Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
96s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2024, 04:23
Behavioral task
behavioral1
Sample
7c2827ed0020fe6dedb95d9b329de460_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7c2827ed0020fe6dedb95d9b329de460_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
7c2827ed0020fe6dedb95d9b329de460_NeikiAnalytics.exe
-
Size
138KB
-
MD5
7c2827ed0020fe6dedb95d9b329de460
-
SHA1
a74123601a89166ac88abfdfea9e857903abefd9
-
SHA256
33bcca4963612bb10c2c64d262b9939d2a1e596e8db408fe338d6299abe51bb5
-
SHA512
41d3cf593736981260b356e6a1acf9e56d82898a98a66282b6b91cf3d72ea36b074d0ea1d3c78b65ab1dd11e018639646bb1b659f3fd536fbdee487a7db2a4e5
-
SSDEEP
3072:+OpFhrH21lww+dvnNjC5zxFiMxkqC4giUvQkuPcA1Khe2yU:Jp7H2fadvNu5zKIpC4gnvQkw71IyU
Malware Config
Signatures
-
Modifies AppInit DLL entries 2 TTPs
-
resource yara_rule behavioral2/files/0x0007000000022ae0-5.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 2492 ykjyebb.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\PROGRA~3\Mozilla\ykjyebb.exe 7c2827ed0020fe6dedb95d9b329de460_NeikiAnalytics.exe File created C:\PROGRA~3\Mozilla\pjitnjk.dll ykjyebb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c2827ed0020fe6dedb95d9b329de460_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7c2827ed0020fe6dedb95d9b329de460_NeikiAnalytics.exe"1⤵
- Drops file in Program Files directory
PID:4196
-
C:\PROGRA~3\Mozilla\ykjyebb.exeC:\PROGRA~3\Mozilla\ykjyebb.exe -aryugnm1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2492
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
138KB
MD5a8c3db1165a80d61dffbde10333e6adf
SHA16626048b72ccde04cb9e30f82d652b3e2ccb6a0c
SHA25695630acb498e64f55259cb97e99d6b0d3df77b46621af6e5d05abc17e4a15369
SHA5128556412107cee3917bea82e7f91104f7ffa64e70ba8c4893f84e4f23aaa2622eea195fdcf17380302fbceae4859220638ebabaf25dc34f7547084efd9458810b