Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 22:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
180003673efe224306dbcce2f81357b0_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
180003673efe224306dbcce2f81357b0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
180003673efe224306dbcce2f81357b0_NeikiAnalytics.exe
-
Size
432KB
-
MD5
180003673efe224306dbcce2f81357b0
-
SHA1
bf0ef914b48b1f38b0ed42941945af802e2da48f
-
SHA256
4f324fb4329039a1156384c6fd4a74887a071371d24661a5894a32da95be78c4
-
SHA512
6d6c42c6a861549ff1b19bb9af852142ffd9594bbeb8190ad35cd3a10dfd0ccac932a1efbdaea9e358ae59e3d872a1611569c20af43f27c8ac0efc20ae0b46b3
-
SSDEEP
6144:a1VzdIgi71nAv/szQRzf4Zj3JVyN/Y53fZ6ZsVb7v:YVzdInSssRWjPy9Y53B6A7v
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 180003673efe224306dbcce2f81357b0_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" koayie.exe -
Executes dropped EXE 1 IoCs
pid Process 2588 koayie.exe -
Loads dropped DLL 2 IoCs
pid Process 2860 180003673efe224306dbcce2f81357b0_NeikiAnalytics.exe 2860 180003673efe224306dbcce2f81357b0_NeikiAnalytics.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\koayie = "C:\\Users\\Admin\\koayie.exe /g" koayie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\koayie = "C:\\Users\\Admin\\koayie.exe /v" koayie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\koayie = "C:\\Users\\Admin\\koayie.exe /f" koayie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\koayie = "C:\\Users\\Admin\\koayie.exe /u" koayie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\koayie = "C:\\Users\\Admin\\koayie.exe /i" koayie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\koayie = "C:\\Users\\Admin\\koayie.exe /r" koayie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\koayie = "C:\\Users\\Admin\\koayie.exe /j" koayie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\koayie = "C:\\Users\\Admin\\koayie.exe /s" koayie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\koayie = "C:\\Users\\Admin\\koayie.exe /m" koayie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\koayie = "C:\\Users\\Admin\\koayie.exe /w" koayie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\koayie = "C:\\Users\\Admin\\koayie.exe /b" koayie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\koayie = "C:\\Users\\Admin\\koayie.exe /y" koayie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\koayie = "C:\\Users\\Admin\\koayie.exe /z" koayie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\koayie = "C:\\Users\\Admin\\koayie.exe /p" koayie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\koayie = "C:\\Users\\Admin\\koayie.exe /k" koayie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\koayie = "C:\\Users\\Admin\\koayie.exe /c" koayie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\koayie = "C:\\Users\\Admin\\koayie.exe /e" koayie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\koayie = "C:\\Users\\Admin\\koayie.exe /l" koayie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\koayie = "C:\\Users\\Admin\\koayie.exe /n" koayie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\koayie = "C:\\Users\\Admin\\koayie.exe /q" koayie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\koayie = "C:\\Users\\Admin\\koayie.exe /t" koayie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\koayie = "C:\\Users\\Admin\\koayie.exe /a" koayie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\koayie = "C:\\Users\\Admin\\koayie.exe /t" 180003673efe224306dbcce2f81357b0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\koayie = "C:\\Users\\Admin\\koayie.exe /o" koayie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\koayie = "C:\\Users\\Admin\\koayie.exe /h" koayie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\koayie = "C:\\Users\\Admin\\koayie.exe /x" koayie.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\koayie = "C:\\Users\\Admin\\koayie.exe /d" koayie.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2860 180003673efe224306dbcce2f81357b0_NeikiAnalytics.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe 2588 koayie.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2860 180003673efe224306dbcce2f81357b0_NeikiAnalytics.exe 2588 koayie.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2860 wrote to memory of 2588 2860 180003673efe224306dbcce2f81357b0_NeikiAnalytics.exe 28 PID 2860 wrote to memory of 2588 2860 180003673efe224306dbcce2f81357b0_NeikiAnalytics.exe 28 PID 2860 wrote to memory of 2588 2860 180003673efe224306dbcce2f81357b0_NeikiAnalytics.exe 28 PID 2860 wrote to memory of 2588 2860 180003673efe224306dbcce2f81357b0_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\180003673efe224306dbcce2f81357b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\180003673efe224306dbcce2f81357b0_NeikiAnalytics.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\koayie.exe"C:\Users\Admin\koayie.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2588
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
432KB
MD54490eae4716e28d36eeed76b84e0979e
SHA1738e5da4dce082ea003a69d4b7d543ecc547f91c
SHA256e11a8f14a460d45e7943c6f366b3603d11633836c237b6d0413754d6d006d715
SHA5120fbdfaafd49aae48da1ac8194f7d36bdd1f546e04d608bf867343747b30cb4b5de8f685bab083c27f1e7c7c11d8f7426bab2a0b7046f582c15db74dc56547c63