Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 18:59
Static task
static1
Behavioral task
behavioral1
Sample
19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe
-
Size
40KB
-
MD5
19221f0dd9766ba9f9361f52447f6d20
-
SHA1
26ba3de7e0a5c6bf4efbd3da45a5209dc253fc59
-
SHA256
c1477f99bf737702d1de157b752acc7b4989b78c1027dc4f109b77b7b076b312
-
SHA512
50da9583935a2b5d3461c6cab13eb168f11f665925b569dda221d8e881171b8b4120d8fbccfb9dc6bcb209f70e0fbf70549e4cc179cf4fee3816bf135f2c1e2e
-
SSDEEP
768:kvfko/XiYUsWEzQp8F9bdHXtHs7CQpcdHoCCvc:kEKZWm+8F95NWee1vc
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Admin.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation 19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
pid Process 2952 Admin.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\Admin.exe" 19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\Admin.exe" Admin.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1396 19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe 1396 19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe 1396 19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe 1396 19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe 1396 19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe 1396 19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe 2952 Admin.exe 2952 Admin.exe 1396 19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe 1396 19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe 1396 19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe 1396 19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe 1396 19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe 1396 19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe 2952 Admin.exe 2952 Admin.exe 1396 19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe 1396 19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe 2952 Admin.exe 2952 Admin.exe 1396 19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe 1396 19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe 2952 Admin.exe 2952 Admin.exe 1396 19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe 1396 19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe 2952 Admin.exe 2952 Admin.exe 1396 19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe 1396 19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe 2952 Admin.exe 2952 Admin.exe 1396 19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe 2952 Admin.exe 2952 Admin.exe 1396 19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe 1396 19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe 2952 Admin.exe 1396 19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe 2952 Admin.exe 2952 Admin.exe 1396 19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe 1396 19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe 2952 Admin.exe 1396 19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe 2952 Admin.exe 1396 19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe 2952 Admin.exe 2952 Admin.exe 1396 19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe 2952 Admin.exe 1396 19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe 1396 19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe 2952 Admin.exe 1396 19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe 2952 Admin.exe 2952 Admin.exe 1396 19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe 1396 19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe 2952 Admin.exe 2952 Admin.exe 1396 19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe 1396 19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe 2952 Admin.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1396 19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe 2952 Admin.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1396 wrote to memory of 2952 1396 19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe 87 PID 1396 wrote to memory of 2952 1396 19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe 87 PID 1396 wrote to memory of 2952 1396 19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\19221f0dd9766ba9f9361f52447f6d20_NeikiAnalytics.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Users\Admin\Admin.exe"C:\Users\Admin\Admin.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2952
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD5749a621f1e590d41aa0cd0db05921390
SHA15345bea7a2daac7085131d6279af71fdaebd91de
SHA256f06840f2545cb1c00cf871b42fc11cc0b328e1ed0bfccee0279b03754fbe0352
SHA5125213534640766eb72afb0a436029fc7ad1f7835db39d2472d854fd5b5a3295c4b8dfcf38fac77f8651082cba43e0677e92390622da37bb57512748ca71ea3524