Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    12/05/2024, 00:00

General

  • Target

    4cf679c63e738fe77ce6a08527e23d80_NeikiAnalytics.exe

  • Size

    670KB

  • MD5

    4cf679c63e738fe77ce6a08527e23d80

  • SHA1

    af16a9202fb8b5af17909422c9f5338e60d41d5a

  • SHA256

    d1b54e32a1e3f8757ac742161e2e8e3ece04f5783872214e226832aed8007acd

  • SHA512

    ea9c2194616b5bacc61f014f46c665fad2e9b2ac99e6d83c228860381b16496135285df9f403fa85fd99aece22168610d52f219a0ed4d2b89a99a141b87faa12

  • SSDEEP

    6144:/rTfUHeeSKOS9ccFKk3Y9t9YZuxzK0hAhvdDf03g3d6YzjO9Zimm1NroFjXog4Os:/n8yN0Mr8ZWKzvF03EQReurog4/FIg

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 9 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4cf679c63e738fe77ce6a08527e23d80_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\4cf679c63e738fe77ce6a08527e23d80_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2984
    • C:\Users\Public\Microsoft Build\Isass.exe
      "C:\Users\Public\Microsoft Build\Isass.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:3008
    • C:\Users\Public\Microsoft Build\Isass.exe
      "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\4cf679c63e738fe77ce6a08527e23d80_NeikiAnalytics.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1152
      • C:\Users\Admin\AppData\Local\Temp\4cf679c63e738fe77ce6a08527e23d80_NeikiAnalytics.exe
        "C:\Users\Admin\AppData\Local\Temp\4cf679c63e738fe77ce6a08527e23d80_NeikiAnalytics.exe"
        3⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2744
        • C:\Users\Public\Microsoft Build\Isass.exe
          "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\4cf679c63e738fe77ce6a08527e23d80_NeikiAnalytics.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2720
          • C:\Users\Admin\AppData\Local\Temp\4cf679c63e738fe77ce6a08527e23d80_NeikiAnalytics.exe
            "C:\Users\Admin\AppData\Local\Temp\4cf679c63e738fe77ce6a08527e23d80_NeikiAnalytics.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:2940

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Public\Microsoft Build\Isass.exe

    Filesize

    320KB

    MD5

    bff78902be43594cdffc6ce37458ee5c

    SHA1

    441fdaaf073d134b51bc091712adbc40c277b89c

    SHA256

    036b2bdcbd660aa5183d2ba8e56eed88fe37ce11c5a4440a09f68eefdf8260ab

    SHA512

    2f8512723fd41286108c078d125436224b30c404bed8c772d4f3aab6d76af19daf3db2d65403f38ae9abac6f2668411a8e901a55fbb98ca8645c4fafab373689

  • memory/1152-19-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2720-32-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2744-21-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2940-34-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2984-7-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2984-10-0x0000000004550000-0x00000000057F9000-memory.dmp

    Filesize

    18.7MB

  • memory/2984-11-0x0000000004550000-0x00000000057F9000-memory.dmp

    Filesize

    18.7MB

  • memory/2984-16-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2984-15-0x00000000003B0000-0x00000000003B1000-memory.dmp

    Filesize

    4KB

  • memory/3008-35-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/3008-57-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/3008-17-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/3008-36-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/3008-37-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/3008-40-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/3008-47-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/3008-48-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/3008-49-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/3008-14-0x00000000003B0000-0x00000000003B1000-memory.dmp

    Filesize

    4KB

  • memory/3008-63-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/3008-64-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/3008-69-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/3008-73-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/3008-81-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/3008-82-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/3008-91-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB