Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/05/2024, 07:17

General

  • Target

    9df55a89bf7d1f9204aa86d46bc76c40_NeikiAnalytics.exe

  • Size

    223KB

  • MD5

    9df55a89bf7d1f9204aa86d46bc76c40

  • SHA1

    b919725198a359bdd8d5301d3a2eb522fa85bd5f

  • SHA256

    969d0266fc8540369499be81010ef8ffc928d9b188ea866e165435a14b460d7c

  • SHA512

    995ffe19c8171188413260ba158f30ee5595aa9923f61cdc380a8aa73be7b13ccc3ec9500fd27916b72e54821d20651c142549255dcb148a24f3dd7df94daaf2

  • SSDEEP

    3072:OhpcW0zxK6hgveEQloO1t6+S9LsZF9h2+NNILxRRNyy5An6jD4vmoIjueXVihP:Ev09K6h//mWo+SqZF9A+vULyyUUogWP

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Program crash 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9df55a89bf7d1f9204aa86d46bc76c40_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\9df55a89bf7d1f9204aa86d46bc76c40_NeikiAnalytics.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1244
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 396
      2⤵
      • Program crash
      PID:444
    • C:\Users\Admin\AppData\Local\Temp\9df55a89bf7d1f9204aa86d46bc76c40_NeikiAnalytics.exe
      C:\Users\Admin\AppData\Local\Temp\9df55a89bf7d1f9204aa86d46bc76c40_NeikiAnalytics.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:4048
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 368
        3⤵
        • Program crash
        PID:1176
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1244 -ip 1244
    1⤵
      PID:4772
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4048 -ip 4048
      1⤵
        PID:3500

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\9df55a89bf7d1f9204aa86d46bc76c40_NeikiAnalytics.exe

        Filesize

        223KB

        MD5

        a03c4e098abd30bed2b611b62b346519

        SHA1

        68102ec40ae65c2baeb9660ab32056eca7b64aba

        SHA256

        1ae2a6c7b4740c5c2475cc32f7fdb612fd0e212b53cbf3784fe2feb41ef1ce57

        SHA512

        13823914a39e1b889c00816dbb3c670160b91b2e45e8ad237ed1c45a4ab9c411ebbd44063efe54c0e9a665c14a1c5735186be080d3855ca365e52e641358c612

      • memory/1244-0-0x0000000000400000-0x0000000000446000-memory.dmp

        Filesize

        280KB

      • memory/1244-6-0x0000000000400000-0x0000000000446000-memory.dmp

        Filesize

        280KB

      • memory/4048-7-0x0000000000400000-0x0000000000446000-memory.dmp

        Filesize

        280KB

      • memory/4048-8-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/4048-13-0x00000000014A0000-0x00000000014E6000-memory.dmp

        Filesize

        280KB

      • memory/4048-14-0x0000000000400000-0x0000000000446000-memory.dmp

        Filesize

        280KB