Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13/05/2024, 21:54
Static task
static1
Behavioral task
behavioral1
Sample
23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe
-
Size
246KB
-
MD5
23c5b85a0a85036d4440ebf88f7fe7b0
-
SHA1
15a1fc90fb6518c7d8ab007f1f75c7fe4c3ff7bd
-
SHA256
681ff32af98b617be733a2c6b5a525004d1c8b2698cfbb8762d56aede2c04bcd
-
SHA512
deb9ca5785ab7ad6ed241e33e49fe81cbcd36a37e285473cd0fa1c612dd6b99aaf1f3424c11b5cf36de92b13d24f122fcf0347afea5280c412ad9045d09ef081
-
SSDEEP
6144:VZSE8UGJwiYwUfWeR7oHYnOW111mFW+9fOL:33GFY/jWHYt1yW+9fk
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened (read-only) \??\H: 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened (read-only) \??\I: 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened (read-only) \??\K: 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened (read-only) \??\L: 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened (read-only) \??\M: 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened (read-only) \??\O: 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened (read-only) \??\E: 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened (read-only) \??\J: 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened (read-only) \??\N: 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Internet Explorer\iediagcmd.cab 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.cab 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXD8A.tmp 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\DVDMaker.exe 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.cab 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\DVD Maker\RCXD2F.tmp 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.cab 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File created C:\Program Files\readme.1xt 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\RCXE21.tmp 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\RCXCCA.tmp 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.cab 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\RCXE11.tmp 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.cab 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.cab 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\RCXC70.tmp 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\DVD Maker\RCXD0F.tmp 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXD65.tmp 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\Internet Explorer\RCXEAA.tmp 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\RCXCB5.tmp 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.cab 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\Internet Explorer\RCXE92.tmp 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\RCXC81.tmp 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\RCXDDF.tmp 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXD89.tmp 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\RCXC93.tmp 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\RCXDCD.tmp 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\RCXE70.tmp 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\7zFM.cab 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXD9C.tmp 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\RCXDE0.tmp 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.cab 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\Internet Explorer\RCXEA9.tmp 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXD52.tmp 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.cab 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\DVD Maker\RCXD0E.tmp 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\7z.cab 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\RCXDCE.tmp 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.cab 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXD87.tmp 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXD63.tmp 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.cab 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\RCXCB4.tmp 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\7zFM.cab 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\DVD Maker\DVDMaker.cab 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCXD9B.tmp 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.cab 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\RCXE10.tmp 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\7z.cab 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\chrome.cab 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\RCXDCC.tmp 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe 23c5b85a0a85036d4440ebf88f7fe7b0_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
544KB
MD59a1dd1d96481d61934dcc2d568971d06
SHA1f136ef9bf8bd2fc753292fb5b7cf173a22675fb3
SHA2568cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525
SHA5127ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa
-
Filesize
246KB
MD523c5b85a0a85036d4440ebf88f7fe7b0
SHA115a1fc90fb6518c7d8ab007f1f75c7fe4c3ff7bd
SHA256681ff32af98b617be733a2c6b5a525004d1c8b2698cfbb8762d56aede2c04bcd
SHA512deb9ca5785ab7ad6ed241e33e49fe81cbcd36a37e285473cd0fa1c612dd6b99aaf1f3424c11b5cf36de92b13d24f122fcf0347afea5280c412ad9045d09ef081
-
Filesize
930KB
MD530ac0b832d75598fb3ec37b6f2a8c86a
SHA16f47dbfd6ff36df7ba581a4cef024da527dc3046
SHA2561ea0839c8dc95ad2c060af7d042c40c0daed58ce8e4524c0fba12fd73e4afb74
SHA512505870601a4389b7ed2c8fecf85835adfd2944cbc10801f74bc4e08f5a0d6ecc9a52052fc37e216304cd1655129021862294a698ed36b3b43d428698f7263057
-
Filesize
236KB
MD537decee0d02084982526f2514754252b
SHA1167191ae5bef60e5a8ecec5b565a0233bd75e3ba
SHA2562679aab908667675501798a9c50d6f271526f143a51d72f7b6d3a4437df628d6
SHA5128b995d56e0c4ac4d3209a53dffd1e756ed27dcd1ca00592be4a67382b3e3065458989d0daaee2468977d2ac40fcc1dd6aba00494011740d6a2b1de1c4ac54cbe
-
Filesize
188KB
MD5f03cd3c73a4d56421c60e6f2a40a9ef2
SHA13e7b8c15ba83c23333740af3aa4c4b3066fe5173
SHA25644fc47dc280a196cc49849cfb770030f1525758ba266330b6232ee60fb4fe642
SHA512ba57d32ffe4d0ecca137aed733c1471b4663dcba07a4c4fffcffc008a051de86fd8561bdd93d5fff545bf1865c8b5ac71eae31d20228727f5c1a46f2f9a6390e
-
Filesize
906KB
MD584ff6c209447a056e22a29806bfa2c96
SHA121190928955094c44ad996f26c801b46437809cc
SHA256d2072ffe011341ec2a3c4af9f93b06deffa92fa05120c45dbb3ad5635f3e57b1
SHA5126493dfbe43887e6a588ef067960ddb9e9798e07bb14fd73abf99acc5ee63250858c86d70a926f009f466bf6fedb7ca43bbecf7fc2433e47704527c2d0b6b01d9
-
Filesize
2.2MB
MD5e83d2495d5867e224fbf42ef40d8856c
SHA1fec908e0e7bc469875ab8f68d936225c635a6ac2
SHA2562c806d9b932f24c4bc84e86ced7962a75c0161ff732f77eb1827a3a14976b2c1
SHA512e22f36cb40fff2672e9e49aa991656a0cc1188c7ba2583efae2d238a4e864bd5f8bdc532a5c35285ca2b4b105097454eb06d5860c41e618c44bab6e300408b8d
-
Filesize
2.2MB
MD5f56161efdeee267a188bb1800c725c04
SHA19f5cf40f112be8cc27fd10186bfa9b58191e36c2
SHA256dc3fcaf700b8105152f362d6b32ad161289753f8a55039eeea81cfcbd6ddff4d
SHA51227f3928be8380909c4b83578d2adf1b0fa3677f494a83585ad2db5a41ee1319bc205bd97f2180253ca30503200934284471043d7eebd86acf3bbc27219e92398
-
Filesize
4.3MB
MD52161730a7ae00a1fb8c5020a43be949f
SHA18db6b820472cdfa266c874e0d3a9395412995aa1
SHA25607e7896b2304e3b9966294a02d2ed32f41994ee7bd0a284e4160743edaeb9e15
SHA512aa3659b6184f4273b7fcf1f7d2cd0a5a9129b8856d15e4ca8904b709e85cd432538ce0510ca9777760a1a9d5391671232a79908860e7d665260a54910f6fea5a
-
Filesize
1.5MB
MD5f22cd3cc2e3b4c32e662f58d676f2409
SHA13b79f1edbaf507401fc8d11aa2d0f5b948ca1be2
SHA256006fbeca22a89fbd281eb008313d752aaa59a2fe944c1d92539d00f3e60d4d4f
SHA512949f09504ce931e5291f987fdc99a8f62e1e34452b896f2e2fcbce4c95ccffe2fe025478e6f5f869f9a7b40c10cf4003ab360aca1a7f91180edda771a8098afe
-
Filesize
1.6MB
MD5527e039ba9add8a7fac3a6bc30a6d476
SHA1729a329265eda72cada039c1941e7c672addfc19
SHA2564b8a72fc81b733ed2e6e70d4c5401f954002783dbf14927849ad579860780b94
SHA5129e73e14e33a5f07a87e9c1fecfdaee09d1408471052aacfde3d1e877dad4d253b525ebefca6bddabc23cf81d8dcce0785aedcc2f135d171ecbb1feaeb922c449
-
Filesize
1.6MB
MD5ec6386b63c3a5ffe0577905e94262c3a
SHA18f8c428d0e7f32c9d733ca28384ded413a060588
SHA256302c968ab3e1227d54df4e72f39088d7483d25eeb3037f0b16bc39cef2728fa4
SHA512ddbefb759858493de1f9d7addc6ff4488c8be3164374e0a88c3cbe97751510005dfe6d91c5499fcbdc35aa33a8eda2d45591a66e54ab9462277dc833faef77c3
-
Filesize
170KB
MD532e2cae7e76918b070f8c32616ab6bd5
SHA10aa207dea9e3cf5669b6f486cf9c660825b4f4b9
SHA25658f07057ad332b7ce92d297fccb1636e5c6a1bd5b7b770adaee6b5a09a0b2e79
SHA5127d2f860072871e603d389bb81222168050819d25c5de1176beb8520159aae0a40526aec7c40cf9f26e09a85bfa3f72e6426887bd9f927c1756261a52acc09845
-
Filesize
2.8MB
MD5095092f4e746810c5829038d48afd55a
SHA1246eb3d41194dddc826049bbafeb6fc522ec044a
SHA2562f606012843d144610dc7be55d1716d5d106cbc6acbce57561dc0e62c38b8588
SHA5127f36fc03bfed0f3cf6ac3406c819993bf995e4f8c26a7589e9032c14b5a9c7048f5567f77b3b15f946c5282fc0be6308a92eab7879332d74c400d0c139ce8400
-
Filesize
193KB
MD53a5b2ea749e4fa19db431d819abd43e7
SHA11728d71c0ca50857909bb5054a886ab6ad117ffa
SHA25637bfba349edf7da3cd787af6d9c51d3c17f94eef00040c430b0ff4be968523e9
SHA51275911f7ed848cbff6981ef92a6f7447e3202ac5d046b4d75ce16a5a691ffe714fd8b8fa7c1900209bff7a28c2cf0e2de7552a985a33552c1756707b12493d042
-
Filesize
1.5MB
MD589c8ec56440f2fa5e0779cface82af81
SHA16c40caba7a31afc589a195dc412b2ec0a04d09de
SHA25612caf9aad85f249f602ec130c0ce2258b380753d94084dc4b05eb13b9190095e
SHA5127892c0d0a57cbe7574fc8e70f0b71c5016513e9ce5ef0a737de09080ef0f6653696e145d29a1a94fb3c81fbbd5f7b6cd13cb0b83e1efae5238ed3cfc7b3c4ab0
-
Filesize
246KB
MD524e3eab59da95b6e91b6f12b37fa69e2
SHA19e2e406c77fe246900aaf624971952abede01046
SHA256595018f29dba2f86ed0cb3aad3a8ee119b8b049267f33a0cfd11371fb2971352
SHA5123bb4e6029df1aa83d9b7217467b23bc23b3c167f365dcdf8eb0529cdb7e49068b1fb0210d59e3f409ed097a608401f21f715e4c92b857c043bfb38d8abc4c0f6
-
Filesize
1020KB
MD5b65d7344b0a7faa207d2e1a7adaafb60
SHA1755ad15b1745b0e730d658d4a92e2b754425b7db
SHA256f4b91fbbcba8a46eefe4965e4a24c6ede3decbd1fec96e141a1953173efd1c92
SHA512f17ac73c2df7c73a31b11ce0f533d6db91bdb0cdeea653dcd52ac72c3cf28da0c236b79586ddc7a6c825fdd171290722f888465e776f12ac2cae75be82726b22
-
Filesize
351KB
MD541f922d6a794c0f8425c8436d7077c84
SHA1bc8132703b9c003a88e72733ffebc48f76a82258
SHA256412df2da4d524e6b78ed6c7bc595224643574510fba194ee940e495d981a6510
SHA5122c30a1eb85197866e85244fa341071cd1c2505fe1cf4e735a3d82ae303778a17ac8522395d761f101c6b5a5596e4459a3de33765c9addbe34e241aeef5af954a
-
Filesize
469KB
MD570d721cc971a9effcf7845cefbb02704
SHA1e8bfd33b8bc368c5b4586b42e925e3cea458bddb
SHA256f7443fc06e9598ddfd8dd09f507f76b037c7bf3d08e9694f9d3abbd05e258bd3
SHA512c0b17c4ec30fa89b00e42d6310cf717fa4e8eb8da9b6c37890ccf95e03b0589e8ac074a3572004983d57b5d00806a6efd5b2d9f53731b76b119c0abcf9453d0a