Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

0863e1268b...cs.exe

windows7-x64

7

0863e1268b...cs.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    26/05/2024, 14:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe

  • Size

    2.7MB

  • MD5

    0863e1268bf146972594281dfea8c840

  • SHA1

    162ae9c5144580aa6fb8911b0a418be6a4548c40

  • SHA256

    1c8399a59b5347641a665ed1744894ea9c513068740dc0f909ed6da7f6030e47

  • SHA512

    ef4c6cc62bf10a1e82b2867fb629dcbb44eef1f9f3dbaf8961921303f6bd6b7c07ad5796d2989bcd73d111748a7d83f0a95b444692956189506322b5e248d956

  • SSDEEP

    49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBX9w4Sx:+R0pI/IQlUoMPdmpSpz4

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2824
    • C:\Adobe3M\devdobloc.exe
      C:\Adobe3M\devdobloc.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2212

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\LabZKV\dobaloc.exe
    Filesize

    2.7MB

    MD5

    d0e007a41156f4e8078b8b2433c91f5d

    SHA1

    37493abf89b9188cf31da31dab2d07e5e8fce3b8

    SHA256

    6f7fed035cec554d40803be04c4a54f51e798d2aeb40cc3456f92f74214bd073

    SHA512

    ee32d58364c9f90d01fea91400adc437e5f01b5d4c18c661948b2efabbf90697424a5628033f806e597e4e1680fbfafcce9451453c6379c62fbc0b46e58e3823

    Download Submit

  • C:\Users\Admin\253086396416_6.1_Admin.ini
    Filesize

    204B

    MD5

    476547fe98f0740fcaf14484866fb0ae

    SHA1

    798bdcabdcc1e9b00a97421807741544fa433944

    SHA256

    b1934ef1f8a61782439f983c9685bfd2ca7d24cbc54f9c03430632eb278f007c

    SHA512

    2af68f11e946c151ed50aa8e125eb6067658369804e7298632f01be224945f265a2d64c4c206a215dfb78295f7088182ce51c2b45072c0291a4d34257704480e

    Download Submit

  • \Adobe3M\devdobloc.exe
    Filesize

    2.7MB

    MD5

    d1bff2325beadb1cbb8d37230a2eb9e8

    SHA1

    4a9087468af5c6715cd39fabe7fd7c2187306bfb

    SHA256

    af9071af8d215af160a8d2d3cc68456e16b4ee80e3831f2dd396e9bf85c9cc5b

    SHA512

    6df42a26e62ce1f7dc82274d420eab910f023c607e36ac5aa7701e6244f8b73fa51ca83b99a969beabfcedf3beb120a68f483f1d1b950d56c7ab803cdc8100aa

    Download Submit