Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    04/06/2024, 20:45

General

  • Target

    00140a3e46adf548e7ff87cf9d5c0900_NeikiAnalytics.exe

  • Size

    730KB

  • MD5

    00140a3e46adf548e7ff87cf9d5c0900

  • SHA1

    f0dd69a34d8e8535a5513a2a1bf6d755dcc632ed

  • SHA256

    52a2fceb783b68c15163928a1f01f4ad9a49d48928a3e68f073eeaf1b550d3b4

  • SHA512

    a4d3915c598cdc2a5b5af8d522a7da5593e3b2dbe4467573f6a20926aca5159cf6ce6bb3021c0120f648689bcf2f8314b5bc42b1c60f9479f15a6a21ad5015f2

  • SSDEEP

    12288:ZT43hUGlUj36hOHmqNi2rd2lq+mWTvA4p3Gwe7OI2qRShbe0nM/:B43946hhS5EM+bTXpzq52GaNM/

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\00140a3e46adf548e7ff87cf9d5c0900_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\00140a3e46adf548e7ff87cf9d5c0900_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2956
    • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2324

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nst204F.tmp\RCPicPlugin.dll

    Filesize

    992KB

    MD5

    05ad7a5d251e7c7bfd9d56125663d2bd

    SHA1

    4e3951b8b9f7fa6e738998217938fda91fae720a

    SHA256

    a2bc165462b22163e5abed2725148fae55e7369e6a7c688a907db244d0115fb9

    SHA512

    b79d71ec6ab87405e9c6f3c524b52b57aa56aa4058d9aa8e53cd360acdb8bac6ed382f139a24c0973d01c565996e717d6d9513c5ff6bb39a09fd1f274d763e4b

  • \Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

    Filesize

    730KB

    MD5

    00140a3e46adf548e7ff87cf9d5c0900

    SHA1

    f0dd69a34d8e8535a5513a2a1bf6d755dcc632ed

    SHA256

    52a2fceb783b68c15163928a1f01f4ad9a49d48928a3e68f073eeaf1b550d3b4

    SHA512

    a4d3915c598cdc2a5b5af8d522a7da5593e3b2dbe4467573f6a20926aca5159cf6ce6bb3021c0120f648689bcf2f8314b5bc42b1c60f9479f15a6a21ad5015f2

  • memory/2324-14-0x0000000002720000-0x0000000002721000-memory.dmp

    Filesize

    4KB