Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
130s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 16:38
Static task
static1
Behavioral task
behavioral1
Sample
23883c6ae9e1d945e5182de656ab8ef0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
23883c6ae9e1d945e5182de656ab8ef0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
23883c6ae9e1d945e5182de656ab8ef0_NeikiAnalytics.exe
-
Size
60KB
-
MD5
23883c6ae9e1d945e5182de656ab8ef0
-
SHA1
b4627c21b305fb5e887ecec6ade22558fff28045
-
SHA256
40353fa4e918e7fe7af8c17f04bf58f2be0df1aaadad3032abc40bca2547f0aa
-
SHA512
fbd6f79c0dc054b9b058f8a6e17351e87c81ab64c75743277e983fe0eaa61a351d35abfa338b6d4957b79a923999656048af53d24fa9d775d7761af413027637
-
SSDEEP
768:vCru/f9Uw/E6zy4n8uZ5tUXMJ+fROUmELY2glEbM3j+rd+fpRuO4TW7ReOON:7RTzy48untU8fOMEI3jyYfPT4wON
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3876 wrote to memory of 1936 3876 23883c6ae9e1d945e5182de656ab8ef0_NeikiAnalytics.exe 84 PID 3876 wrote to memory of 1936 3876 23883c6ae9e1d945e5182de656ab8ef0_NeikiAnalytics.exe 84 PID 3876 wrote to memory of 1936 3876 23883c6ae9e1d945e5182de656ab8ef0_NeikiAnalytics.exe 84 PID 1936 wrote to memory of 4928 1936 cmd.exe 85 PID 1936 wrote to memory of 4928 1936 cmd.exe 85 PID 1936 wrote to memory of 4928 1936 cmd.exe 85 PID 4928 wrote to memory of 1532 4928 iexpress.exe 86 PID 4928 wrote to memory of 1532 4928 iexpress.exe 86 PID 4928 wrote to memory of 1532 4928 iexpress.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\23883c6ae9e1d945e5182de656ab8ef0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\23883c6ae9e1d945e5182de656ab8ef0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\39EC.tmp\1.bat" "C:\Users\Admin\AppData\Local\Temp\23883c6ae9e1d945e5182de656ab8ef0_NeikiAnalytics.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\iexpress.exeiexpress /n /q /m C:\Users\Admin\AppData\Local\Temp\popup.sed3⤵
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\makecab.exeC:\Windows\SysWOW64\makecab.exe /f "~%TargetName%.DDF"4⤵PID:1532
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD502dba5f37067292355c6d01a57d4ef48
SHA17c67ab3f99fbf7a53018dd295d2968c525db83d9
SHA2568b74c812ba9e6c536da7edd4101e7e0dddeab8355e5aff095dd31b3f00560242
SHA51212201f949ee3198c8f4b39cc8edf90a114ecf42ddd5383ed0b87e4c78053cd517786dc7af83557e63a0483af74f4c0117d5568441ae761ff6958e758704d602a
-
Filesize
60KB
MD5e830326eea445c45fe3889af3c08c601
SHA18b5f56ffdad7353baf10fbc593637b6e071cb327
SHA2563d6b8bcb6a4d1034b3e2ad34683150e6f5d208315d46bf8ca5bf1a8190dc9320
SHA51297d115e2f7759e9eecd0ee7d1f3286181f2cfe9b735d58828e02e50c4b50561f684e571cf38c522c43ed244943fe558f5a4870f814d1a22dac86315c319b1ec8
-
Filesize
724B
MD5c3ca008abd6997c4b036a7e8be75cb2c
SHA105f7a3527bb04c691b08f040f562582035398829
SHA25629ef6bf47dcc8c67f1abe1b269d3518d6a4ebe125daa1ea460779638cb9782a3
SHA512bee0baf3cb83144239077f99f5ca2a6ca7b618f7f51a53e03613ae697e8bc76fa28f5d006296b469be8e1fffeeb35668b5fe87b260b1380cc003815ea9efb083