Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    157s
  • max time network
    162s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/06/2024, 14:27

General

  • Target

    808bb4ed7096db047ab04154115f95fddc4c5b9228808ee6c2b6996c1fa0c3a8_NeikiAnalytics.exe

  • Size

    134KB

  • MD5

    e14ee0e2d03d9f6ae52baf7859388aa0

  • SHA1

    f16ed5584f88cd0aa710bac0b6c2659fa61effc5

  • SHA256

    808bb4ed7096db047ab04154115f95fddc4c5b9228808ee6c2b6996c1fa0c3a8

  • SHA512

    45bc1343790d913fa2a7ab60beaf40be693ab84c265d76f0696124d1f397e7f37793fb4b5cbedfce023da588cdaf781c0345dcfced113e2f7507b2eafc244678

  • SSDEEP

    1536:rF0AJELopHG9aa+9qX3apJzAKWYr0v7ioy6paK2AZqMIK7aGZh38Q/:riAyLN9aa+9U2rW1ip6pr2At7NZuQ/

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\808bb4ed7096db047ab04154115f95fddc4c5b9228808ee6c2b6996c1fa0c3a8_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\808bb4ed7096db047ab04154115f95fddc4c5b9228808ee6c2b6996c1fa0c3a8_NeikiAnalytics.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1348
    • C:\ProgramData\Update\WwanSvc.exe
      "C:\ProgramData\Update\WwanSvc.exe" /run
      2⤵
      • Executes dropped EXE
      PID:4168
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3832 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:2244

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\Update\WwanSvc.exe

      Filesize

      134KB

      MD5

      73c69761a20216ed0d86cbfa1cdb4ba2

      SHA1

      db244a1947d826bd81c999328d35e3bbd5d8b562

      SHA256

      fcec6b6156a7b76508971e3fb1e992d2b725896686485d48ff29c272c98b782d

      SHA512

      cedf05bd3c5fdef54404b34c45966220e1e636e620e77b986d04f3846cd98270614892360ea5d284b6a976f98a2f60655fc9fc4d0f6787b7c5ddfe35720d24d8

    • memory/1348-0-0x0000000000C70000-0x0000000000C98000-memory.dmp

      Filesize

      160KB

    • memory/1348-6-0x0000000000C70000-0x0000000000C98000-memory.dmp

      Filesize

      160KB

    • memory/4168-4-0x0000000000AE0000-0x0000000000B08000-memory.dmp

      Filesize

      160KB

    • memory/4168-7-0x0000000000AE0000-0x0000000000B08000-memory.dmp

      Filesize

      160KB