Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    24/05/2024, 21:02

General

  • Target

    8791e6d033c60f741742263243416ae0_NeikiAnalytics.exe

  • Size

    408KB

  • MD5

    8791e6d033c60f741742263243416ae0

  • SHA1

    518214cdc0ab7e34355f81b783ac34825711138e

  • SHA256

    757bb52277053fa8ec38e35e1d8d61f848b3cb98052f9b83ab7beef6764c5141

  • SHA512

    77908b64b0a7f3beef34cedcf8c3d67dfc430347682fdddb8e0366c6ec23c63806cb8511d15f87cbaa147913ced6757658a4812ade7447474ef02731bd8e1759

  • SSDEEP

    6144:4jlYKRF/LReWAsUymUvi1VJp6nrrtAujCcd2i6MkU6sHR8VckeknCHBi0QLN4:4jauDReWoUa1VJEZ/acOCHBi0Qq

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8791e6d033c60f741742263243416ae0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\8791e6d033c60f741742263243416ae0_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2424
    • C:\ProgramData\dnvxyn.exe
      "C:\ProgramData\dnvxyn.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:2108

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\MSOCache .exe

    Filesize

    408KB

    MD5

    1105f58959bf73878e6b7b727ef80075

    SHA1

    808e65d4b9f7dd6a25e52b845a423660fa95ef94

    SHA256

    3f636d80cfcc608475e2fb89123350c49853483bde541f7de8346feb616d5b95

    SHA512

    331b87b3a628301b3d8c5fc7f90733ade733308fd7ac9570e8f6b217344f568d7d4404a3e8946ba42784f970382fa0c7afc6d471d5ef426dbef7a8c1fdc14381

  • C:\ProgramData\Saaaalamm\Mira.h

    Filesize

    136KB

    MD5

    cb4c442a26bb46671c638c794bf535af

    SHA1

    8a742d0b372f2ddd2d1fdf688c3c4ac7f9272abf

    SHA256

    f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25

    SHA512

    074a31e8da403c0a718f93cbca50574d8b658921193db0e6e20eacd232379286f14a3698cd443dc740d324ad19d74934ae001a7ad64b88897d8afefbc9a3d4e3

  • \ProgramData\dnvxyn.exe

    Filesize

    271KB

    MD5

    56880d7d241a6137c0ed2d5893c6af1d

    SHA1

    1a4d35a824bac78ad625ca97d50fd7b406d02761

    SHA256

    05571d347095f56d6e06c78d387841e8e962593da2a66601765ed3424849981a

    SHA512

    cc806e9d2cfee76541970f0082e1e600cec89c7e1941f488df944e1132fdf6f8bff62aa06b819ad16a5b69541e779bd9c8aebc41255dc80d98c13672fdf546bd

  • memory/2108-131-0x0000000000400000-0x0000000000448000-memory.dmp

    Filesize

    288KB

  • memory/2424-0-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

  • memory/2424-1-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

  • memory/2424-12-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB