Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 16:38
Static task
static1
Behavioral task
behavioral1
Sample
23883c6ae9e1d945e5182de656ab8ef0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
23883c6ae9e1d945e5182de656ab8ef0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
23883c6ae9e1d945e5182de656ab8ef0_NeikiAnalytics.exe
-
Size
60KB
-
MD5
23883c6ae9e1d945e5182de656ab8ef0
-
SHA1
b4627c21b305fb5e887ecec6ade22558fff28045
-
SHA256
40353fa4e918e7fe7af8c17f04bf58f2be0df1aaadad3032abc40bca2547f0aa
-
SHA512
fbd6f79c0dc054b9b058f8a6e17351e87c81ab64c75743277e983fe0eaa61a351d35abfa338b6d4957b79a923999656048af53d24fa9d775d7761af413027637
-
SSDEEP
768:vCru/f9Uw/E6zy4n8uZ5tUXMJ+fROUmELY2glEbM3j+rd+fpRuO4TW7ReOON:7RTzy48untU8fOMEI3jyYfPT4wON
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1928 wrote to memory of 2116 1928 23883c6ae9e1d945e5182de656ab8ef0_NeikiAnalytics.exe 29 PID 1928 wrote to memory of 2116 1928 23883c6ae9e1d945e5182de656ab8ef0_NeikiAnalytics.exe 29 PID 1928 wrote to memory of 2116 1928 23883c6ae9e1d945e5182de656ab8ef0_NeikiAnalytics.exe 29 PID 1928 wrote to memory of 2116 1928 23883c6ae9e1d945e5182de656ab8ef0_NeikiAnalytics.exe 29 PID 2116 wrote to memory of 1696 2116 cmd.exe 30 PID 2116 wrote to memory of 1696 2116 cmd.exe 30 PID 2116 wrote to memory of 1696 2116 cmd.exe 30 PID 2116 wrote to memory of 1696 2116 cmd.exe 30 PID 1696 wrote to memory of 1664 1696 iexpress.exe 31 PID 1696 wrote to memory of 1664 1696 iexpress.exe 31 PID 1696 wrote to memory of 1664 1696 iexpress.exe 31 PID 1696 wrote to memory of 1664 1696 iexpress.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\23883c6ae9e1d945e5182de656ab8ef0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\23883c6ae9e1d945e5182de656ab8ef0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\8C77.tmp\1.bat" "C:\Users\Admin\AppData\Local\Temp\23883c6ae9e1d945e5182de656ab8ef0_NeikiAnalytics.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\iexpress.exeiexpress /n /q /m C:\Users\Admin\AppData\Local\Temp\popup.sed3⤵
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\SysWOW64\makecab.exeC:\Windows\SysWOW64\makecab.exe /f "~%TargetName%.DDF"4⤵PID:1664
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD502dba5f37067292355c6d01a57d4ef48
SHA17c67ab3f99fbf7a53018dd295d2968c525db83d9
SHA2568b74c812ba9e6c536da7edd4101e7e0dddeab8355e5aff095dd31b3f00560242
SHA51212201f949ee3198c8f4b39cc8edf90a114ecf42ddd5383ed0b87e4c78053cd517786dc7af83557e63a0483af74f4c0117d5568441ae761ff6958e758704d602a
-
Filesize
60KB
MD5e830326eea445c45fe3889af3c08c601
SHA18b5f56ffdad7353baf10fbc593637b6e071cb327
SHA2563d6b8bcb6a4d1034b3e2ad34683150e6f5d208315d46bf8ca5bf1a8190dc9320
SHA51297d115e2f7759e9eecd0ee7d1f3286181f2cfe9b735d58828e02e50c4b50561f684e571cf38c522c43ed244943fe558f5a4870f814d1a22dac86315c319b1ec8
-
Filesize
724B
MD5c3ca008abd6997c4b036a7e8be75cb2c
SHA105f7a3527bb04c691b08f040f562582035398829
SHA25629ef6bf47dcc8c67f1abe1b269d3518d6a4ebe125daa1ea460779638cb9782a3
SHA512bee0baf3cb83144239077f99f5ca2a6ca7b618f7f51a53e03613ae697e8bc76fa28f5d006296b469be8e1fffeeb35668b5fe87b260b1380cc003815ea9efb083