Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    80s
  • max time network
    100s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/06/2024, 21:07

General

  • Target

    03ad5c7c8fb5e90d46a6b7b762a37a826e147b052632b3541588f3e121a58ced_NeikiAnalytics.exe

  • Size

    32KB

  • MD5

    afdd7a49c5a1b88779ef43e7d6142490

  • SHA1

    dc51449b88dad09c8bbcf40b4bb52376ddc26148

  • SHA256

    03ad5c7c8fb5e90d46a6b7b762a37a826e147b052632b3541588f3e121a58ced

  • SHA512

    cbd5466cab7b57276a5eb76834828ecf183399f84f14427528219a25b0ced1c2f265a4a14fe21e56914a8b9133bf66f9dcabdda498ebee6c3bdd0824dbfb39c5

  • SSDEEP

    384:Q98xUHQ+i8EBepM5Oy4Ng8zLeiUerZaGULt0BTfCAx7ZXQUwG5kAyAe0g:TweTCM8/gop1aGUJcOG9wGzY0g

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Runs .reg file with regedit 1 IoCs
  • Suspicious behavior: RenamesItself 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\03ad5c7c8fb5e90d46a6b7b762a37a826e147b052632b3541588f3e121a58ced_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\03ad5c7c8fb5e90d46a6b7b762a37a826e147b052632b3541588f3e121a58ced_NeikiAnalytics.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1504
    • C:\Windows\SysWOW64\regedit.exe
      regedit.exe /s C:\Users\Admin\AppData\Local\Temp\~dfds3.reg
      2⤵
      • Adds Run key to start application
      • Runs .reg file with regedit
      PID:4180

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\~dfds3.reg

    Filesize

    166B

    MD5

    f44153ef26be29552cf320325ad8b72e

    SHA1

    74ac72ba2ff0f871e59b11c95ad707372662370c

    SHA256

    767009fb8726500a4bc54b2ee744cc3ada64fdf16a44e22ff9dfe7652e2a439f

    SHA512

    1d42a4dba1d8d0df9f8fedfba384ffdbcff3103c8ba360f255b5d7e8a46128f40521e4d16cf6de04365b3b6ffad8bc681cf7042d92867ab3d912601a3d5e6e65

  • C:\Users\Admin\AppData\Local\WinHttp.exe

    Filesize

    32KB

    MD5

    b2af8fff47c8abe8513fee33c00f48d1

    SHA1

    099bb4f950a3469014b78a3906fe9783bdd6cbff

    SHA256

    84e8847ec953fd77dfe2baca48d47279f235039e1098b4047af861b7493f100b

    SHA512

    161ac51858fd6cd53170d2f4485dc893053e51f14f53446c2a1b2fafa68d77c6b04fa3d91f5289996fa3ed4c67d1a40f865aee82b34692d6ef3a527e8f91b3fb

  • memory/1504-1-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1504-11-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB