Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

d60b961bf7...cs.exe

windows7-x64

7

d60b961bf7...cs.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d60b961bf73c627a142d356c39251b10_NeikiAnalytics.exe

  • Size

    455KB

  • Sample

    240517-jvl91sgh43

  • MD5

    d60b961bf73c627a142d356c39251b10

  • SHA1

    27a4c03c98741ca88b43a6a0418a3d54a54f5397

  • SHA256

    f815c67aa874e065868c8eb1f330dd150ffe8187e314d86daee5cccd1e88fffb

  • SHA512

    10f7223aef6fefff68dd02217e86ba43e18b2cfa11acff9a78231b30639ba0a16f0c0f436fc519ed25df4c19446e3c7c6a6aa92dbe6c126a093f0f5ec8d8cdf0

  • SSDEEP

    6144:mBapC9DUIYmO5Kv5Q7X/l/rYvkW1VxxfnzrV9UAH0ctkPfc92F85LpIh9jil:5pQD+mO5KWy/zrVbt4fcY29U9jI

Score
7/10
persistence

Malware Config

Targets

    • Target

      d60b961bf73c627a142d356c39251b10_NeikiAnalytics.exe

    • Size

      455KB

    • MD5

      d60b961bf73c627a142d356c39251b10

    • SHA1

      27a4c03c98741ca88b43a6a0418a3d54a54f5397

    • SHA256

      f815c67aa874e065868c8eb1f330dd150ffe8187e314d86daee5cccd1e88fffb

    • SHA512

      10f7223aef6fefff68dd02217e86ba43e18b2cfa11acff9a78231b30639ba0a16f0c0f436fc519ed25df4c19446e3c7c6a6aa92dbe6c126a093f0f5ec8d8cdf0

    • SSDEEP

      6144:mBapC9DUIYmO5Kv5Q7X/l/rYvkW1VxxfnzrV9UAH0ctkPfc92F85LpIh9jil:5pQD+mO5KWy/zrVbt4fcY29U9jI

    Score
    7/10
    persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks