Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/05/2024, 05:45
Static task
static1
Behavioral task
behavioral1
Sample
8b72719cde7c92b37bb9739f25f5ee70_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8b72719cde7c92b37bb9739f25f5ee70_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
8b72719cde7c92b37bb9739f25f5ee70_NeikiAnalytics.exe
-
Size
192KB
-
MD5
8b72719cde7c92b37bb9739f25f5ee70
-
SHA1
dd1384d9e174e3f77c7866d416279fbfe81f49fe
-
SHA256
2edb36a04587a2190ff2024880b2349dcfb5f46c57d5947f1230474d89743327
-
SHA512
744328681a08377224aca829ea5bd5586e6e24bd9cc9ebb64f34c3353679a5efdf13794492886c28eee506828ebda4d0d3f77c5a6622d6e9edffafa61b8fcea4
-
SSDEEP
3072:E+eYVwTVQsoNW7aNJAlKiufw59ck+RABrMAcBSOX5NwnA74NNI4gRSsuCZq:swxN6cJAwbw06lMhBSOX9ENIDEqZq
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1196 8b72719cde7c92b37bb9739f25f5ee70_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
pid Process 1196 8b72719cde7c92b37bb9739f25f5ee70_NeikiAnalytics.exe -
Loads dropped DLL 1 IoCs
pid Process 2856 8b72719cde7c92b37bb9739f25f5ee70_NeikiAnalytics.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1196 8b72719cde7c92b37bb9739f25f5ee70_NeikiAnalytics.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2856 8b72719cde7c92b37bb9739f25f5ee70_NeikiAnalytics.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 1196 8b72719cde7c92b37bb9739f25f5ee70_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2856 wrote to memory of 1196 2856 8b72719cde7c92b37bb9739f25f5ee70_NeikiAnalytics.exe 28 PID 2856 wrote to memory of 1196 2856 8b72719cde7c92b37bb9739f25f5ee70_NeikiAnalytics.exe 28 PID 2856 wrote to memory of 1196 2856 8b72719cde7c92b37bb9739f25f5ee70_NeikiAnalytics.exe 28 PID 2856 wrote to memory of 1196 2856 8b72719cde7c92b37bb9739f25f5ee70_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b72719cde7c92b37bb9739f25f5ee70_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8b72719cde7c92b37bb9739f25f5ee70_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\8b72719cde7c92b37bb9739f25f5ee70_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\8b72719cde7c92b37bb9739f25f5ee70_NeikiAnalytics.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
PID:1196
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
MD56c3095dbd0dbd712b44af36d2001b89b
SHA1c2e3cc3178b858d5a6f727201fc90b384e1d8ce1
SHA2569caccfe827519bdf369b63e191ab1af5fd5f2070dc1b78bdba8449cb9d5f3446
SHA51231114fdc937d41aa204cebce266fbdf1ef0e95dce70d1a8160e5a72e041ab0710c2fe7d07ea759418d91c495f5077d0f0cc4e97c3fe6598969a4a19a67b12b4a