Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 16:47
Static task
static1
Behavioral task
behavioral1
Sample
25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exe
-
Size
1.1MB
-
MD5
25b3966cb262f3aeef5ea0a8f3ceccf0
-
SHA1
122763c7cb72d7c5638ac74bfeb4f4b7515691be
-
SHA256
629e4c7858715a8dd7c634200a040724e954af0cb87346b8b4371579f28a49c1
-
SHA512
298002e7f0badc8582a0d28f48cd2162c1c54ad68dd602e089de0978691aa8b0223d0986f51865c522975f4cfbc1b79118be89bd045680f03b18268dfab48711
-
SSDEEP
12288:ed3CkVCRdEo0aQi2Vj7LHflPjVDa/ZSBHnhvMCtjW:ONVUd31Bij7LHfl9a/ZSFueC
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2588 25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
pid Process 2588 25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exe -
Loads dropped DLL 4 IoCs
pid Process 2240 25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exe 2952 WerFault.exe 2952 WerFault.exe 2952 WerFault.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2952 2588 WerFault.exe 29 -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2240 25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2588 25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2240 wrote to memory of 2588 2240 25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exe 29 PID 2240 wrote to memory of 2588 2240 25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exe 29 PID 2240 wrote to memory of 2588 2240 25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exe 29 PID 2240 wrote to memory of 2588 2240 25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exe 29 PID 2588 wrote to memory of 2952 2588 25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exe 30 PID 2588 wrote to memory of 2952 2588 25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exe 30 PID 2588 wrote to memory of 2952 2588 25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exe 30 PID 2588 wrote to memory of 2952 2588 25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 1443⤵
- Loads dropped DLL
- Program crash
PID:2952
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD553b3c20e558e7181eecfca71c3197c9c
SHA19be3437a275cd0d89837eab1c50bdf79ff8a6fe1
SHA256da79d24320a61a83e23c314a2d50acda1a60b9f2151c1bbc2e9d2d803aa8a2ba
SHA512e878ad7eb4ec8c9bb264c5a2c484cf201b9c4d808fd428f98e7909a55608a5d873718545726bb800d626938e62747ac35528f6979600785a67de271c5784ad37