Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
10/05/2024, 06:27
General
-
Target
8f61db31c18507290290fe903d867e60_NeikiAnalytics.exe
-
Size
223KB
-
MD5
8f61db31c18507290290fe903d867e60
-
SHA1
7194200e1bfae632d7f89b46ea734135506a7579
-
SHA256
d8d409a8d020ea7f8d8d515aae38542a4995217f799ecbf7f3606dfee25ede11
-
SHA512
3d9c756c7c125cb279569dacb426ecc7495c45faf20e0f1799288b839dac194b35ca8f2b71c779d3001b25d2e5dbec1afe6b7ccc3a956688679e45e3110c5ee8
-
SSDEEP
6144:u5GgJgBhFk801VcNliLcKQ8tqHz3I/COWP:IGtu1VK8LcJ8tqHz+COWP
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f61db31c18507290290fe903d867e60_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8f61db31c18507290290fe903d867e60_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8f61db31c18507290290fe903d867e60_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\8f61db31c18507290290fe903d867e60_NeikiAnalytics.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
223KB
MD5164f720e7aeee102c62941c0c78a98e9
SHA18c417a90b7f66979fb6ccfd117b91b3eed1741d0
SHA2566d1c77c8928caca23b17075e757c26b242b50117f692493e1c185f414ed074fa
SHA5120ae93603dae7acfe146e9d7b24d481c76ab7a9da17e6a3d6f3eadf70ffc5fc9851160a21b5bb4cb633decd18d15aa526f02b4c1346279af8e568bf9e8e25ccd6
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
104KB
-
Filesize
280KB
-
Filesize
280KB