Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    652e5c5ca83720cd9fb6902890af7af8776145352e4a9afa13e95a4161d07db8_NeikiAnalytics.exe

  • Size

    119KB

  • Sample

    240620-p9gwqsydqg

  • MD5

    1cd3aadd971541f7a5dcb5c714e4e0d0

  • SHA1

    135ed42948dd10a56f535218f6dabe5095d92bb3

  • SHA256

    652e5c5ca83720cd9fb6902890af7af8776145352e4a9afa13e95a4161d07db8

  • SHA512

    7f036f8a914ad45527de1c9ba6194fed2bb93a103a399dbd287ae68fb2bfd3127174fd7cf1f54179166cb207076e8870be8f023b035d76e94760ba27e5c999c1

  • SSDEEP

    3072:8OjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPh:8Is9OKofHfHTXQLzgvnzHPowYbvrjD/E

Malware Config

Targets

    • Target

      652e5c5ca83720cd9fb6902890af7af8776145352e4a9afa13e95a4161d07db8_NeikiAnalytics.exe

    • Size

      119KB

    • MD5

      1cd3aadd971541f7a5dcb5c714e4e0d0

    • SHA1

      135ed42948dd10a56f535218f6dabe5095d92bb3

    • SHA256

      652e5c5ca83720cd9fb6902890af7af8776145352e4a9afa13e95a4161d07db8

    • SHA512

      7f036f8a914ad45527de1c9ba6194fed2bb93a103a399dbd287ae68fb2bfd3127174fd7cf1f54179166cb207076e8870be8f023b035d76e94760ba27e5c999c1

    • SSDEEP

      3072:8OjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPh:8Is9OKofHfHTXQLzgvnzHPowYbvrjD/E

    • Drops file in Drivers directory

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks