Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

85782863a1...cs.exe

windows7-x64

7

85782863a1...cs.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    151s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/05/2024, 07:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe

  • Size

    4.1MB

  • MD5

    85782863a1699d9dba449b7affd51940

  • SHA1

    9e7bebb2e5bab28250683d15a6d30c572ee2f0f7

  • SHA256

    b1a6c4faf48eb2d00355d976c3314d8cfd16408799c2411cb440d7ffd59f60b7

  • SHA512

    f1e228709a95970e48b95bf26499899537e482d300d6193ada57077501615becae8b283c7ee0b192a0dc31b92319a8028f2d84d865bd19b869d50863370d5146

  • SSDEEP

    98304:+R0pI/IQlUoMPdmpSp34ADtnkgvNWlw6aTfN41v:+R0pIAQhMPdm05n9klRKN41v

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\85782863a1699d9dba449b7affd51940_NeikiAnalytics.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2332
    • C:\UserDotW2\xoptiloc.exe
      C:\UserDotW2\xoptiloc.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:4244
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3844 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:1088

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\KaVB3E\optidevsys.exe
      Filesize

      2KB

      MD5

      75ce4e8c53f9b6806ac1eb9333389f45

      SHA1

      d1bda301f8ae47d55344588ed4a41c720ce6cc09

      SHA256

      125b5a9aa572a1070c03f3b83132f9e06b5bb82e5c000611e06a74e30ea4cf15

      SHA512

      b97e02a2f3b8e866cd1b872e369bf45c8c5a571bba9b4c1cb0798c76dd158e0c2ea0d76112eda77efb805b72b9c6717ef4bb14b7ae168f58c76a56afdf517cc1

      Download Submit

    • C:\UserDotW2\xoptiloc.exe
      Filesize

      4.1MB

      MD5

      a676ec79468b70c12c7bd73368b482c0

      SHA1

      15682154c6253c4ef66daff3e957d7938fb0824f

      SHA256

      9dc1923f40c6f7b00fe0682dbfa87a2e462254da589935284de9568aa9747031

      SHA512

      9dbf9520ecebf468b601f4c164e398a26c94745d9574c146ea8066b79743204b58d4bdc505e0827f74da126a9be75e67f7d8aa0e64e2c8321f103a278382b582

      Download Submit

    • C:\Users\Admin\253086396416_10.0_Admin.ini
      Filesize

      206B

      MD5

      8d977e7f46711ad77158f1d241ab7f25

      SHA1

      6e23c75ad058d8c249e19490c768e8ebe7883f47

      SHA256

      f1d57013781c5ef36a26a94be4563228d1c9e3dfef75a11768e03a9be211787f

      SHA512

      a414a1d6690040b93f3ca6f3012e1d66bb8dae8eb77c52fc255241ffadca5613c74f25747e7881b28a9b5c95805cdbe882507befa9d3f02b6cb859008714db62

      Download Submit