Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    105s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/06/2024, 01:14

General

  • Target

    9428a6521088216a83e401dc7cf3a3a0_NeikiAnalytics.exe

  • Size

    6.2MB

  • MD5

    9428a6521088216a83e401dc7cf3a3a0

  • SHA1

    34b15c82e8aa42de4fc1baefc90ad0a9f5bc4454

  • SHA256

    a51bccc7ded9b49e1317c19b628b7c3e4f89de06784119fed86d120c4f438150

  • SHA512

    1407d4bafb41c7d79ae280a509f4359e6136e5b2174a5dbd035eddb0b2c904fdd36d4ab5b97ef9cfb5874bcbf99e1b33c55d6d99ba4f04fa44e30a2dbcecd867

  • SSDEEP

    98304:9bkTttG2daLX1lM50QdWW7T7TT7khfLEfJjr4I3AWtbzrCgHriBsUgywYH:x+hUD7MDWavTchTEfVrHJV/HriBsUt

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9428a6521088216a83e401dc7cf3a3a0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\9428a6521088216a83e401dc7cf3a3a0_NeikiAnalytics.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3440
    • C:\Users\Admin\AppData\Local\Temp\is-HI9LL.tmp\9428a6521088216a83e401dc7cf3a3a0_NeikiAnalytics.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-HI9LL.tmp\9428a6521088216a83e401dc7cf3a3a0_NeikiAnalytics.tmp" /SL5="$800E0,6223240,56832,C:\Users\Admin\AppData\Local\Temp\9428a6521088216a83e401dc7cf3a3a0_NeikiAnalytics.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3012
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\system32\schtasks.exe" /Delete /F /TN "Musiland_Music_Downloader_5151"
        3⤵
          PID:3652
        • C:\Users\Admin\AppData\Local\Musiland Music Downloader\musilandmusicdownloader.exe
          "C:\Users\Admin\AppData\Local\Musiland Music Downloader\musilandmusicdownloader.exe" 3b946430892e3bf0e5f148d6100fef9b
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:624

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Musiland Music Downloader\musilandmusicdownloader.exe

      Filesize

      3.9MB

      MD5

      1af374b3b5a87d83be9ae131e07db17a

      SHA1

      fd55ee4a6a6a38c38afd57cd684ed630b9f85c45

      SHA256

      ff017ffe85a8388674080e58708bd2cab958f6941c215b22ef59c6461cd45b89

      SHA512

      f28bb2e9f764224a79d83ae25d7b1ecda52ce3c32b7da8372d74b4718969c96f8213f76214322ff5e22f629849fd3568412ae1240e2b7882dd38269aef0bf76a

    • C:\Users\Admin\AppData\Local\Temp\is-EFICU.tmp\_isetup\_iscrypt.dll

      Filesize

      2KB

      MD5

      a69559718ab506675e907fe49deb71e9

      SHA1

      bc8f404ffdb1960b50c12ff9413c893b56f2e36f

      SHA256

      2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

      SHA512

      e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

    • C:\Users\Admin\AppData\Local\Temp\is-EFICU.tmp\_isetup\_isdecmp.dll

      Filesize

      19KB

      MD5

      3adaa386b671c2df3bae5b39dc093008

      SHA1

      067cf95fbdb922d81db58432c46930f86d23dded

      SHA256

      71cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38

      SHA512

      bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303

    • C:\Users\Admin\AppData\Local\Temp\is-HI9LL.tmp\9428a6521088216a83e401dc7cf3a3a0_NeikiAnalytics.tmp

      Filesize

      692KB

      MD5

      1f867b23e94cb84404b9f58144e518fb

      SHA1

      99a7a7f472e6d81ffc9a48d9f4bcccfbc172bc18

      SHA256

      e9bda766a107f30c1d7a9c9dba0f32339dd1c746d65aaec2affac735dcec9ed9

      SHA512

      efa3882e8969daba6696e628155bdcd441177db1d7127d4a93173571ba52588e91f73fc243b177194063401037ea3c0608a20b7d45f7945ad04b9842cb36531d

    • memory/624-76-0x0000000000400000-0x0000000000BED000-memory.dmp

      Filesize

      7.9MB

    • memory/624-74-0x0000000000400000-0x0000000000BED000-memory.dmp

      Filesize

      7.9MB

    • memory/624-75-0x0000000000400000-0x0000000000BED000-memory.dmp

      Filesize

      7.9MB

    • memory/624-77-0x0000000000400000-0x0000000000BED000-memory.dmp

      Filesize

      7.9MB

    • memory/624-80-0x0000000000400000-0x0000000000BED000-memory.dmp

      Filesize

      7.9MB

    • memory/3012-8-0x0000000000400000-0x00000000004BD000-memory.dmp

      Filesize

      756KB

    • memory/3012-79-0x0000000000400000-0x00000000004BD000-memory.dmp

      Filesize

      756KB

    • memory/3440-3-0x0000000000401000-0x000000000040B000-memory.dmp

      Filesize

      40KB

    • memory/3440-0-0x0000000000400000-0x0000000000414000-memory.dmp

      Filesize

      80KB

    • memory/3440-78-0x0000000000400000-0x0000000000414000-memory.dmp

      Filesize

      80KB