Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 07:17
Static task
static1
Behavioral task
behavioral1
Sample
9df55a89bf7d1f9204aa86d46bc76c40_NeikiAnalytics.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
9df55a89bf7d1f9204aa86d46bc76c40_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
9df55a89bf7d1f9204aa86d46bc76c40_NeikiAnalytics.exe
-
Size
223KB
-
MD5
9df55a89bf7d1f9204aa86d46bc76c40
-
SHA1
b919725198a359bdd8d5301d3a2eb522fa85bd5f
-
SHA256
969d0266fc8540369499be81010ef8ffc928d9b188ea866e165435a14b460d7c
-
SHA512
995ffe19c8171188413260ba158f30ee5595aa9923f61cdc380a8aa73be7b13ccc3ec9500fd27916b72e54821d20651c142549255dcb148a24f3dd7df94daaf2
-
SSDEEP
3072:OhpcW0zxK6hgveEQloO1t6+S9LsZF9h2+NNILxRRNyy5An6jD4vmoIjueXVihP:Ev09K6h//mWo+SqZF9A+vULyyUUogWP
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 4048 9df55a89bf7d1f9204aa86d46bc76c40_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
pid Process 4048 9df55a89bf7d1f9204aa86d46bc76c40_NeikiAnalytics.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 444 1244 WerFault.exe 82 1176 4048 WerFault.exe 89 -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1244 9df55a89bf7d1f9204aa86d46bc76c40_NeikiAnalytics.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 4048 9df55a89bf7d1f9204aa86d46bc76c40_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1244 wrote to memory of 4048 1244 9df55a89bf7d1f9204aa86d46bc76c40_NeikiAnalytics.exe 89 PID 1244 wrote to memory of 4048 1244 9df55a89bf7d1f9204aa86d46bc76c40_NeikiAnalytics.exe 89 PID 1244 wrote to memory of 4048 1244 9df55a89bf7d1f9204aa86d46bc76c40_NeikiAnalytics.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\9df55a89bf7d1f9204aa86d46bc76c40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9df55a89bf7d1f9204aa86d46bc76c40_NeikiAnalytics.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 3962⤵
- Program crash
PID:444
-
-
C:\Users\Admin\AppData\Local\Temp\9df55a89bf7d1f9204aa86d46bc76c40_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\9df55a89bf7d1f9204aa86d46bc76c40_NeikiAnalytics.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:4048 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 3683⤵
- Program crash
PID:1176
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1244 -ip 12441⤵PID:4772
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4048 -ip 40481⤵PID:3500
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
223KB
MD5a03c4e098abd30bed2b611b62b346519
SHA168102ec40ae65c2baeb9660ab32056eca7b64aba
SHA2561ae2a6c7b4740c5c2475cc32f7fdb612fd0e212b53cbf3784fe2feb41ef1ce57
SHA51213823914a39e1b889c00816dbb3c670160b91b2e45e8ad237ed1c45a4ab9c411ebbd44063efe54c0e9a665c14a1c5735186be080d3855ca365e52e641358c612