Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 16:47
Static task
static1
Behavioral task
behavioral1
Sample
25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exe
-
Size
1.1MB
-
MD5
25b3966cb262f3aeef5ea0a8f3ceccf0
-
SHA1
122763c7cb72d7c5638ac74bfeb4f4b7515691be
-
SHA256
629e4c7858715a8dd7c634200a040724e954af0cb87346b8b4371579f28a49c1
-
SHA512
298002e7f0badc8582a0d28f48cd2162c1c54ad68dd602e089de0978691aa8b0223d0986f51865c522975f4cfbc1b79118be89bd045680f03b18268dfab48711
-
SSDEEP
12288:ed3CkVCRdEo0aQi2Vj7LHflPjVDa/ZSBHnhvMCtjW:ONVUd31Bij7LHfl9a/ZSFueC
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1944 25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
pid Process 1944 25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exe -
Program crash 3 IoCs
pid pid_target Process procid_target 4504 3320 WerFault.exe 81 2064 1944 WerFault.exe 90 4564 1944 WerFault.exe 90 -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3320 25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 1944 25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3320 wrote to memory of 1944 3320 25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exe 90 PID 3320 wrote to memory of 1944 3320 25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exe 90 PID 3320 wrote to memory of 1944 3320 25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3320 -s 3442⤵
- Program crash
PID:4504
-
-
C:\Users\Admin\AppData\Local\Temp\25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:1944 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 3443⤵
- Program crash
PID:2064
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 3763⤵
- Program crash
PID:4564
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3320 -ip 33201⤵PID:4676
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1944 -ip 19441⤵PID:2836
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1944 -ip 19441⤵PID:3164
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5fa646ef096474de61fe9b7b62235e1b1
SHA1a716c57ee72f1e7e0974f4d25e408c3442a5ad50
SHA25618b6f0d342cf738942cb72e44b1c08b648cb9ed304d6fac6070b2590fdb4911d
SHA5122ef289266ba5654e5cff7273173d7481f49e069cbb372ffe7aa1744e3c51d7581b267431e0e9c982698f8ddaea2b253cdefe5eb892cf40bec7f6bd485993eb06