exe

    Filesize

    55KB

    MD5

    4e0f08667b11570f3821be4b5d55408d

    SHA1

    e2c07995439dc61b63c9b4744a488a06d5625c68

    SHA256

    8bba5c66bd16ac291c4f5b0c4a30889f99516d0ac730fd067e30b9fe4affce43

    SHA512

    21ca9b1b58f7d6a10be81710fb0725f34dd4e9c9b893ab459d4eb8fb4e614d552a4e3fc875e09a5858c5cfe4230fd70910703929a5ceefb98c6d4dc05b81e2ae

  • memory/1732-0-0x0000000000130000-0x0000000000134000-memory.dmp

    Filesize

    16KB

  • memory/2496-8-0x0000000000210000-0x0000000000214000-memory.dmp

    Filesize

    16KB