Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

7

3a50ce1fdd...cs.exe

windows7-x64

10

3a50ce1fdd...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3a50ce1fdd93ae5fbc810c8d4cd9a3a0_NeikiAnalytics.exe

  • Size

    91KB

  • Sample

    240602-fhms8scc55

  • MD5

    3a50ce1fdd93ae5fbc810c8d4cd9a3a0

  • SHA1

    fb585d9b5a2e8cc49cd27995e26426f661201a31

  • SHA256

    0a8e8012c6e4d632b06494dc039465a057cdd756f897e5b093215e0b6031af5e

  • SHA512

    47da6bb1c7a4d3debf07b2c01f641dd1c56c0f43ffb68c0aceaa5d8c746bdf3d155e6df33df4e7f76f5cdc8d044566e5bd0ebb64a74727bff6fd7434ab205304

  • SSDEEP

    1536:kRsjd3GR2Dxy387Lnouy8VT8Rsjd3GR2Dxy387Lnouy8VTY:kOgUXoutN8OgUXoutNY

Score
10/10
evasionpersistenceupx

Malware Config

Targets

    • Target

      3a50ce1fdd93ae5fbc810c8d4cd9a3a0_NeikiAnalytics.exe

    • Size

      91KB

    • MD5

      3a50ce1fdd93ae5fbc810c8d4cd9a3a0

    • SHA1

      fb585d9b5a2e8cc49cd27995e26426f661201a31

    • SHA256

      0a8e8012c6e4d632b06494dc039465a057cdd756f897e5b093215e0b6031af5e

    • SHA512

      47da6bb1c7a4d3debf07b2c01f641dd1c56c0f43ffb68c0aceaa5d8c746bdf3d155e6df33df4e7f76f5cdc8d044566e5bd0ebb64a74727bff6fd7434ab205304

    • SSDEEP

      1536:kRsjd3GR2Dxy387Lnouy8VT8Rsjd3GR2Dxy387Lnouy8VTY:kOgUXoutN8OgUXoutNY

    Score
    10/10
    evasionpersistenceupx

    • Modifies WinLogon for persistence

      persistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Disables RegEdit via registry modification

      evasion

    • Disables use of System Restore points

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks