Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 18:32
Behavioral task
behavioral1
Sample
42f7a8eaa7c7f56d1c5e894130788980_NeikiAnalytics.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
42f7a8eaa7c7f56d1c5e894130788980_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
42f7a8eaa7c7f56d1c5e894130788980_NeikiAnalytics.exe
-
Size
4.2MB
-
MD5
42f7a8eaa7c7f56d1c5e894130788980
-
SHA1
51676c5d880bed1eb1b7d9023edb28fdb623ac51
-
SHA256
e84d44bedee6b09ddb6c1a3866d9a192ea1ab5cc84d1c0a1fe5f8e6d90079fdb
-
SHA512
e2a481725f6aa49f52dcb86fd3aae99b48d66066514a20d241492c87e4a765ec51d851d24459bee2f8bc4577bb49ef43f42bc995082d15421b7eb13c65c272e8
-
SSDEEP
98304:doILtJwb4X+nJitKyRyVMnY9wkr/cHvNrTMCS/WAPoWkXEMhYSDDhqAaj:eYJ3X+JMKyR06vrPNrTMC+voWkXOwij
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1656 f.exe -
resource yara_rule behavioral2/memory/2260-8-0x0000000000400000-0x0000000000AF1000-memory.dmp vmprotect behavioral2/files/0x000700000002340d-13.dat vmprotect behavioral2/memory/2260-15-0x0000000000400000-0x0000000000AF1000-memory.dmp vmprotect behavioral2/memory/1656-27-0x0000000000400000-0x0000000000AF1000-memory.dmp vmprotect behavioral2/memory/2260-10-0x0000000000400000-0x0000000000AF1000-memory.dmp vmprotect behavioral2/memory/1656-28-0x0000000000400000-0x0000000000AF1000-memory.dmp vmprotect -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2260 42f7a8eaa7c7f56d1c5e894130788980_NeikiAnalytics.exe 1656 f.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\zj\f.exe 42f7a8eaa7c7f56d1c5e894130788980_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2260 42f7a8eaa7c7f56d1c5e894130788980_NeikiAnalytics.exe 2260 42f7a8eaa7c7f56d1c5e894130788980_NeikiAnalytics.exe 2260 42f7a8eaa7c7f56d1c5e894130788980_NeikiAnalytics.exe 2260 42f7a8eaa7c7f56d1c5e894130788980_NeikiAnalytics.exe 1656 f.exe 1656 f.exe 1656 f.exe 1656 f.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2260 wrote to memory of 1656 2260 42f7a8eaa7c7f56d1c5e894130788980_NeikiAnalytics.exe 84 PID 2260 wrote to memory of 1656 2260 42f7a8eaa7c7f56d1c5e894130788980_NeikiAnalytics.exe 84 PID 2260 wrote to memory of 1656 2260 42f7a8eaa7c7f56d1c5e894130788980_NeikiAnalytics.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\42f7a8eaa7c7f56d1c5e894130788980_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\42f7a8eaa7c7f56d1c5e894130788980_NeikiAnalytics.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Program Files (x86)\zj\f.exe"C:\Program Files (x86)\zj\f.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1656
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.2MB
MD505b8020b532ee63e87adcd70b3bf4bdb
SHA1f33cd12d47ec7142a80e608f24cc4a32195a92c7
SHA256515966fd182086d10aa8f5eded51cc03e6dbd20da41e047165c3fe43a020855b
SHA512709f12f3baf82b6ca0345ce0a74177e09fd7d822658d8fefce3ab8019b99358253f45993d8291566d2299ce7f8e23b001841d4fa03ea717be6c203d92011555b