Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    17/05/2024, 09:28

General

  • Target

    e7562ac25264d3aa1a2c9fce91578660_NeikiAnalytics.exe

  • Size

    29KB

  • MD5

    e7562ac25264d3aa1a2c9fce91578660

  • SHA1

    6a73d29ac694393a0c867bb8747ff91828707eed

  • SHA256

    1d45e730660c6762765b63fa5fd83ae9e0bf9dbfda451cc66217b4677e659954

  • SHA512

    4204781434f8bd671762597f91499ed9e68ab9900e473a66ee1d23d8d9a6369d0d59713e4aeab343721b7bee12c9fbcff548d8fcf98dde021cd53ae9fe9002c1

  • SSDEEP

    768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/6:AEwVs+0jNDY1qi/qy

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 28 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Modifies system certificate store 2 TTPs 9 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e7562ac25264d3aa1a2c9fce91578660_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\e7562ac25264d3aa1a2c9fce91578660_NeikiAnalytics.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:2796
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:1932

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    7b9f9d8f3e70615116a0f730786fc13a

    SHA1

    f715ae1aea0c08b9d4465880b6c77b89133a542e

    SHA256

    30bf6feb1b6144e2a1b969a0505a524506ec99b1d9ae1ee1eed6597a63d0fe04

    SHA512

    8c2c731f7d50cf06885e899558ee035669c082068c4e682f85c8186a4290848ce84f1ff62bb9510ab6fcacf4db40e7dd375249bee471ea73c3ecc26c6968773c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    94afb625bbcb7befe71d2438ad90f539

    SHA1

    c26db6b6acb2b6d477d1c83394383590b0874910

    SHA256

    cca1c8769133b92920901aae33eeb7b18976dc24368ef1725b4c5da57144833b

    SHA512

    f48b8fff9d97decfbbcffb5c561dd2668962b18e820d7cca1f82b18f77313a6de72c26e0a91c82106a9e2a4ed298de8c843ff041a4fdfacb4008a1a2556e5ffe

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    a9f8edde8f98f7834eb7ea4996747c71

    SHA1

    f303a1ed204e9b62e763b5f58b2f70f0d7d7d63c

    SHA256

    8e6d19dcbdbb5013a1288f565606117926eb13a941184e1ef3c5776c31a7dc17

    SHA512

    908d61d58a68812b78623cdeaf114de64713d0cb93939031de3781112c2c8d170ac6b08eb084add960d5fec229d2f4d8da77ba0ddb936ca3554f6a97ffcafdc9

  • C:\Users\Admin\AppData\Local\Temp\TVbqjvjs3p.log

    Filesize

    288B

    MD5

    0729a09a916fd8f56caf831fd1bc219d

    SHA1

    34f908b94769fb331d14bba91102999968676a1e

    SHA256

    087792a8c65bb46529c00108258f2170206a905709e843dbadfe05b663dce35f

    SHA512

    ed67e98da015a52f190c3c5ce2728c08af4373a8a2eb81490b6d93c79d687fc305bf2ee154f1387aed3fa44ff6dcd375b4e5d184ceb278c160caae5a30c12ddc

  • C:\Users\Admin\AppData\Local\Temp\Tar4B24.tmp

    Filesize

    177KB

    MD5

    435a9ac180383f9fa094131b173a2f7b

    SHA1

    76944ea657a9db94f9a4bef38f88c46ed4166983

    SHA256

    67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

    SHA512

    1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

  • C:\Users\Admin\AppData\Local\Temp\tmp4FB6.tmp

    Filesize

    29KB

    MD5

    6fc8eab64370754d259786c34462fc4e

    SHA1

    dfa87600087f420866ec1f0a48b18994dff1059d

    SHA256

    a006514c66d4b4e67b685d8cd54131d58a273c52295ef577c6bfcab4dafc8108

    SHA512

    8f24e36e805d278a95e60c74ca2c80bc124c98282ed2083aae9a9c18ff3c8d3069c308a04f654d18451cb194d18d1af5d5fb125e0bffb3abb7868819f83e6664

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    320B

    MD5

    3eaa66ac4d890bc5b1e86bcc28140622

    SHA1

    4b5076bf63c50902c5d7326fda6a2c54f489c215

    SHA256

    f89f6fe791e1cd5eb4c5d69107fc53bcb094b5bf385699100c7674314c220f36

    SHA512

    69ed8e3695a75241d108225b3d3357b92448b454074729c4d0be641c8e2527b5c8bfd15df46b4ac1ec9ab6897f9cf5931c8d317352c8753a84e702a05adc9de0

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    320B

    MD5

    2dccfa5e40685b9acf7c7bd2146f1d33

    SHA1

    952201fe81bf18f5bd0fca5eb2a51a8ac093b9a0

    SHA256

    d9f900ca5dc5a9bf67343288e7655da365770a8395f5649b1d90ab91d9085f19

    SHA512

    ff2055b2323d505caf2d69883e6d8c91b01a0001695f99990c5ce38f862e022fbc2a129eaa0f86603eeebdcdf43da32e35429ed05989175e30a09491b6f6b2ee

  • C:\Windows\services.exe

    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • memory/1932-80-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1932-40-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1932-11-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1932-42-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1932-35-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1932-30-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1932-28-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1932-82-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1932-64-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1932-18-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1932-68-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1932-23-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1932-70-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1932-87-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1932-75-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2796-63-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2796-0-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2796-81-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2796-79-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2796-74-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2796-69-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2796-67-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2796-17-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2796-10-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2796-41-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2796-4-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB