Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    12/06/2024, 12:47

General

  • Target

    3b94295fdf636f6d64c729aa55c17e50_NeikiAnalytics.exe

  • Size

    76KB

  • MD5

    3b94295fdf636f6d64c729aa55c17e50

  • SHA1

    ff6cca6be01d601fefd0151994161323bf81624c

  • SHA256

    7116782dd713982c2693af47271ab6e99addc2ec2a7c197d91e784ee4d26576d

  • SHA512

    c0176cbe74b8ea463d97423bf91392eb322f0bd0ead2457d9d7b0ff03ef0dcfd0e0221236eac4584f13876ae6c14a33ae921ba064ca41214ae8a4bd100c4a37f

  • SSDEEP

    1536:t3x85+Ks2k7Tt3cwa2REnxfu39k/LHL05Nq3xlJUKToXsSKBNIoEQzB:th85+KsxJMhUeLg5OdUKTovToEQF

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3b94295fdf636f6d64c729aa55c17e50_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\3b94295fdf636f6d64c729aa55c17e50_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2056
    • C:\Users\Admin\AppData\Local\Temp\tV3NDZ8ovURarz0.exe
      C:\Users\Admin\AppData\Local\Temp\tV3NDZ8ovURarz0.exe
      2⤵
      • Executes dropped EXE
      PID:1608
    • C:\Windows\svhost.exe
      "C:\Windows\svhost.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:844

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tV3NDZ8ovURarz0.exe

    Filesize

    60KB

    MD5

    7b112b1fb864c90ec5b65eab21cb40b8

    SHA1

    e7b73361f722fc7cbb93ef98a8d26e34f4d49767

    SHA256

    751941b4e09898c31791efeb5f90fc7367c89831d4a98637ed505e40763e287b

    SHA512

    bf9cdeff39cc4fa48457c55ad02e3856b5b27998535aed801a469252f01e7676462332fa3f93877753e963d037472f615c1fc5fc2e996316621b4e0a180cb5f5

  • C:\Users\Admin\Downloads\ResetExit.exe

    Filesize

    414KB

    MD5

    0f7bbddfd0da8adaab2d18c7d667047e

    SHA1

    a69d3040eea9450d0f8020d266b636512afb6919

    SHA256

    164a827caa0af4b8abab814172c76f020eb082570508024c5cb1dcc0b5ed0a35

    SHA512

    d54bd6f5f3b383a2e37f15cd1e1ecf344c4f5754bf19c8ac1833cd0db8cd8689ac822c3a01d1990f2cc2c821a67029a798365a84a388b60ed601a73f7126ba94

  • C:\Windows\svhost.exe

    Filesize

    16KB

    MD5

    76fd02b48297edb28940bdfa3fa1c48a

    SHA1

    bf5cae1057a0aca8bf3aab8b121fe77ebb0788ce

    SHA256

    07abd35f09b954eba7011ce18b225017c50168e039732680df58ae703324825c

    SHA512

    28c7bf4785547f6df9d678699a55cfb24c429a2bac5375733ff2f760c92933190517d8acd740bdf69c3ecc799635279af5d7ebd848c5b471318d1f330c441ff0