Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/05/2024, 12:39

General

  • Target

    d25fa79d16af84d3f61d66936f02ac90_NeikiAnalytics.exe

  • Size

    25KB

  • MD5

    d25fa79d16af84d3f61d66936f02ac90

  • SHA1

    46cad828fed51ddfd3b919a6f5e2b231b32a6a8f

  • SHA256

    9f8a692f4795ea939d042c9914952b7c1782ab54d0f9c88c3fe4a60556be98a9

  • SHA512

    713decadafb32aa60502bd91e25290354fc821abcd7c76bc4dbeddfed3edcf8a919d9cfbbccb84fe0cb6b74f08f4d3c3bd8c8a4cd41a5c398b2d12f1111abcdb

  • SSDEEP

    384:0wznxkW5jElj3Jb7IdLEwcFq2jAiOCTJOcQTws61:lVE55/IqFq2s1EJO3j61

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d25fa79d16af84d3f61d66936f02ac90_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\d25fa79d16af84d3f61d66936f02ac90_NeikiAnalytics.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1892
    • C:\Users\Admin\AppData\Local\Temp\budha.exe
      "C:\Users\Admin\AppData\Local\Temp\budha.exe"
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      PID:2036

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\16B57FC6503CEF36CB8D6FED4FA2773A

    Filesize

    5B

    MD5

    5bfa51f3a417b98e7443eca90fc94703

    SHA1

    8c015d80b8a23f780bdd215dc842b0f5551f63bd

    SHA256

    bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

    SHA512

    4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\16B57FC6503CEF36CB8D6FED4FA2773A

    Filesize

    394B

    MD5

    a33c66a13068c5d88e86d5d35525b0fa

    SHA1

    e3bd70a92dcd883f265b15ef51a843ebb9e2bf9a

    SHA256

    7e94432b083b13a5d96be6dd7a6721035d32ceaa77f7e203f96c1cd7f935c8d8

    SHA512

    fb2c96f0b6b94550ef4d4c6acf2c5c1db9f5526209b04c059d720de451d7480953e4e747a8bd98c91f1c31acbdbe61b7c1c2f32930e538b97cf8a1187ba24d3b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\16B57FC6503CEF36CB8D6FED4FA2773A

    Filesize

    394B

    MD5

    a981ac3e65597663e351cc18f1813c43

    SHA1

    d72267467206384d1875108cdb046c61ba02a450

    SHA256

    c561fbfecd2e78be89e35fb9cb2c4bb2897b3f1d0c13d1852137e899c9719970

    SHA512

    bc78379f51345e352ccf719d4646ab7b04fcd4153c11c8665457f41bbcd8540ca282d0a87007a69860e0600c2cab9d76979dfe6ee82cb0c2af165fe392524b94

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\16B57FC6503CEF36CB8D6FED4FA2773A

    Filesize

    394B

    MD5

    a7e3ca02159bc735c16eef0e1aa5900b

    SHA1

    6ff971f37d97bf2814a197b601cba0ce59b4825c

    SHA256

    ad62dd69de759e22f779d46bd3bda783c7fffd8da197ca09194a5f265982951a

    SHA512

    a43ed625494ff57132977f991bb4431fa952cedb749d3db0b194f0c85ff736b8febfb94cdc6d99c70b59bbe5dde9378dcfcb5710cf1fe919435d5b4bb1b47896

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\16B57FC6503CEF36CB8D6FED4FA2773A

    Filesize

    394B

    MD5

    c201246d87f37dd0b3d4d242baf8019e

    SHA1

    0193f4b95ce3b0927ac1cf543bcbaaf1660f03d3

    SHA256

    5bb762dca0c2eeabf7d654f3795a381b47483c7d826dab6a7552dd928bb3f69e

    SHA512

    b66a5989c300ad0323e836db0111dbc509dbebd671917d35de7fa6f59ba5f8eac97bf4cdd34c3abf6ae49fb150fb9f4b35a9c34d6d0306ba432a8fcdb8eb8bbf

  • C:\Users\Admin\AppData\Local\Temp\budha.exe

    Filesize

    25KB

    MD5

    9060bfcd36ac991a4a875e5edaaa8b01

    SHA1

    5166823eb9c9a87869f6a16350e3551f193dc121

    SHA256

    faaeaf8a005698885a3c6f56d9ef626cab2a879a27338d9ac0a2de9d8554a331

    SHA512

    e99fd9409643fa65efb5d71e0817fcfb03f8fe2b16bcddaeece7b3490a498b473a068a3e604ce934aac83b1e65e1b33bf7e3d071841a9af14eeacb534550afed

  • memory/1892-2-0x0000000002160000-0x0000000002161000-memory.dmp

    Filesize

    4KB

  • memory/1892-3-0x0000000002830000-0x0000000002C30000-memory.dmp

    Filesize

    4.0MB

  • memory/1892-12-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/1892-0-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2036-13-0x00000000001F0000-0x00000000001F1000-memory.dmp

    Filesize

    4KB

  • memory/2036-152-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2036-14-0x0000000002610000-0x0000000002A10000-memory.dmp

    Filesize

    4.0MB