Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
13/05/2024, 09:23
Static task
static1
Behavioral task
behavioral1
Sample
ae231849bc431244b466e9016f4cfdf0_NeikiAnalytics.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
ae231849bc431244b466e9016f4cfdf0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
ae231849bc431244b466e9016f4cfdf0_NeikiAnalytics.exe
-
Size
34KB
-
MD5
ae231849bc431244b466e9016f4cfdf0
-
SHA1
cb2588d7a5ac1c727d011893b0c7aac041122d05
-
SHA256
c5c2ad315ecb44dc38f5e687fa9b8a23023e984ef31d1514cd211e81bccd7ea6
-
SHA512
4602d8d9ff6e6a4e337f3709491a50672448a63af5b8acd5b4c2e2de94d7600feb5ea41d9ec012ccbdba773f0f1d64384b1e0824b508d97d86cb7329498c0022
-
SSDEEP
768:6B7HBXFw82t2C80lyaZ4jX05Rftleo9LXm4g:u7HZFwzlyaZTNAaG
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation ae231849bc431244b466e9016f4cfdf0_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
pid Process 2708 cnwog.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4712 wrote to memory of 2708 4712 ae231849bc431244b466e9016f4cfdf0_NeikiAnalytics.exe 82 PID 4712 wrote to memory of 2708 4712 ae231849bc431244b466e9016f4cfdf0_NeikiAnalytics.exe 82 PID 4712 wrote to memory of 2708 4712 ae231849bc431244b466e9016f4cfdf0_NeikiAnalytics.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae231849bc431244b466e9016f4cfdf0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ae231849bc431244b466e9016f4cfdf0_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\cnwog.exe"C:\Users\Admin\AppData\Local\Temp\cnwog.exe"2⤵
- Executes dropped EXE
PID:2708
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
34KB
MD52afac02dcab6e571bd39d1652784c170
SHA1a81eff8dd648c0daa43cba77cf6daa3d9cb2cd69
SHA256d52d0a7b1e6ee05a6badc04d4b271bb59588c906c1423a0545178abcb5f91a8b
SHA512d51c635c2f506d68022d5b4602da478bb956d44db06728de7cb86c03c81fc2008a109f5d9db136ae9a52ec22c0849e1986b3a376d3264d4df359d0da007d4368