Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/05/2024, 19:14

General

  • Target

    194573521d4ff5c862e2948cf8309f30_NeikiAnalytics.exe

  • Size

    53KB

  • MD5

    194573521d4ff5c862e2948cf8309f30

  • SHA1

    25ed2e52d574c80f013db1a81340a245ac5ceed0

  • SHA256

    a4a268dc72d8ac288d6c621fc2b5f5507b907925af103fdd76d5e180ff119de6

  • SHA512

    86179ebfce8bad584bc83734c5ea95417f6c031c773aeffa0d24f54158fedb3be141b5ba04cf2f737c66951f3dc5de6082726a97a1ee19c340be0c2919dfb241

  • SSDEEP

    1536:vNhg8r8QHkwp+2/7Kp3StjEMjmLM3ztDJWZsXy4JzxPME:fkwp/JJjmLM3zRJWZsXy4JN

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\194573521d4ff5c862e2948cf8309f30_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\194573521d4ff5c862e2948cf8309f30_NeikiAnalytics.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:212
    • C:\Users\Admin\vouexom.exe
      "C:\Users\Admin\vouexom.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3104

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\vouexom.exe

    Filesize

    53KB

    MD5

    2e9f13ed1275bbba9acf8f260f01084a

    SHA1

    8c13957100825d263ac6eec20c267b46ce4fbb56

    SHA256

    3cb9065efa11f5561842ff3a69237f5523d0fefb453ead81823f546e6336d9f7

    SHA512

    83304cdfb1b63248407d6661ffc862dab35c09c21eb28ac8d4448398d0050a50fb52d5b5fe19982c34d207113564b35cd52bd96d183b699485aed212e22403d9

  • memory/212-0-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/3104-34-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB