Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 02:17
Static task
static1
Behavioral task
behavioral1
Sample
63047fc25c05a1bde4471bb07d691630_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
63047fc25c05a1bde4471bb07d691630_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
63047fc25c05a1bde4471bb07d691630_NeikiAnalytics.exe
-
Size
74KB
-
MD5
63047fc25c05a1bde4471bb07d691630
-
SHA1
93c28f1b90fe85bea3fa647f791b904fda7ae592
-
SHA256
b1cc805032f6097c10dbb13811c55a64f3d6d5ade89cf3b4b42e7ab369e5f9ba
-
SHA512
32526f27660934406be3bacb62f6d2e6b48a78a0c7ec07cef28f26c0755129b69078002f168f6ca98bfc14fe41ae9c6af2ca52d7a489436eca9a329ff4f3529b
-
SSDEEP
1536:1HIVaam4XFsej94BpTjtkP0pzHrlFAREEP7VtmmH6O+nBI9M:qVaamMsA9CtkMpzLHHEjqmH6O+UM
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1952 ovsutoax.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ovsutoax.exe 63047fc25c05a1bde4471bb07d691630_NeikiAnalytics.exe File created C:\Windows\SysWOW64\ovsutoax.exe 63047fc25c05a1bde4471bb07d691630_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\63047fc25c05a1bde4471bb07d691630_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\63047fc25c05a1bde4471bb07d691630_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
PID:3576 -
C:\Windows\SysWOW64\ovsutoax.exe"C:\Windows\SysWOW64\ovsutoax.exe"2⤵
- Executes dropped EXE
PID:1952
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
71KB
MD5b1ab562ee8f1230bfbd85aaeb5e51771
SHA1f5756cd3dc7445d40d631e7967b171edd7471e31
SHA2567f6a06de321d50c3d7f8c27c8033fbe3053aa65393ea1862347e81591bc877aa
SHA5126dcaa37996918ab51916d1934f86a8ed51d8af633a4470cd035fcb8ac9ed36c2bc28d63f2fc6c920e37dc63275f35646536b46ff665e9acc243e52c6e8a1ad3b