Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

39bee9f9c8...cs.exe

windows7-x64

8

39bee9f9c8...cs.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    39bee9f9c8955c18845557c32883745a61ca95a64c01a1876f711f02d6101baa_NeikiAnalytics

  • Size

    284KB

  • Sample

    240521-mwr4faag9s

  • MD5

    b0b328d93eb4006ef6a025f6933c99e0

  • SHA1

    22630767616437241403c51e94888c0c163c8c2e

  • SHA256

    39bee9f9c8955c18845557c32883745a61ca95a64c01a1876f711f02d6101baa

  • SHA512

    8d5735ad490f71d2766e6cd8aea73765c14c38ab3bdfbdc040df2867c5bc19622ce2333d1ebb333f94d3d56d0f001638329b32389de2ff5d3608d382f3d7af05

  • SSDEEP

    3072:KSQ0EWVwZhKxC5Rt+k60Zh+qw6PYSsszfHZTZJ2lu:KPA6wxmuJspr2l

Score
8/10
persistenceupx

Malware Config

Targets

    • Target

      39bee9f9c8955c18845557c32883745a61ca95a64c01a1876f711f02d6101baa_NeikiAnalytics

    • Size

      284KB

    • MD5

      b0b328d93eb4006ef6a025f6933c99e0

    • SHA1

      22630767616437241403c51e94888c0c163c8c2e

    • SHA256

      39bee9f9c8955c18845557c32883745a61ca95a64c01a1876f711f02d6101baa

    • SHA512

      8d5735ad490f71d2766e6cd8aea73765c14c38ab3bdfbdc040df2867c5bc19622ce2333d1ebb333f94d3d56d0f001638329b32389de2ff5d3608d382f3d7af05

    • SSDEEP

      3072:KSQ0EWVwZhKxC5Rt+k60Zh+qw6PYSsszfHZTZJ2lu:KPA6wxmuJspr2l

    Score
    8/10
    persistenceupx

    • Adds policy Run key to start application

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks