Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/05/2024, 12:19
Static task
static1
Behavioral task
behavioral1
Sample
01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe
-
Size
92KB
-
MD5
01fd4daa9eaf6bcc9cfaa37efa2f3430
-
SHA1
fddfd69cb7fdec778088ed568656103c62c3e85f
-
SHA256
8e421dd3424223564c85b6f2c8d4db7e616669f24e2ced5cafe96d69a83f8e94
-
SHA512
fcdc4890fd25dd58648a0d6602ca130f2c61efcce12f31377b3cb2955758491e7fd1fbae5b4a1a060fffe9028b2568a443450abe189529b3bd7ba4de9350ab87
-
SSDEEP
768:54pt1NSf7M9Syk+IAnTjwm41tYhZV6pudcMiDh7FOaRb8RC1J3AFLT7Dm3UIn4Us:OVNSf7hyk+I6412V6PMqAax80XAFSrR+
Malware Config
Extracted
urelas
218.54.47.77
218.54.47.74
Signatures
-
Deletes itself 1 IoCs
pid Process 2196 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 1384 huter.exe -
Loads dropped DLL 1 IoCs
pid Process 1252 01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1252 wrote to memory of 1384 1252 01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe 28 PID 1252 wrote to memory of 1384 1252 01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe 28 PID 1252 wrote to memory of 1384 1252 01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe 28 PID 1252 wrote to memory of 1384 1252 01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe 28 PID 1252 wrote to memory of 1384 1252 01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe 28 PID 1252 wrote to memory of 1384 1252 01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe 28 PID 1252 wrote to memory of 1384 1252 01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe 28 PID 1252 wrote to memory of 2196 1252 01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe 29 PID 1252 wrote to memory of 2196 1252 01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe 29 PID 1252 wrote to memory of 2196 1252 01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe 29 PID 1252 wrote to memory of 2196 1252 01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\01fd4daa9eaf6bcc9cfaa37efa2f3430_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\huter.exe"C:\Users\Admin\AppData\Local\Temp\huter.exe"2⤵
- Executes dropped EXE
PID:1384
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "2⤵
- Deletes itself
PID:2196
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512B
MD5d8c69e006046149f40585fb3e1bfafb4
SHA197073fb1d116248dbecd009e4bf873ab45c6c2da
SHA256df1edebe6911c5127449117bdcec2878b0ecaff3e930a37e13aefe54363be228
SHA512b8f5c75fbbddbb185a82395b59f75802cf800dac792c7256261998f3b4a965f180a901f4bd4e873b1cec0ac7acb77e09ec793c8b19ac2d1fdf115e57c42626b9
-
Filesize
304B
MD59b6e321710b30ad900aa92e5cb30d191
SHA1e09bf7d2dc2af6b1ac030c9853a9639582c26888
SHA25684fd1df0d46564fafc29f3ed7b9e1fdf0f02dbbdd80166c1a713c4519c114f28
SHA51242d07d99d6d6e80bb85a7e09b5eb374b727182af1ee44b7893367d4406eb751b61a28ad2591be9f0cb455dd6849a1e90f3b20ef210079be89eb951e4aba31a7e
-
Filesize
92KB
MD5f5d943978595a5176fe6aee3aca57157
SHA188096c8297ec5101fe1c06c464f03fe3275f778d
SHA256af3d47c96fbc712ba82df328a7651419337703ca4965eed1e544658b686c672b
SHA512f3aeb079ac8225af6717803714f66050a72f73601b5108777c524f3182a36108cfd030be527d6f420e73cc24949c236070b3a1d4ff0b5561bf1d86594259078c