Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    10/05/2024, 13:20

General

  • Target

    ea3fcad10e7360f86e32848574107810_NeikiAnalytics.exe

  • Size

    4.3MB

  • MD5

    ea3fcad10e7360f86e32848574107810

  • SHA1

    5c6c0e26b337cfb03944756ce7cede8be8576af8

  • SHA256

    21297f29d97dbd948c68f37294f130e4a331e1438cd5fa2339d291a23e041449

  • SHA512

    0c5bae4d0545c54e50e72bbaf16c6ce4eb5119bba055f259602d7dbe4421878f632c63c61f25f6384230d0a702e0ce0cffb3cdc0ef67342ff44ec9dbb20eb103

  • SSDEEP

    98304:lqs7WQUP+Mxzy8RjJ+6qKgv9dAdw+EKnU3pO9uqeL:wsCQy+N8RjJUKO9dagRZOpeL

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • VMProtect packed file 7 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ea3fcad10e7360f86e32848574107810_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\ea3fcad10e7360f86e32848574107810_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2416
    • C:\Users\Admin\AppData\Local\Temp\opeu\zeoiu.exe
      "C:\Users\Admin\AppData\Local\Temp\opeu\zeoiu.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:2796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\opeu\zeoiu.exe

    Filesize

    4.3MB

    MD5

    845cd78af716a31ecd3f0545cf6b44a4

    SHA1

    27016eda19b8da00b655d90b0c7b4bc6211c7149

    SHA256

    a59ddd6cb1106ca47b83ba1eba4ed5f9ed72847c867a30a082741c69679816ec

    SHA512

    0a76625fe654f6dcba5839d1568420a81b13c5fdb0e9d04406bea46822844925fbc3b34038fdbc78e8ebed413c286b71863ce20c5f8f85a6fd0660a23ddf75bd

  • memory/2416-39-0x0000000000400000-0x0000000000AFC000-memory.dmp

    Filesize

    7.0MB

  • memory/2416-32-0x0000000000310000-0x0000000000311000-memory.dmp

    Filesize

    4KB

  • memory/2416-5-0x00000000002C0000-0x00000000002C1000-memory.dmp

    Filesize

    4KB

  • memory/2416-29-0x0000000000300000-0x0000000000301000-memory.dmp

    Filesize

    4KB

  • memory/2416-27-0x0000000000300000-0x0000000000301000-memory.dmp

    Filesize

    4KB

  • memory/2416-24-0x00000000002F0000-0x00000000002F1000-memory.dmp

    Filesize

    4KB

  • memory/2416-22-0x00000000002F0000-0x00000000002F1000-memory.dmp

    Filesize

    4KB

  • memory/2416-19-0x00000000002E0000-0x00000000002E1000-memory.dmp

    Filesize

    4KB

  • memory/2416-17-0x00000000002E0000-0x00000000002E1000-memory.dmp

    Filesize

    4KB

  • memory/2416-14-0x00000000002D0000-0x00000000002D1000-memory.dmp

    Filesize

    4KB

  • memory/2416-12-0x00000000002D0000-0x00000000002D1000-memory.dmp

    Filesize

    4KB

  • memory/2416-9-0x00000000002C0000-0x00000000002C1000-memory.dmp

    Filesize

    4KB

  • memory/2416-7-0x00000000002C0000-0x00000000002C1000-memory.dmp

    Filesize

    4KB

  • memory/2416-37-0x0000000000400000-0x0000000000AFC000-memory.dmp

    Filesize

    7.0MB

  • memory/2416-0-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2416-34-0x0000000000310000-0x0000000000311000-memory.dmp

    Filesize

    4KB

  • memory/2416-2-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2416-30-0x0000000000310000-0x0000000000311000-memory.dmp

    Filesize

    4KB

  • memory/2416-4-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2416-44-0x0000000000400000-0x0000000000AFC000-memory.dmp

    Filesize

    7.0MB

  • memory/2796-45-0x0000000000400000-0x0000000000AFC000-memory.dmp

    Filesize

    7.0MB

  • memory/2796-70-0x0000000000270000-0x0000000000271000-memory.dmp

    Filesize

    4KB

  • memory/2796-84-0x0000000000400000-0x0000000000AFC000-memory.dmp

    Filesize

    7.0MB

  • memory/2796-83-0x0000000000400000-0x0000000000AFC000-memory.dmp

    Filesize

    7.0MB

  • memory/2796-68-0x0000000000270000-0x0000000000271000-memory.dmp

    Filesize

    4KB

  • memory/2796-65-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

  • memory/2796-63-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

  • memory/2796-60-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

  • memory/2796-58-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

  • memory/2796-55-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/2796-53-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB