Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
125s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2024, 04:33
Static task
static1
Behavioral task
behavioral1
Sample
7dcf68329df76a82bd06b3fb2dd81f00_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7dcf68329df76a82bd06b3fb2dd81f00_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
7dcf68329df76a82bd06b3fb2dd81f00_NeikiAnalytics.exe
-
Size
81KB
-
MD5
7dcf68329df76a82bd06b3fb2dd81f00
-
SHA1
c1a4a3e525d4ea7b702bf8442cfd0ebf5e6cc972
-
SHA256
1b062ae6f45d8651780e44f8638e66b850e205c6a4a42d9d1e56b237e43d6297
-
SHA512
04c95d1b4d8e421da75329a5d0e254ed44cefa33a921c9fc9524395d793ea03d4956b06afccbb829611662668817c261c7005e98b15730564bcaceccf33435df
-
SSDEEP
1536:Wxkzy48untU8fOMEI3jyYfPiuORuGj9sEM:nzltUeOsaPuGj9sEM
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1060 wrote to memory of 2180 1060 7dcf68329df76a82bd06b3fb2dd81f00_NeikiAnalytics.exe 90 PID 1060 wrote to memory of 2180 1060 7dcf68329df76a82bd06b3fb2dd81f00_NeikiAnalytics.exe 90 PID 1060 wrote to memory of 2180 1060 7dcf68329df76a82bd06b3fb2dd81f00_NeikiAnalytics.exe 90 PID 2180 wrote to memory of 4912 2180 cmd.exe 91 PID 2180 wrote to memory of 4912 2180 cmd.exe 91 PID 2180 wrote to memory of 4912 2180 cmd.exe 91 PID 4912 wrote to memory of 1568 4912 iexpress.exe 92 PID 4912 wrote to memory of 1568 4912 iexpress.exe 92 PID 4912 wrote to memory of 1568 4912 iexpress.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\7dcf68329df76a82bd06b3fb2dd81f00_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7dcf68329df76a82bd06b3fb2dd81f00_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\E6F5.tmp\1.bat" "C:\Users\Admin\AppData\Local\Temp\7dcf68329df76a82bd06b3fb2dd81f00_NeikiAnalytics.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\iexpress.exeiexpress /n /q /m C:\Users\Admin\AppData\Local\Temp\popup.sed3⤵
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SysWOW64\makecab.exeC:\Windows\SysWOW64\makecab.exe /f "~%TargetName%.DDF"4⤵PID:1568
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3728,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:81⤵PID:4376
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD502dba5f37067292355c6d01a57d4ef48
SHA17c67ab3f99fbf7a53018dd295d2968c525db83d9
SHA2568b74c812ba9e6c536da7edd4101e7e0dddeab8355e5aff095dd31b3f00560242
SHA51212201f949ee3198c8f4b39cc8edf90a114ecf42ddd5383ed0b87e4c78053cd517786dc7af83557e63a0483af74f4c0117d5568441ae761ff6958e758704d602a
-
Filesize
81KB
MD5838422629c1d8eb9e516893b81366c31
SHA10a771b9ebb2d7b5195d651b1eeecd929106f2294
SHA256e3552acf753b77ab7fa70fc53e13ac09dfd04eaa5448f761aa360e4f2112195e
SHA512848b337f4873c17078b36efd6de6c4786634af733ab6143e032d4daeb5646102c710b6eeb55913f574687d8e89de302648ba7986496c7a09fa9f6801fdb2572a
-
Filesize
724B
MD5c3ca008abd6997c4b036a7e8be75cb2c
SHA105f7a3527bb04c691b08f040f562582035398829
SHA25629ef6bf47dcc8c67f1abe1b269d3518d6a4ebe125daa1ea460779638cb9782a3
SHA512bee0baf3cb83144239077f99f5ca2a6ca7b618f7f51a53e03613ae697e8bc76fa28f5d006296b469be8e1fffeeb35668b5fe87b260b1380cc003815ea9efb083