Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

17066232cd...cs.exe

windows7-x64

7

17066232cd...cs.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/06/2024, 22:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    17066232cde84efde8080de89326014a52e4c3f77db0fc5e51da9aed9e8fe94d_NeikiAnalytics.exe

  • Size

    2.7MB

  • MD5

    c04b22fdd4abfb82c971334105f8a850

  • SHA1

    c57dbcefdb1bf441efbf92ebd1afc1ae8c65b730

  • SHA256

    17066232cde84efde8080de89326014a52e4c3f77db0fc5e51da9aed9e8fe94d

  • SHA512

    19e0b58d4b3c33bc10659774114a579faf9cdbf05baf0f40ff2c76bf4886bd3333814cc1bc9cf56bc99d647b8fb7aa329e42d635e8783a41c86dd52863b14125

  • SSDEEP

    49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBq9w4Sx:+R0pI/IQlUoMPdmpSpc4

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\17066232cde84efde8080de89326014a52e4c3f77db0fc5e51da9aed9e8fe94d_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\17066232cde84efde8080de89326014a52e4c3f77db0fc5e51da9aed9e8fe94d_NeikiAnalytics.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4736
    • C:\UserDot1Q\adobsys.exe
      C:\UserDot1Q\adobsys.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2280

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\LabZ6Y\optidevloc.exe
    Filesize

    256B

    MD5

    7b3cffac7066949173af9dec430e50ef

    SHA1

    4c7dd08e8b1cbe82c512820c7053bd053b06d424

    SHA256

    82e8f656f8eb55c46453962cd11965172a5564eb82c56788f85f83dda46995a8

    SHA512

    23b204cb0e6bdfb0aa9170914f3a82b60f8ddda4c76fd13b8df933d68165658435a634f1fa5974cde19cb1ee82cc61a4618c9b581c7ae6d0dfb43223fe6e8151

    Download Submit

  • C:\UserDot1Q\adobsys.exe
    Filesize

    2.7MB

    MD5

    c294ac150eb7bbf2e46c7d1db9bc9d07

    SHA1

    f745bdd646678bba9599b44fe3a39ae6154c4901

    SHA256

    c272bc17cbcf6b4636874c7d9790fd5281a388dcd8dbca631d8e537c80cf6bf5

    SHA512

    9669d688d4e6374e367c867de83f87eeb9747dcf6095ade49fd2e8ab24de432ab65a2ade00bb3e6a037cbff5439ac5cf81a432d6f31d8b09216d325db3816b92

    Download Submit

  • C:\Users\Admin\253086396416_10.0_Admin.ini
    Filesize

    207B

    MD5

    30c5e609aacacb970840fba6388f9905

    SHA1

    0257329fbd8895839fe2d502cb95c14c7a3b5592

    SHA256

    f3b9a0f88f99578c4978dd9f343faf1eb5cffef7b8f084b8c5eac3f78e1c3a9b

    SHA512

    40eb77fca38bd5e8b8a61b770edb3d76490467baa2fc8cef2e3269d2ff6819205b9aa823196b70291b1267e09b354188522f1cee40135a41b173e0d9a23a8965

    Download Submit