Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 05:34
Static task
static1
Behavioral task
behavioral1
Sample
7fa854cea9e5d21e2d8bbb3a492395d0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7fa854cea9e5d21e2d8bbb3a492395d0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
7fa854cea9e5d21e2d8bbb3a492395d0_NeikiAnalytics.exe
-
Size
381KB
-
MD5
7fa854cea9e5d21e2d8bbb3a492395d0
-
SHA1
2b23b63746320fdab5739a75b9e4370ea925d2e9
-
SHA256
a09d9b9cd61d203f5b6283781180c030fe453deb482860e8188603fe36d15223
-
SHA512
d9b110b09dd0b772c98cfe355efcb91734e0945f3b472c7b95b46c6346f7c5442978362363a47f8adec4ab45066b7317d80e8a6b23b51983805c785e98f7f4e2
-
SSDEEP
3072:QtwizQTj8CSUYf8W3nSjen++Bj88OZS0/Qe2HdOylqwvwKbk0i0kfS:wuj8NDF3OR9/Qe2HdJfwKbk0i0B
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1048 LiveMessageCenter.exe -
Executes dropped EXE 2 IoCs
pid Process 2852 casino_extensions.exe 1048 LiveMessageCenter.exe -
Loads dropped DLL 4 IoCs
pid Process 1196 casino_extensions.exe 1196 casino_extensions.exe 1404 casino_extensions.exe 1404 casino_extensions.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\LiveMessageCenter.exe casino_extensions.exe File created C:\Windows\SysWOW64\casino_extensions.exe casino_extensions.exe File opened for modification C:\Windows\SysWOW64\casino_extensions.exe casino_extensions.exe File opened for modification C:\Windows\SysWOW64\casino_extensions.exe casino_extensions.exe File created C:\Windows\SysWOW64\LiveMessageCenter.exe casino_extensions.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Internet Explorer\casino_extensions.exe casino_extensions.exe File opened for modification C:\Program Files (x86)\Internet Explorer\casino_extensions.exe LiveMessageCenter.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1048 LiveMessageCenter.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2320 7fa854cea9e5d21e2d8bbb3a492395d0_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2320 wrote to memory of 1196 2320 7fa854cea9e5d21e2d8bbb3a492395d0_NeikiAnalytics.exe 28 PID 2320 wrote to memory of 1196 2320 7fa854cea9e5d21e2d8bbb3a492395d0_NeikiAnalytics.exe 28 PID 2320 wrote to memory of 1196 2320 7fa854cea9e5d21e2d8bbb3a492395d0_NeikiAnalytics.exe 28 PID 2320 wrote to memory of 1196 2320 7fa854cea9e5d21e2d8bbb3a492395d0_NeikiAnalytics.exe 28 PID 1196 wrote to memory of 2852 1196 casino_extensions.exe 29 PID 1196 wrote to memory of 2852 1196 casino_extensions.exe 29 PID 1196 wrote to memory of 2852 1196 casino_extensions.exe 29 PID 1196 wrote to memory of 2852 1196 casino_extensions.exe 29 PID 2852 wrote to memory of 1404 2852 casino_extensions.exe 30 PID 2852 wrote to memory of 1404 2852 casino_extensions.exe 30 PID 2852 wrote to memory of 1404 2852 casino_extensions.exe 30 PID 2852 wrote to memory of 1404 2852 casino_extensions.exe 30 PID 1404 wrote to memory of 1048 1404 casino_extensions.exe 31 PID 1404 wrote to memory of 1048 1404 casino_extensions.exe 31 PID 1404 wrote to memory of 1048 1404 casino_extensions.exe 31 PID 1404 wrote to memory of 1048 1404 casino_extensions.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\7fa854cea9e5d21e2d8bbb3a492395d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7fa854cea9e5d21e2d8bbb3a492395d0_NeikiAnalytics.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\SysWOW64\casino_extensions.exeC:\Windows\system32\casino_extensions.exe3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"4⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\SysWOW64\LiveMessageCenter.exeC:\Windows\system32\LiveMessageCenter.exe /part25⤵
- Deletes itself
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1048
-
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
395KB
MD57aee9dd0dab85168f4f390d04bf26923
SHA16174b830aabbe3b54f8b4fa4aea002ebc95a0a6d
SHA256d503965ba6e1a616eb2398db96190071cfd71b5f7b39eed7327858736af49542
SHA512c126e7881b10e41cad8fcc24f9ea0111833f33a6d8a0268a5b9a8b876005f862454a49e19dc7c4c51c3dc347d733472b5565ad4b28e994bdcaf313d1afeac616
-
Filesize
392KB
MD564b7c2a685ed89bafcb35abd32dc6ef1
SHA1266cdc32d9c857cae5ce09a7f015224fe5191289
SHA2565f53be590195952f9a8375c8c5c06f46e9bf1e5584fe3f5d0daa741f930d7a0d
SHA512419f36521774da1ffa4ba35e9c0777a85e652b55ea56c2e47edc43a02d6edd3bfd81d738dd313573b28a50f49ce840ef2d9fe5dcabe4c61d353cf434d23adb00