Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    107s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/05/2024, 01:59

General

  • Target

    44cc8024db4bd958ce9675daaf2472f0_NeikiAnalytics.exe

  • Size

    106KB

  • MD5

    44cc8024db4bd958ce9675daaf2472f0

  • SHA1

    207b3c37b4ff7f8df3fa86e6e0cf15ece15a11b1

  • SHA256

    aa4477e9eae99adb452b62f1c5ca6b48186f60749496062e234adafa609788e4

  • SHA512

    f511082d87b87c2c633635e1f286b8ec14492edf520343db95bc75da40601f6c6505de7c7ffec54981318a07abc55a55c6d5f3ad5f9c27d36e0b49a51aea2cb9

  • SSDEEP

    1536:zO/z6hPABUjO/Zd1716EoLiL4l1HdIaqQPDm0xK8i6f0Zn9PRVW8sW45ouANk4:kzgjO/Zd1RePDmZ8tf05iW4uuM

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\44cc8024db4bd958ce9675daaf2472f0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\44cc8024db4bd958ce9675daaf2472f0_NeikiAnalytics.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1852
    • C:\Users\Admin\AppData\Local\Temp\44cc8024db4bd958ce9675daaf2472f0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\44cc8024db4bd958ce9675daaf2472f0_NeikiAnalytics.exe" end
      2⤵
        PID:2652

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1852-0-0x0000000000400000-0x0000000000421000-memory.dmp

      Filesize

      132KB

    • memory/2652-1-0x0000000000400000-0x0000000000421000-memory.dmp

      Filesize

      132KB