Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/05/2024, 17:55

General

  • Target

    07704c1a03e952203f10467bf06476e0_NeikiAnalytics.exe

  • Size

    408KB

  • MD5

    07704c1a03e952203f10467bf06476e0

  • SHA1

    dc21b7371e89883f24b9e798c3b02e4d05422385

  • SHA256

    9e18f0e99ea01b623bd428f89d31ac6589baa9873d6cdfbcb7dc401275bc274d

  • SHA512

    e8b8476822d84262337de361186168ee91e12b092b1df4f7d80abc8c15ace1de57442d2113120bc65624d8ed7bc438e4fcc8c5cfc3cbd8b18f7d09972b060162

  • SSDEEP

    6144:4jlYKRF/LReWAsUyxCrImuPkHXD0xjPi6Q8qF3QavYOktyRh4zU/y6dHX7LZqiVs:4jauDReWLh+6Q815yXbdH/zVMx0spF

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\07704c1a03e952203f10467bf06476e0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\07704c1a03e952203f10467bf06476e0_NeikiAnalytics.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4504
    • C:\ProgramData\mjdfi.exe
      "C:\ProgramData\mjdfi.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:3476

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Documents and Settings .exe

    Filesize

    408KB

    MD5

    355799f1b2f78cfd63f3a1a33ed8baae

    SHA1

    902b05946f8a2d40e843fe6292b3453d7899a135

    SHA256

    b1d079ed0f9d4eebbfaacd1185a1d3660f4492385c347125ad94d3a42a3bda16

    SHA512

    67ac4475d4e7f4338dac0af912f507cc34be53080b3e800b71beda76d094ed25d55859411b2ff9f2247c1cbf79ffb007d6c08535a905cc833b223aa6e4917f80

  • C:\ProgramData\Saaaalamm\Mira.h

    Filesize

    136KB

    MD5

    cb4c442a26bb46671c638c794bf535af

    SHA1

    8a742d0b372f2ddd2d1fdf688c3c4ac7f9272abf

    SHA256

    f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25

    SHA512

    074a31e8da403c0a718f93cbca50574d8b658921193db0e6e20eacd232379286f14a3698cd443dc740d324ad19d74934ae001a7ad64b88897d8afefbc9a3d4e3

  • C:\ProgramData\mjdfi.exe

    Filesize

    271KB

    MD5

    94217a60668cf8efd9c1f5575cca13c7

    SHA1

    199411b0ab205bf3117fe02109d83f995eacb6eb

    SHA256

    3b2902a0a50b33efdec5d1dcb44d6aafd5f64e1fe4324b7c2349c9636e8c10a5

    SHA512

    59299bb7b144eafcc7849b5955193c20dafded63acbb14ed26e78da605fda6c7cca8236784d4bf664df2b2ec75f6f5cb419196d7de28b94f77756cd6462c5fb5

  • memory/3476-130-0x0000000000400000-0x0000000000448000-memory.dmp

    Filesize

    288KB

  • memory/4504-0-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

  • memory/4504-1-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

  • memory/4504-10-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB