Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

19221f0dd9...cs.exe

windows7-x64

10

19221f0dd9...cs.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/05/2024, 18:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe

  • Size

    40KB

  • MD5

    19221f0dd9766ba9f9361f52447f6d20

  • SHA1

    26ba3de7e0a5c6bf4efbd3da45a5209dc253fc59

  • SHA256

    c1477f99bf737702d1de157b752acc7b4989b78c1027dc4f109b77b7b076b312

  • SHA512

    50da9583935a2b5d3461c6cab13eb168f11f665925b569dda221d8e881171b8b4120d8fbccfb9dc6bcb209f70e0fbf70549e4cc179cf4fee3816bf135f2c1e2e

  • SSDEEP

    768:kvfko/XiYUsWEzQp8F9bdHXtHs7CQpcdHoCCvc:kEKZWm+8F95NWee1vc

Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1396
    • C:\Users\Admin\Admin.exe
      "C:\Users\Admin\Admin.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2952

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\Admin.exe
    Filesize

    40KB

    MD5

    749a621f1e590d41aa0cd0db05921390

    SHA1

    5345bea7a2daac7085131d6279af71fdaebd91de

    SHA256

    f06840f2545cb1c00cf871b42fc11cc0b328e1ed0bfccee0279b03754fbe0352

    SHA512

    5213534640766eb72afb0a436029fc7ad1f7835db39d2472d854fd5b5a3295c4b8dfcf38fac77f8651082cba43e0677e92390622da37bb57512748ca71ea3524

    Download Submit