Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    11/05/2024, 05:45

General

  • Target

    8b72719cde7c92b37bb9739f25f5ee70_NeikiAnalytics.exe

  • Size

    192KB

  • MD5

    8b72719cde7c92b37bb9739f25f5ee70

  • SHA1

    dd1384d9e174e3f77c7866d416279fbfe81f49fe

  • SHA256

    2edb36a04587a2190ff2024880b2349dcfb5f46c57d5947f1230474d89743327

  • SHA512

    744328681a08377224aca829ea5bd5586e6e24bd9cc9ebb64f34c3353679a5efdf13794492886c28eee506828ebda4d0d3f77c5a6622d6e9edffafa61b8fcea4

  • SSDEEP

    3072:E+eYVwTVQsoNW7aNJAlKiufw59ck+RABrMAcBSOX5NwnA74NNI4gRSsuCZq:swxN6cJAwbw06lMhBSOX9ENIDEqZq

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8b72719cde7c92b37bb9739f25f5ee70_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\8b72719cde7c92b37bb9739f25f5ee70_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2856
    • C:\Users\Admin\AppData\Local\Temp\8b72719cde7c92b37bb9739f25f5ee70_NeikiAnalytics.exe
      C:\Users\Admin\AppData\Local\Temp\8b72719cde7c92b37bb9739f25f5ee70_NeikiAnalytics.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of UnmapMainImage
      PID:1196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\8b72719cde7c92b37bb9739f25f5ee70_NeikiAnalytics.exe

    Filesize

    192KB

    MD5

    6c3095dbd0dbd712b44af36d2001b89b

    SHA1

    c2e3cc3178b858d5a6f727201fc90b384e1d8ce1

    SHA256

    9caccfe827519bdf369b63e191ab1af5fd5f2070dc1b78bdba8449cb9d5f3446

    SHA512

    31114fdc937d41aa204cebce266fbdf1ef0e95dce70d1a8160e5a72e041ab0710c2fe7d07ea759418d91c495f5077d0f0cc4e97c3fe6598969a4a19a67b12b4a

  • memory/1196-12-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/1196-13-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/1196-18-0x0000000000180000-0x00000000001B8000-memory.dmp

    Filesize

    224KB

  • memory/2856-2-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/2856-10-0x0000000000340000-0x0000000000378000-memory.dmp

    Filesize

    224KB

  • memory/2856-9-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB