Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    24/06/2024, 14:27

General

  • Target

    808bb4ed7096db047ab04154115f95fddc4c5b9228808ee6c2b6996c1fa0c3a8_NeikiAnalytics.exe

  • Size

    134KB

  • MD5

    e14ee0e2d03d9f6ae52baf7859388aa0

  • SHA1

    f16ed5584f88cd0aa710bac0b6c2659fa61effc5

  • SHA256

    808bb4ed7096db047ab04154115f95fddc4c5b9228808ee6c2b6996c1fa0c3a8

  • SHA512

    45bc1343790d913fa2a7ab60beaf40be693ab84c265d76f0696124d1f397e7f37793fb4b5cbedfce023da588cdaf781c0345dcfced113e2f7507b2eafc244678

  • SSDEEP

    1536:rF0AJELopHG9aa+9qX3apJzAKWYr0v7ioy6paK2AZqMIK7aGZh38Q/:riAyLN9aa+9U2rW1ip6pr2At7NZuQ/

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\808bb4ed7096db047ab04154115f95fddc4c5b9228808ee6c2b6996c1fa0c3a8_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\808bb4ed7096db047ab04154115f95fddc4c5b9228808ee6c2b6996c1fa0c3a8_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1492
    • C:\ProgramData\Update\WwanSvc.exe
      "C:\ProgramData\Update\WwanSvc.exe" /run
      2⤵
      • Executes dropped EXE
      PID:1484

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \ProgramData\Update\WwanSvc.exe

    Filesize

    134KB

    MD5

    51b54e2f7c7a1f1a1e20dd9c3c0b570d

    SHA1

    e804e4d3dac399751a937871c08822713764443c

    SHA256

    7d9b40ffab50304b1f48fab8a28d9eb95d67d0565b3f0174d66f4a20c28283d5

    SHA512

    9633a8f28c402f4877f79bedcedfe40339ddb5c2c49b4349c641263549f736c87e7a84e29c35cec98b27c978efbb36e088ae136032d8bcf86dc789d466234a8b

  • memory/1484-6-0x0000000000E30000-0x0000000000E58000-memory.dmp

    Filesize

    160KB

  • memory/1484-9-0x0000000000E30000-0x0000000000E58000-memory.dmp

    Filesize

    160KB

  • memory/1492-0-0x0000000000B70000-0x0000000000B98000-memory.dmp

    Filesize

    160KB

  • memory/1492-7-0x0000000000B70000-0x0000000000B98000-memory.dmp

    Filesize

    160KB

  • memory/1492-8-0x0000000000140000-0x0000000000168000-memory.dmp

    Filesize

    160KB

  • memory/1492-10-0x0000000000B70000-0x0000000000B98000-memory.dmp

    Filesize

    160KB