Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/05/2024, 00:00

General

  • Target

    4cf679c63e738fe77ce6a08527e23d80_NeikiAnalytics.exe

  • Size

    670KB

  • MD5

    4cf679c63e738fe77ce6a08527e23d80

  • SHA1

    af16a9202fb8b5af17909422c9f5338e60d41d5a

  • SHA256

    d1b54e32a1e3f8757ac742161e2e8e3ece04f5783872214e226832aed8007acd

  • SHA512

    ea9c2194616b5bacc61f014f46c665fad2e9b2ac99e6d83c228860381b16496135285df9f403fa85fd99aece22168610d52f219a0ed4d2b89a99a141b87faa12

  • SSDEEP

    6144:/rTfUHeeSKOS9ccFKk3Y9t9YZuxzK0hAhvdDf03g3d6YzjO9Zimm1NroFjXog4Os:/n8yN0Mr8ZWKzvF03EQReurog4/FIg

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4cf679c63e738fe77ce6a08527e23d80_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\4cf679c63e738fe77ce6a08527e23d80_NeikiAnalytics.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2964
    • C:\Users\Public\Microsoft Build\Isass.exe
      "C:\Users\Public\Microsoft Build\Isass.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:4112
    • C:\Users\Public\Microsoft Build\Isass.exe
      "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\4cf679c63e738fe77ce6a08527e23d80_NeikiAnalytics.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3480
      • C:\Users\Admin\AppData\Local\Temp\4cf679c63e738fe77ce6a08527e23d80_NeikiAnalytics.exe
        "C:\Users\Admin\AppData\Local\Temp\4cf679c63e738fe77ce6a08527e23d80_NeikiAnalytics.exe"
        3⤵
        • Checks computer location settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4432
        • C:\Users\Public\Microsoft Build\Isass.exe
          "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\4cf679c63e738fe77ce6a08527e23d80_NeikiAnalytics.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3000
          • C:\Users\Admin\AppData\Local\Temp\4cf679c63e738fe77ce6a08527e23d80_NeikiAnalytics.exe
            "C:\Users\Admin\AppData\Local\Temp\4cf679c63e738fe77ce6a08527e23d80_NeikiAnalytics.exe"
            5⤵
            • Checks computer location settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2548
            • C:\Users\Public\Microsoft Build\Isass.exe
              "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\4cf679c63e738fe77ce6a08527e23d80_NeikiAnalytics.exe
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:1336
              • C:\Users\Admin\AppData\Local\Temp\4cf679c63e738fe77ce6a08527e23d80_NeikiAnalytics.exe
                "C:\Users\Admin\AppData\Local\Temp\4cf679c63e738fe77ce6a08527e23d80_NeikiAnalytics.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                PID:776
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4028 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:4324

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Public\Microsoft Build\Isass.exe

      Filesize

      320KB

      MD5

      bff78902be43594cdffc6ce37458ee5c

      SHA1

      441fdaaf073d134b51bc091712adbc40c277b89c

      SHA256

      036b2bdcbd660aa5183d2ba8e56eed88fe37ce11c5a4440a09f68eefdf8260ab

      SHA512

      2f8512723fd41286108c078d125436224b30c404bed8c772d4f3aab6d76af19daf3db2d65403f38ae9abac6f2668411a8e901a55fbb98ca8645c4fafab373689

    • memory/776-27-0x0000000000400000-0x00000000016A8E52-memory.dmp

      Filesize

      18.7MB

    • memory/1336-25-0x0000000000400000-0x00000000016A8E52-memory.dmp

      Filesize

      18.7MB

    • memory/2548-17-0x0000000000400000-0x00000000016A8E52-memory.dmp

      Filesize

      18.7MB

    • memory/2964-1-0x00007FFECB7B0000-0x00007FFECB9A5000-memory.dmp

      Filesize

      2.0MB

    • memory/2964-0-0x0000000000400000-0x00000000016A8E52-memory.dmp

      Filesize

      18.7MB

    • memory/2964-9-0x0000000000400000-0x00000000016A8E52-memory.dmp

      Filesize

      18.7MB

    • memory/3000-15-0x0000000000400000-0x00000000016A8E52-memory.dmp

      Filesize

      18.7MB

    • memory/3480-10-0x0000000000400000-0x00000000016A8E52-memory.dmp

      Filesize

      18.7MB

    • memory/3480-11-0x0000000000400000-0x00000000016A8E52-memory.dmp

      Filesize

      18.7MB

    • memory/4112-28-0x0000000000400000-0x00000000016A8E52-memory.dmp

      Filesize

      18.7MB

    • memory/4112-41-0x0000000000400000-0x00000000016A8E52-memory.dmp

      Filesize

      18.7MB

    • memory/4112-83-0x0000000000400000-0x00000000016A8E52-memory.dmp

      Filesize

      18.7MB

    • memory/4112-7-0x00007FFECB7B0000-0x00007FFECB9A5000-memory.dmp

      Filesize

      2.0MB

    • memory/4112-6-0x0000000000400000-0x00000000016A8E52-memory.dmp

      Filesize

      18.7MB

    • memory/4112-29-0x0000000000400000-0x00000000016A8E52-memory.dmp

      Filesize

      18.7MB

    • memory/4112-30-0x0000000000400000-0x00000000016A8E52-memory.dmp

      Filesize

      18.7MB

    • memory/4112-36-0x0000000000400000-0x00000000016A8E52-memory.dmp

      Filesize

      18.7MB

    • memory/4112-37-0x0000000000400000-0x00000000016A8E52-memory.dmp

      Filesize

      18.7MB

    • memory/4112-74-0x0000000000400000-0x00000000016A8E52-memory.dmp

      Filesize

      18.7MB

    • memory/4112-46-0x0000000000400000-0x00000000016A8E52-memory.dmp

      Filesize

      18.7MB

    • memory/4112-47-0x0000000000400000-0x00000000016A8E52-memory.dmp

      Filesize

      18.7MB

    • memory/4112-53-0x0000000000400000-0x00000000016A8E52-memory.dmp

      Filesize

      18.7MB

    • memory/4112-57-0x0000000000400000-0x00000000016A8E52-memory.dmp

      Filesize

      18.7MB

    • memory/4112-64-0x0000000000400000-0x00000000016A8E52-memory.dmp

      Filesize

      18.7MB

    • memory/4112-65-0x0000000000400000-0x00000000016A8E52-memory.dmp

      Filesize

      18.7MB

    • memory/4112-67-0x0000000000400000-0x00000000016A8E52-memory.dmp

      Filesize

      18.7MB

    • memory/4432-14-0x0000000000400000-0x00000000016A8E52-memory.dmp

      Filesize

      18.7MB

    • memory/4432-12-0x0000000000400000-0x00000000016A8E52-memory.dmp

      Filesize

      18.7MB