Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

babdd706c9...cs.exe

windows7-x64

7

babdd706c9...cs.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/05/2024, 09:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    babdd706c9bd2403865f38b8c6223030_NeikiAnalytics.exe

  • Size

    2.7MB

  • MD5

    babdd706c9bd2403865f38b8c6223030

  • SHA1

    1d4c0daf19e8dd6600bd1a4a9de3a07bc01a23de

  • SHA256

    42ce927a9cc27c12509ec7a973cbb733a3f1267d2640f69d6fe931d3a134eb0d

  • SHA512

    564fee5c56d4c0988fa3518a64caf213138cdf1c73dee0f32cbf12065f8003f7c242ed5acc38b8bb1c22f3d3643f240e15443a9c00dbffdafd98624525a6d78d

  • SSDEEP

    49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBH9w4Sx:+R0pI/IQlUoMPdmpSpT4

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\babdd706c9bd2403865f38b8c6223030_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\babdd706c9bd2403865f38b8c6223030_NeikiAnalytics.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:744
    • C:\UserDotEK\abodsys.exe
      C:\UserDotEK\abodsys.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:3924
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4184,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:8
    1⤵
      PID:4856

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\MintZS\optixec.exe
      Filesize

      2.7MB

      MD5

      2dcd5d91345965794018be6e02d3e63b

      SHA1

      d7d652dac543120e6627c8ca806ebed4a5b0384d

      SHA256

      ca43d883625fd2af61cc0952c06106abcc0e5743a55ff3c4c7d69dc716994595

      SHA512

      07075aeaed36f0b77a1e1fe4fbe0c1fbd98eb7c38f70be5ecd5108d53daad4854999054b41589f31b2f15593ec852f7877ff2f89760cedb553b5bbfa74959ee0

      Download Submit

    • C:\UserDotEK\abodsys.exe
      Filesize

      2.7MB

      MD5

      dbd572b108e97c01128a8530d75ec0ca

      SHA1

      dc33d16862f643b1ee6b5fce6ebe23345aaaa175

      SHA256

      09fc88d04ba4532ab5b4d1bce847081fd10d2e938c51cbb55f30049680ed6605

      SHA512

      56b2cf001ac542d3a723a89c5304ca9a00fbe606d03448e7e2822b231885eea9e3da97c0814ffc9df0369bc97ca532b573ea7355b795bf848323e02bb14036a5

      Download Submit

    • C:\Users\Admin\253086396416_10.0_Admin.ini
      Filesize

      205B

      MD5

      1a880686f071e9056eed52465f7798ef

      SHA1

      d10d3e9f1d078594ec4d889a5cd609e14a5741d6

      SHA256

      de60a2cf877a813578fff525822e018afd757a519d4309c2874ebbeff9d31e07

      SHA512

      759a06a94739c2d688b6db425f1144f615f9067665ab4f5d4f50c2b12a57b7aeedf3b8e713abcbdd862f7548321da2160402a3783bf66c3c764a0aeba7b351e5

      Download Submit