Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    93s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/05/2024, 14:38

General

  • Target

    0f15d84b8fb3530cbbcf9b6a06573070_NeikiAnalytics.exe

  • Size

    91KB

  • MD5

    0f15d84b8fb3530cbbcf9b6a06573070

  • SHA1

    46f5afbb0f099a0ca9d2e55e9c09085d50f4dac8

  • SHA256

    e3ec46a47e248030446e63ffffd7c17e4f473cc85f78d41f62260ae87fe8f09b

  • SHA512

    63da39075a6a6cfd8ae1dc6c2a59a5083cf5973c46a1469c44dd1857f3930a155348987f17a34db05dacf084e26b835f12ce005a107e95efa901fc15336884d6

  • SSDEEP

    1536:N5VzcfA/6LrVpL74gfh16nDGhqyEvnlfvJuprKAJXwg2MuO5l3Z1uk2hI8vqQwOz:/V2A/gVh74gpgD0qyEvlpur1gtEl3Z1u

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0f15d84b8fb3530cbbcf9b6a06573070_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\0f15d84b8fb3530cbbcf9b6a06573070_NeikiAnalytics.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4224
    • C:\Users\Admin\AppData\Local\Temp\7J6kuATrQWKtDzp.exe
      C:\Users\Admin\AppData\Local\Temp\7J6kuATrQWKtDzp.exe
      2⤵
      • Executes dropped EXE
      PID:4864
    • C:\Windows\CTS.exe
      "C:\Windows\CTS.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:936

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

    Filesize

    349KB

    MD5

    9536a47376136241db5358fa290da4df

    SHA1

    1a3efc0b5ded5ec47d92fe5d0331febf50c3d86c

    SHA256

    ab5e30f03917bc1bc41e2f3a7c096354fa50a403f15dcd5df7db88681cf2a9d9

    SHA512

    ea70012594d40b2e72266f490cc8d07e988e1ffe6cfc0694f4ba4fa65e5fa45d1bd2a8003b0a291c4eb1d5bad74e6cc1d7a5e30db0200b5430f3db3dc350413f

  • C:\Users\Admin\AppData\Local\Temp\7J6kuATrQWKtDzp.exe

    Filesize

    64KB

    MD5

    e97c622b03fb2a2598bf019fbbe29f2c

    SHA1

    32698bd1d3a0ff6cf441770d1b2b816285068d19

    SHA256

    5c1af46c7300e87a73dacf6cf41ce397e3f05df6bd9c7e227b4ac59f85769160

    SHA512

    db70c62fb35a8e5b005f13b57c1ebbf6c465f6ff0524422294c43e27fb4aa79379dc1e300ad11dc2354405c43b192ae06b91c0f525a1f2617e4d14673651a87d

  • C:\Windows\CTS.exe

    Filesize

    27KB

    MD5

    a6749b968461644db5cc0ecceffb224a

    SHA1

    2795aa37b8586986a34437081351cdd791749a90

    SHA256

    720023737d7ff700818f55612ba069a609a5ddea646bb3509b615ee3523a4ca2

    SHA512

    2a276816290746ed914af9cf6427aef31ce9395b8e9937090e329a8f74fb84c62d15b196e13346caa086842b3f5f549b9eb20cbf422d18c9c1b63e6342ea90b4

  • memory/936-11-0x0000000000660000-0x0000000000678000-memory.dmp

    Filesize

    96KB

  • memory/4224-0-0x0000000000820000-0x0000000000838000-memory.dmp

    Filesize

    96KB

  • memory/4224-9-0x0000000000820000-0x0000000000838000-memory.dmp

    Filesize

    96KB