Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
129s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2024, 02:30
Static task
static1
Behavioral task
behavioral1
Sample
5baf3eb3aebd59ce55b522ca962c5660_NeikiAnalytics.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
5baf3eb3aebd59ce55b522ca962c5660_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
5baf3eb3aebd59ce55b522ca962c5660_NeikiAnalytics.exe
-
Size
1.4MB
-
MD5
5baf3eb3aebd59ce55b522ca962c5660
-
SHA1
bbf175e624155c1b4a314463628a4621b4e9fba9
-
SHA256
61fa5d2d3dee4c2cdbfbc479f2dbb3a4a62ec08ac8c6bc52eb9b6995549f6451
-
SHA512
dfe0f23c51df7783f651e2274743ac7265bca4ac982de2ec7f5ff8564d62157f0adbc09d32d7620a526d975949b4e929ae8a5d2b6725c0dc7e9b8011ededd4f6
-
SSDEEP
24576:B2pyIAEnltauATTzE6KNDTrxa/ZS/QERT77Lv+f6T8TxL5qgAfTL7:sWuATeTtggQERTbExL5ID
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1228 5baf3eb3aebd59ce55b522ca962c5660_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
pid Process 1228 5baf3eb3aebd59ce55b522ca962c5660_NeikiAnalytics.exe -
Program crash 3 IoCs
pid pid_target Process procid_target 3392 4204 WerFault.exe 82 4280 1228 WerFault.exe 90 3516 1228 WerFault.exe 90 -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4204 5baf3eb3aebd59ce55b522ca962c5660_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4204 wrote to memory of 1228 4204 5baf3eb3aebd59ce55b522ca962c5660_NeikiAnalytics.exe 90 PID 4204 wrote to memory of 1228 4204 5baf3eb3aebd59ce55b522ca962c5660_NeikiAnalytics.exe 90 PID 4204 wrote to memory of 1228 4204 5baf3eb3aebd59ce55b522ca962c5660_NeikiAnalytics.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\5baf3eb3aebd59ce55b522ca962c5660_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5baf3eb3aebd59ce55b522ca962c5660_NeikiAnalytics.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 3442⤵
- Program crash
PID:3392
-
-
C:\Users\Admin\AppData\Local\Temp\5baf3eb3aebd59ce55b522ca962c5660_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\5baf3eb3aebd59ce55b522ca962c5660_NeikiAnalytics.exe2⤵
- Deletes itself
- Executes dropped EXE
PID:1228 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 3523⤵
- Program crash
PID:4280
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 1643⤵
- Program crash
PID:3516
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4204 -ip 42041⤵PID:2416
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1228 -ip 12281⤵PID:3928
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1228 -ip 12281⤵PID:3372
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5a45abedf831713f453e506b88bc4ff61
SHA1616479f18ee00253bd131c06a895b2357ee2dcdc
SHA25694aa512ad4504464a308856df461cda99ee8b3fa20779f4c34618dcc01fb66d3
SHA512f6e3f07e47cb5000a4f2bf71593dd106aab30b3f58198332d70bb1ea79c14f286f82cb195450d21d35f87a441ce9dd2b61dd53543f371f375d5c45a377f0909d