Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    103s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/05/2024, 10:10

General

  • Target

    e8b2d328bb6cc3f37cf13c74428de960_NeikiAnalytics.exe

  • Size

    904KB

  • MD5

    e8b2d328bb6cc3f37cf13c74428de960

  • SHA1

    8037d0f3a63d0b8d53d107a691d7643a7107de84

  • SHA256

    607aea4a37d9249900c473ffb13d16eb688b95c10ca2ab9cd192c729fe0488d1

  • SHA512

    253af489077e73777c1bb878d230c0f8e558f4e644c347d7c9efeb309e54f68a8cf99684875c1b209dd056319122ce51bbf5b580056b1e936fba5aafb9f68731

  • SSDEEP

    12288:9n8yN0Mr8ti6aVArIygU40vy3W/ceKSHMsiFyY6XNm0FrSNPUZ6RwQv:FPutiz0fDjymk4HM5yJmaiP0Qv

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 8 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 32 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e8b2d328bb6cc3f37cf13c74428de960_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\e8b2d328bb6cc3f37cf13c74428de960_NeikiAnalytics.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:228
    • C:\Users\Public\Microsoft Build\Isass.exe
      "C:\Users\Public\Microsoft Build\Isass.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:1188
    • C:\Users\Public\Microsoft Build\Isass.exe
      "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\e8b2d328bb6cc3f37cf13c74428de960_NeikiAnalytics.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4632
      • C:\Users\Admin\AppData\Local\Temp\e8b2d328bb6cc3f37cf13c74428de960_NeikiAnalytics.exe
        "C:\Users\Admin\AppData\Local\Temp\e8b2d328bb6cc3f37cf13c74428de960_NeikiAnalytics.exe"
        3⤵
        • Checks computer location settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1028
        • C:\Users\Public\Microsoft Build\Isass.exe
          "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\e8b2d328bb6cc3f37cf13c74428de960_NeikiAnalytics.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2068
          • C:\Users\Admin\AppData\Local\Temp\e8b2d328bb6cc3f37cf13c74428de960_NeikiAnalytics.exe
            "C:\Users\Admin\AppData\Local\Temp\e8b2d328bb6cc3f37cf13c74428de960_NeikiAnalytics.exe"
            5⤵
            • Checks computer location settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:3692
            • C:\Users\Public\Microsoft Build\Isass.exe
              "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\e8b2d328bb6cc3f37cf13c74428de960_NeikiAnalytics.exe
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:3128
              • C:\Users\Admin\AppData\Local\Temp\e8b2d328bb6cc3f37cf13c74428de960_NeikiAnalytics.exe
                "C:\Users\Admin\AppData\Local\Temp\e8b2d328bb6cc3f37cf13c74428de960_NeikiAnalytics.exe"
                7⤵
                • Checks computer location settings
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:1432
                • C:\Users\Public\Microsoft Build\Isass.exe
                  "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\e8b2d328bb6cc3f37cf13c74428de960_NeikiAnalytics.exe
                  8⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:3460
                  • C:\Users\Admin\AppData\Local\Temp\e8b2d328bb6cc3f37cf13c74428de960_NeikiAnalytics.exe
                    "C:\Users\Admin\AppData\Local\Temp\e8b2d328bb6cc3f37cf13c74428de960_NeikiAnalytics.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:1588
                    • C:\Windows\Temp\{02942DB7-F026-46AC-B204-2DC7F825EF06}\.cr\e8b2d328bb6cc3f37cf13c74428de960_NeikiAnalytics.exe
                      "C:\Windows\Temp\{02942DB7-F026-46AC-B204-2DC7F825EF06}\.cr\e8b2d328bb6cc3f37cf13c74428de960_NeikiAnalytics.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\e8b2d328bb6cc3f37cf13c74428de960_NeikiAnalytics.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:1596

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe

    Filesize

    719KB

    MD5

    07f2eaccf60e8bb5c32566f059bdfd7d

    SHA1

    e3ac67f609abe2532c9e42531b95c35b1f9ac473

    SHA256

    311f4626199b716520215f01bf3296069c80d1b16f52b81fc0b7b643509d6178

    SHA512

    f74e169df8b7bfc78017bfed5071916d5af96435f2b06802d905bbc1f026a9df3618ba0baa4f52c5d7fcb3b26c6a321ea6c3a7b1a74e1aed0e67f08fd25b1a50

  • C:\Users\Admin\AppData\Local\Temp\e8b2d328bb6cc3f37cf13c74428de960_NeikiAnalytics.exe

    Filesize

    635KB

    MD5

    b73be38096eddc4d427fbbfdd8cf15bd

    SHA1

    534f605fd43cc7089e448e5fa1b1a2d56de14779

    SHA256

    ab1164dcaf6c7d7d4905881f332a7b6f854be46e36b860c44d9eedc96ab6607a

    SHA512

    5af779926d344bc7c4140725f90cddad5eb778f5ca4856d5a31a6084424964d205638815eab4454e0ea34ea56fafca19fadd1eb2779dc6b7f277e4e4ce4b1603

  • C:\Users\Public\Microsoft Build\Isass.exe

    Filesize

    211KB

    MD5

    9dabf3f974aa5b00955e2f005c4fd798

    SHA1

    d160ec1b6ce83c79dc28e36cbae969e2b19c2440

    SHA256

    ec83b2ba1279671f41343938d2664287b693c43ff2b4e02ad5858473fe6070eb

    SHA512

    b493b2d23b38cdc1cacc053b952609846f313a82f6c5d51b911bea7902553475d491853ca5dcf9606a06a5c2b4ba6ae7d203babbe80a6280380d711dc77e0769

  • C:\Windows\Temp\{517BA9A2-14E4-456B-A1C8-46613ECEC350}\.ba\logo.png

    Filesize

    1KB

    MD5

    d6bd210f227442b3362493d046cea233

    SHA1

    ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

    SHA256

    335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

    SHA512

    464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

  • C:\Windows\Temp\{517BA9A2-14E4-456B-A1C8-46613ECEC350}\.ba\wixstdba.dll

    Filesize

    191KB

    MD5

    eab9caf4277829abdf6223ec1efa0edd

    SHA1

    74862ecf349a9bedd32699f2a7a4e00b4727543d

    SHA256

    a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

    SHA512

    45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

  • memory/228-4-0x0000000000400000-0x00000000016A8000-memory.dmp

    Filesize

    18.7MB

  • memory/228-9-0x0000000000400000-0x00000000016A8000-memory.dmp

    Filesize

    18.7MB

  • memory/1028-12-0x0000000000400000-0x00000000016A8000-memory.dmp

    Filesize

    18.7MB

  • memory/1188-85-0x0000000000400000-0x00000000016A8000-memory.dmp

    Filesize

    18.7MB

  • memory/1188-82-0x0000000000400000-0x00000000016A8000-memory.dmp

    Filesize

    18.7MB

  • memory/1188-119-0x0000000000400000-0x00000000016A8000-memory.dmp

    Filesize

    18.7MB

  • memory/1188-118-0x0000000000400000-0x00000000016A8000-memory.dmp

    Filesize

    18.7MB

  • memory/1188-101-0x0000000000400000-0x00000000016A8000-memory.dmp

    Filesize

    18.7MB

  • memory/1188-128-0x0000000000400000-0x00000000016A8000-memory.dmp

    Filesize

    18.7MB

  • memory/1188-140-0x0000000000400000-0x00000000016A8000-memory.dmp

    Filesize

    18.7MB

  • memory/1188-8-0x0000000001B50000-0x0000000001B51000-memory.dmp

    Filesize

    4KB

  • memory/1188-108-0x0000000000400000-0x00000000016A8000-memory.dmp

    Filesize

    18.7MB

  • memory/1188-127-0x0000000000400000-0x00000000016A8000-memory.dmp

    Filesize

    18.7MB

  • memory/1188-107-0x0000000000400000-0x00000000016A8000-memory.dmp

    Filesize

    18.7MB

  • memory/1188-86-0x0000000000400000-0x00000000016A8000-memory.dmp

    Filesize

    18.7MB

  • memory/1188-87-0x0000000000400000-0x00000000016A8000-memory.dmp

    Filesize

    18.7MB

  • memory/1188-5-0x0000000000400000-0x00000000016A8000-memory.dmp

    Filesize

    18.7MB

  • memory/1188-91-0x0000000000400000-0x00000000016A8000-memory.dmp

    Filesize

    18.7MB

  • memory/1188-92-0x0000000000400000-0x00000000016A8000-memory.dmp

    Filesize

    18.7MB

  • memory/1188-97-0x0000000000400000-0x00000000016A8000-memory.dmp

    Filesize

    18.7MB

  • memory/1432-22-0x0000000000400000-0x00000000016A8000-memory.dmp

    Filesize

    18.7MB

  • memory/2068-15-0x0000000000400000-0x00000000016A8000-memory.dmp

    Filesize

    18.7MB

  • memory/2068-17-0x0000000000400000-0x00000000016A8000-memory.dmp

    Filesize

    18.7MB

  • memory/3128-20-0x0000000000400000-0x00000000016A8000-memory.dmp

    Filesize

    18.7MB

  • memory/3460-33-0x0000000000400000-0x00000000016A8000-memory.dmp

    Filesize

    18.7MB

  • memory/3692-19-0x0000000000400000-0x00000000016A8000-memory.dmp

    Filesize

    18.7MB

  • memory/4632-10-0x0000000000400000-0x00000000016A8000-memory.dmp

    Filesize

    18.7MB

  • memory/4632-11-0x0000000000400000-0x00000000016A8000-memory.dmp

    Filesize

    18.7MB