Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    25/05/2024, 22:49

General

  • Target

    2eb0b4a864d1e4702577dfedf90f6070_NeikiAnalytics.exe

  • Size

    134KB

  • MD5

    2eb0b4a864d1e4702577dfedf90f6070

  • SHA1

    8095c823a67b042433024baa17d602d90bab1336

  • SHA256

    08ef7719581bf44f5ef88d689d78a6346b5eac02f446840dfd87a57e4d938ad2

  • SHA512

    1dd755e1d89d9729299a7c7645dd5252731a62994a5856d17d38f6bf1bfeaba97f20916d0e34192cc02e92e4955cbc481eabade4a95f2031945b54f20fcf9b54

  • SSDEEP

    1536:rF0AJELopHG9aa+9qX3apJzAKWYr0v7ioy6paK2AZqMIK7aGZh38Qmo:riAyLN9aa+9U2rW1ip6pr2At7NZuQmo

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2eb0b4a864d1e4702577dfedf90f6070_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\2eb0b4a864d1e4702577dfedf90f6070_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2756
    • C:\ProgramData\Update\WwanSvc.exe
      "C:\ProgramData\Update\WwanSvc.exe" /run
      2⤵
      • Executes dropped EXE
      PID:1260

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \ProgramData\Update\WwanSvc.exe

    Filesize

    134KB

    MD5

    26b09ef025a697bd02585dc37b35fa6b

    SHA1

    b26988bd5080b13fa4192e887622d2ca1953c028

    SHA256

    8947214b26fe104b3cf17f0b0de07c4c7f98e523881269bef59e147a7c3bac8a

    SHA512

    0820da9b9a8573f9529747c91915ee76a6a52dae04235d849e3317997c9978d2963e978f4d5486abb350924e5e580a17e7ca7e9b00be79795816c63740c52f38

  • memory/1260-6-0x0000000000E60000-0x0000000000E88000-memory.dmp

    Filesize

    160KB

  • memory/1260-8-0x0000000000E60000-0x0000000000E88000-memory.dmp

    Filesize

    160KB

  • memory/2756-1-0x00000000008B0000-0x00000000008D8000-memory.dmp

    Filesize

    160KB

  • memory/2756-7-0x00000000000F0000-0x0000000000118000-memory.dmp

    Filesize

    160KB

  • memory/2756-9-0x00000000008B0000-0x00000000008D8000-memory.dmp

    Filesize

    160KB