Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
11/05/2024, 10:48
Static task
static1
Behavioral task
behavioral1
Sample
ae3d29b3487036dcf3ccc0e563766590_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
ae3d29b3487036dcf3ccc0e563766590_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
ae3d29b3487036dcf3ccc0e563766590_NeikiAnalytics.exe
-
Size
70KB
-
MD5
ae3d29b3487036dcf3ccc0e563766590
-
SHA1
c8731684f1c627e1d4bb8aa92158f36a25bcaa79
-
SHA256
b03d67ee2b2f73fdd2c9106fc0dd28802bf261faf12e5a1e5da013239cb703a6
-
SHA512
d58b6b0b6b156d4e36f142f106ed539068914ed28fc955befb3c3c6356f77650abdfb318042d441651efb637729b19e3452938cc0902f24145d6a3e2e32ac318
-
SSDEEP
1536:/4Cd+qitb0bt+FTCQ2w9EuTiHsdXzN6WeNy6pac:/H4b0he9EuTz1zs
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2904 conwurm.exe -
Loads dropped DLL 1 IoCs
pid Process 2056 ae3d29b3487036dcf3ccc0e563766590_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2056 wrote to memory of 2904 2056 ae3d29b3487036dcf3ccc0e563766590_NeikiAnalytics.exe 28 PID 2056 wrote to memory of 2904 2056 ae3d29b3487036dcf3ccc0e563766590_NeikiAnalytics.exe 28 PID 2056 wrote to memory of 2904 2056 ae3d29b3487036dcf3ccc0e563766590_NeikiAnalytics.exe 28 PID 2056 wrote to memory of 2904 2056 ae3d29b3487036dcf3ccc0e563766590_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae3d29b3487036dcf3ccc0e563766590_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ae3d29b3487036dcf3ccc0e563766590_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\conwurm.exe"C:\Users\Admin\AppData\Local\Temp\conwurm.exe"2⤵
- Executes dropped EXE
PID:2904
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
71KB
MD5425ad7d8419ad45bffcda6bf4f39e80b
SHA11f14363a16ddfb872504c6e3f2fecb7a1e59dbe0
SHA25609a6c3390a062d3823f102ec9ef90a09b1cebdba29fb10d79c15af0acbdca61e
SHA51238d39a33266086c99e4033699bfcbbfc1cd128c6cba1d232c21c27631f20daa4d47c7ab44fbe6ca8a5097ed4986e30b125ed2ba9ae8f00bdecf44015f0640b15