Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

3504126f58...cs.exe

windows7-x64

7

3504126f58...cs.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    159s
  • max time network
    163s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/05/2024, 23:24 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3504126f5879cb606d7f09f2f5ec1a00_NeikiAnalytics.exe

  • Size

    34KB

  • MD5

    3504126f5879cb606d7f09f2f5ec1a00

  • SHA1

    cb0d24852203fa11d979a75fbeb9e6b87fbd55c2

  • SHA256

    d9ef2c516e74ce8d597255c5d29570909394ff3f2f4a8778c00fddaaca79045c

  • SHA512

    4163cf8d7f7aff644075d5bedad5af51f4f0e43d5c9b59336795596c05c48ddec390ac89553221128999fe39e0b819d5ed6fea9b530f3c30e3ba1e3c336f2a8f

  • SSDEEP

    768:/qPJtHA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNhg:/qnA6C1VqaqhtgVRNToV7TtRu8rM0wY

Score
7/10
persistence

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in Windows directory 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3504126f5879cb606d7f09f2f5ec1a00_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\3504126f5879cb606d7f09f2f5ec1a00_NeikiAnalytics.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:3192
    • C:\Windows\microsofthelp.exe
      "C:\Windows\microsofthelp.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:2400
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4140 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:4056

    Network

    • flag-us
      DNS
      159.113.53.23.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      159.113.53.23.in-addr.arpa
      IN PTR
      Response
      159.113.53.23.in-addr.arpa
      IN PTR
      a23-53-113-159deploystaticakamaitechnologiescom
    • flag-us
      DNS
      241.150.49.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      241.150.49.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      172.210.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.210.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      50.23.12.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      50.23.12.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      18.31.95.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      18.31.95.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      68.159.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      68.159.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      68.159.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      68.159.190.20.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      21.121.18.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      21.121.18.2.in-addr.arpa
      IN PTR
      Response
      21.121.18.2.in-addr.arpa
      IN PTR
      a2-18-121-21deploystaticakamaitechnologiescom
    • flag-us
      DNS
      58.55.71.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      58.55.71.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      11.227.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      11.227.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      240.221.184.93.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      240.221.184.93.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      227.162.46.104.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      227.162.46.104.in-addr.arpa
      IN PTR
      Response
    • 13.107.253.64:443
      46 B
       40 B
       1
      1
    • 8.8.8.8:53
      159.113.53.23.in-addr.arpa
      dns
      72 B
       137 B
       1
      1

      DNS Request

      159.113.53.23.in-addr.arpa

    • 8.8.8.8:53
      241.150.49.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      241.150.49.20.in-addr.arpa

    • 8.8.8.8:53
      172.210.232.199.in-addr.arpa
      dns
      74 B
       128 B
       1
      1

      DNS Request

      172.210.232.199.in-addr.arpa

    • 8.8.8.8:53
      50.23.12.20.in-addr.arpa
      dns
      70 B
       156 B
       1
      1

      DNS Request

      50.23.12.20.in-addr.arpa

    • 8.8.8.8:53
      18.31.95.13.in-addr.arpa
      dns
      70 B
       144 B
       1
      1

      DNS Request

      18.31.95.13.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      146 B
       144 B
       2
      1

      DNS Request

      95.221.229.192.in-addr.arpa

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      68.159.190.20.in-addr.arpa
      dns
      144 B
       158 B
       2
      1

      DNS Request

      68.159.190.20.in-addr.arpa

      DNS Request

      68.159.190.20.in-addr.arpa

    • 8.8.8.8:53
      21.121.18.2.in-addr.arpa
      dns
      70 B
       133 B
       1
      1

      DNS Request

      21.121.18.2.in-addr.arpa

    • 8.8.8.8:53
      58.55.71.13.in-addr.arpa
      dns
      70 B
       144 B
       1
      1

      DNS Request

      58.55.71.13.in-addr.arpa

    • 8.8.8.8:53
      11.227.111.52.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      11.227.111.52.in-addr.arpa

    • 8.8.8.8:53
      240.221.184.93.in-addr.arpa
      dns
      73 B
       144 B
       1
      1

      DNS Request

      240.221.184.93.in-addr.arpa

    • 8.8.8.8:53
      227.162.46.104.in-addr.arpa
      dns
      73 B
       147 B
       1
      1

      DNS Request

      227.162.46.104.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\microsofthelp.exe
      Filesize

      34KB

      MD5

      38aee43b72aa21fbf18eeb5cd29e6ded

      SHA1

      0af8901f95bfc532abb73ff6e719cf673443c354

      SHA256

      a339d6fe313bf9f7a00e480d3c095279dc8b6092e6e2173ace2ad395df0848bd

      SHA512

      aea526309934bacd5173a13f4a3fa76f0ee325edc31ceb530f82e8289b5d94fff38fc032bf4d808a5556bde5937a734804dae5be615847976ca4973d9b0592fc

      Download Submit

    • memory/3192-0-0x0000000000400000-0x0000000000403000-memory.dmp

      Filesize

      12KB

      Download

    • memory/3192-5-0x0000000000400000-0x0000000000403000-memory.dmp

      Filesize

      12KB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.