Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/06/2024, 17:06

General

  • Target

    9345a3dd5694fce8c0a28e9ae65000269f0cc8e55d162018b994555de71c5018_NeikiAnalytics.exe

  • Size

    134KB

  • MD5

    2f55c8858c78f42463baee07210bd460

  • SHA1

    9a086fb81be218004359ca4a5593b0bccd047921

  • SHA256

    9345a3dd5694fce8c0a28e9ae65000269f0cc8e55d162018b994555de71c5018

  • SHA512

    81b2f791acf14dc0deef3d0dc9252a8e26bcf6ae09a52b1845257cb4c8e5e9973d7c4044a582515b07a8332c9151cc4d6b9173ad1f3e1c56ffed3e75c57f27dd

  • SSDEEP

    1536:rF0AJELopHG9aa+9qX3apJzAKWYr0v7ioy6paK2AZqMIK7aGZh38QS:riAyLN9aa+9U2rW1ip6pr2At7NZuQS

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9345a3dd5694fce8c0a28e9ae65000269f0cc8e55d162018b994555de71c5018_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\9345a3dd5694fce8c0a28e9ae65000269f0cc8e55d162018b994555de71c5018_NeikiAnalytics.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4728
    • C:\ProgramData\Update\WwanSvc.exe
      "C:\ProgramData\Update\WwanSvc.exe" /run
      2⤵
      • Executes dropped EXE
      PID:720
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1268 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:4720

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\Update\WwanSvc.exe

      Filesize

      134KB

      MD5

      24767991512739155999d45f1b51513d

      SHA1

      d3b78ccdfe676c6370af37d83f63c00bd207283e

      SHA256

      c3e00badcfd4bf4d75d1d156b57e178b50ae68cf6526fb7d4ae18b3e947614cb

      SHA512

      ce7a76c92838250968767ddc40bed752e8034b89e30634aab41ba2ec171705eb1011d4e53a2da348383b1455889388f10adef0231cb22fdbfcf21718d866978c

    • memory/720-4-0x00000000005A0000-0x00000000005C8000-memory.dmp

      Filesize

      160KB

    • memory/720-7-0x00000000005A0000-0x00000000005C8000-memory.dmp

      Filesize

      160KB

    • memory/4728-0-0x0000000000690000-0x00000000006B8000-memory.dmp

      Filesize

      160KB

    • memory/4728-5-0x0000000000690000-0x00000000006B8000-memory.dmp

      Filesize

      160KB