Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/05/2024, 05:10

General

  • Target

    b0814a8ec88c3899fcaf1866366bda30_NeikiAnalytics.exe

  • Size

    111KB

  • MD5

    b0814a8ec88c3899fcaf1866366bda30

  • SHA1

    87972e2ca2b6d84eee09e6c02c11fd8c9505316d

  • SHA256

    b1b7ecf581cdf7b2c62274ea92c36b8efcc296b81e9b256e8c92ba37b687e6f0

  • SHA512

    f0b2b6da35abb42e9ae2e6f4470f03c04a8215ecd4faf5955cf1dc0cd25b64a31e4fae521fc8f0124a011767ab90e524bad3fe66fa7a1dc2c1ad085c29e63539

  • SSDEEP

    1536:ELNIW39SaZTbFARlq7jC1OZstZu0TSVEdUJWTWd18fw:ELlbZTZX3BAtTSVEdUJWTWd18fw

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b0814a8ec88c3899fcaf1866366bda30_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\b0814a8ec88c3899fcaf1866366bda30_NeikiAnalytics.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2864
    • C:\ProgramData\Graphics\guifx.exe
      "C:\ProgramData\Graphics\guifx.exe" /run
      2⤵
      • Executes dropped EXE
      PID:3116
    • C:\windows\SysWOW64\cmd.exe
      "C:\windows\system32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\b0814a8ec88c3899fcaf1866366bda30_NeikiAnalytics.exe" >> NUL
      2⤵
        PID:1000

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\Graphics\guifx.exe

      Filesize

      111KB

      MD5

      52521eb770588a51b00539bebd6bb19c

      SHA1

      56d3604a317dcd7219e05711939a1ab3e173e840

      SHA256

      43ec1ccd61919c190fe8768336f9e34a0f8ba1719048b09dbeee105b468d1b67

      SHA512

      2ec5d0644c9f5c4c65e700872e1be56a77b8020e5306803429ab0996ce411a31c6e8c03fec7cff55a12b44f837345f28de0a9708d205a697bb514477c0a642d4

    • memory/2864-0-0x0000000000160000-0x000000000017C000-memory.dmp

      Filesize

      112KB

    • memory/2864-6-0x0000000000160000-0x000000000017C000-memory.dmp

      Filesize

      112KB

    • memory/2864-8-0x0000000000160000-0x000000000017C000-memory.dmp

      Filesize

      112KB

    • memory/3116-4-0x0000000000EB0000-0x0000000000ECC000-memory.dmp

      Filesize

      112KB

    • memory/3116-7-0x0000000000EB0000-0x0000000000ECC000-memory.dmp

      Filesize

      112KB