Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2024, 00:58
Static task
static1
Behavioral task
behavioral1
Sample
43c8ae0a5d326c7e341c8de38eeb7a60_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
43c8ae0a5d326c7e341c8de38eeb7a60_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
43c8ae0a5d326c7e341c8de38eeb7a60_NeikiAnalytics.exe
-
Size
81KB
-
MD5
43c8ae0a5d326c7e341c8de38eeb7a60
-
SHA1
e997199d1b410674a25311c37b6f80d3f225f782
-
SHA256
de59e3b6dcea7d12e47b1ced12b3e3d6f65b8211324db913ba29dcbc1ae861ed
-
SHA512
26f5204dbb0aef2d54528bc53110fe8a0cd231cfec6d773fe775e455fb081850603a43a190fb99deb037873118282d093bc4537c1d204f9bfe0493d17ce16552
-
SSDEEP
1536:YAowfUJFgjT284U+w2EwRz6OlvaeEpIaCtwUaSvcmGCCCCCHCChCHCCCdg1WCCCm:YAowyFgjTiUkEwt6OlvaeEpIaCtwUaSV
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 4476 microsofthelp.exe -
Executes dropped EXE 1 IoCs
pid Process 4476 microsofthelp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe" 43c8ae0a5d326c7e341c8de38eeb7a60_NeikiAnalytics.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\microsofthelp.exe 43c8ae0a5d326c7e341c8de38eeb7a60_NeikiAnalytics.exe File created C:\Windows\HidePlugin.dll microsofthelp.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2920 wrote to memory of 4476 2920 43c8ae0a5d326c7e341c8de38eeb7a60_NeikiAnalytics.exe 82 PID 2920 wrote to memory of 4476 2920 43c8ae0a5d326c7e341c8de38eeb7a60_NeikiAnalytics.exe 82 PID 2920 wrote to memory of 4476 2920 43c8ae0a5d326c7e341c8de38eeb7a60_NeikiAnalytics.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\43c8ae0a5d326c7e341c8de38eeb7a60_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\43c8ae0a5d326c7e341c8de38eeb7a60_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\microsofthelp.exe"C:\Windows\microsofthelp.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Drops file in Windows directory
PID:4476
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
81KB
MD545402950f4c3e7574c269f171eafb8d7
SHA1f0cbe131a3de5af08de4e6e1031a733d82d06c28
SHA25698a3a7fb3225aeba47de45227b32cb3b042aace6edd8cf5d476a6051179be77c
SHA5127083a30724f2132c819592d413563ecce0a6efa88d54b6eb2908d16778f65e3156072b649cc088794d6cbbace9b70af63253f47c06ae6339818147b5eb22cf0e