Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 22:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
180003673efe224306dbcce2f81357b0_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
180003673efe224306dbcce2f81357b0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
180003673efe224306dbcce2f81357b0_NeikiAnalytics.exe
-
Size
432KB
-
MD5
180003673efe224306dbcce2f81357b0
-
SHA1
bf0ef914b48b1f38b0ed42941945af802e2da48f
-
SHA256
4f324fb4329039a1156384c6fd4a74887a071371d24661a5894a32da95be78c4
-
SHA512
6d6c42c6a861549ff1b19bb9af852142ffd9594bbeb8190ad35cd3a10dfd0ccac932a1efbdaea9e358ae59e3d872a1611569c20af43f27c8ac0efc20ae0b46b3
-
SSDEEP
6144:a1VzdIgi71nAv/szQRzf4Zj3JVyN/Y53fZ6ZsVb7v:YVzdInSssRWjPy9Y53B6A7v
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 180003673efe224306dbcce2f81357b0_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" xaeas.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 180003673efe224306dbcce2f81357b0_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
pid Process 3212 xaeas.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaeas = "C:\\Users\\Admin\\xaeas.exe /q" 180003673efe224306dbcce2f81357b0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaeas = "C:\\Users\\Admin\\xaeas.exe /b" xaeas.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaeas = "C:\\Users\\Admin\\xaeas.exe /i" xaeas.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaeas = "C:\\Users\\Admin\\xaeas.exe /g" xaeas.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaeas = "C:\\Users\\Admin\\xaeas.exe /c" xaeas.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaeas = "C:\\Users\\Admin\\xaeas.exe /n" xaeas.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaeas = "C:\\Users\\Admin\\xaeas.exe /d" xaeas.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaeas = "C:\\Users\\Admin\\xaeas.exe /l" xaeas.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaeas = "C:\\Users\\Admin\\xaeas.exe /f" xaeas.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaeas = "C:\\Users\\Admin\\xaeas.exe /s" xaeas.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaeas = "C:\\Users\\Admin\\xaeas.exe /y" xaeas.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaeas = "C:\\Users\\Admin\\xaeas.exe /v" xaeas.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaeas = "C:\\Users\\Admin\\xaeas.exe /p" xaeas.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaeas = "C:\\Users\\Admin\\xaeas.exe /r" xaeas.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaeas = "C:\\Users\\Admin\\xaeas.exe /m" xaeas.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaeas = "C:\\Users\\Admin\\xaeas.exe /t" xaeas.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaeas = "C:\\Users\\Admin\\xaeas.exe /h" xaeas.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaeas = "C:\\Users\\Admin\\xaeas.exe /z" xaeas.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaeas = "C:\\Users\\Admin\\xaeas.exe /a" xaeas.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaeas = "C:\\Users\\Admin\\xaeas.exe /q" xaeas.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaeas = "C:\\Users\\Admin\\xaeas.exe /j" xaeas.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaeas = "C:\\Users\\Admin\\xaeas.exe /x" xaeas.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaeas = "C:\\Users\\Admin\\xaeas.exe /u" xaeas.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaeas = "C:\\Users\\Admin\\xaeas.exe /o" xaeas.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaeas = "C:\\Users\\Admin\\xaeas.exe /k" xaeas.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaeas = "C:\\Users\\Admin\\xaeas.exe /w" xaeas.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xaeas = "C:\\Users\\Admin\\xaeas.exe /e" xaeas.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4920 180003673efe224306dbcce2f81357b0_NeikiAnalytics.exe 4920 180003673efe224306dbcce2f81357b0_NeikiAnalytics.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe 3212 xaeas.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4920 180003673efe224306dbcce2f81357b0_NeikiAnalytics.exe 3212 xaeas.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4920 wrote to memory of 3212 4920 180003673efe224306dbcce2f81357b0_NeikiAnalytics.exe 87 PID 4920 wrote to memory of 3212 4920 180003673efe224306dbcce2f81357b0_NeikiAnalytics.exe 87 PID 4920 wrote to memory of 3212 4920 180003673efe224306dbcce2f81357b0_NeikiAnalytics.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\180003673efe224306dbcce2f81357b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\180003673efe224306dbcce2f81357b0_NeikiAnalytics.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\xaeas.exe"C:\Users\Admin\xaeas.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3212
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
432KB
MD580c776afc92edba31e0830e14daa380a
SHA13d23a14c469f25f484a3d2bfbf7875096fcb303f
SHA2562f218430583c04c8e8f784ea6a207670e192815a6ea5919a24cce0283cb7affa
SHA51243ccd6c1a638a0b078913fd3980c099532f5ca4a2fc56bff858a0eb3d5a39eb484d67066dbffc2f807036717e3d4904d5e8d3d762c1288b6d44b0ae85b83d0b3