Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
16/05/2024, 00:31
Static task
static1
Behavioral task
behavioral1
Sample
62afd4d16db5edf8233efccde51d25d0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
62afd4d16db5edf8233efccde51d25d0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
General
-
Target
62afd4d16db5edf8233efccde51d25d0_NeikiAnalytics.exe
-
Size
1.2MB
-
MD5
62afd4d16db5edf8233efccde51d25d0
-
SHA1
e6a88a5f51e8c1c46dcf7eeb0307b00a4aa8100f
-
SHA256
77de0e0c2a83ab5135a1e3a1bb4ddeb1618d2fb72a635079ab5581b908257cdb
-
SHA512
9f19e5292b791adf97cc82e4d43224caced09532b6f1e8c2df8d88ab0ffdf20201b98eec47c4e05c1778234ee436baefb109327b57b1e0dd8451d7c50162cd3b
-
SSDEEP
24576:fXTff2BiQihB88nUSRNPf1BGqZ8MKEuibXJItWA:fXzfSMg8np1zGCUEuibXJItWA
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation 62afd4d16db5edf8233efccde51d25d0_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
pid Process 1084 dotnetchk.exe -
Loads dropped DLL 8 IoCs
pid Process 5096 MsiExec.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe 2500 rundll32.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4152 msiexec.exe Token: SeIncreaseQuotaPrivilege 4152 msiexec.exe Token: SeSecurityPrivilege 1448 msiexec.exe Token: SeCreateTokenPrivilege 4152 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4152 msiexec.exe Token: SeLockMemoryPrivilege 4152 msiexec.exe Token: SeIncreaseQuotaPrivilege 4152 msiexec.exe Token: SeMachineAccountPrivilege 4152 msiexec.exe Token: SeTcbPrivilege 4152 msiexec.exe Token: SeSecurityPrivilege 4152 msiexec.exe Token: SeTakeOwnershipPrivilege 4152 msiexec.exe Token: SeLoadDriverPrivilege 4152 msiexec.exe Token: SeSystemProfilePrivilege 4152 msiexec.exe Token: SeSystemtimePrivilege 4152 msiexec.exe Token: SeProfSingleProcessPrivilege 4152 msiexec.exe Token: SeIncBasePriorityPrivilege 4152 msiexec.exe Token: SeCreatePagefilePrivilege 4152 msiexec.exe Token: SeCreatePermanentPrivilege 4152 msiexec.exe Token: SeBackupPrivilege 4152 msiexec.exe Token: SeRestorePrivilege 4152 msiexec.exe Token: SeShutdownPrivilege 4152 msiexec.exe Token: SeDebugPrivilege 4152 msiexec.exe Token: SeAuditPrivilege 4152 msiexec.exe Token: SeSystemEnvironmentPrivilege 4152 msiexec.exe Token: SeChangeNotifyPrivilege 4152 msiexec.exe Token: SeRemoteShutdownPrivilege 4152 msiexec.exe Token: SeUndockPrivilege 4152 msiexec.exe Token: SeSyncAgentPrivilege 4152 msiexec.exe Token: SeEnableDelegationPrivilege 4152 msiexec.exe Token: SeManageVolumePrivilege 4152 msiexec.exe Token: SeImpersonatePrivilege 4152 msiexec.exe Token: SeCreateGlobalPrivilege 4152 msiexec.exe Token: SeCreateTokenPrivilege 4152 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4152 msiexec.exe Token: SeLockMemoryPrivilege 4152 msiexec.exe Token: SeIncreaseQuotaPrivilege 4152 msiexec.exe Token: SeMachineAccountPrivilege 4152 msiexec.exe Token: SeTcbPrivilege 4152 msiexec.exe Token: SeSecurityPrivilege 4152 msiexec.exe Token: SeTakeOwnershipPrivilege 4152 msiexec.exe Token: SeLoadDriverPrivilege 4152 msiexec.exe Token: SeSystemProfilePrivilege 4152 msiexec.exe Token: SeSystemtimePrivilege 4152 msiexec.exe Token: SeProfSingleProcessPrivilege 4152 msiexec.exe Token: SeIncBasePriorityPrivilege 4152 msiexec.exe Token: SeCreatePagefilePrivilege 4152 msiexec.exe Token: SeCreatePermanentPrivilege 4152 msiexec.exe Token: SeBackupPrivilege 4152 msiexec.exe Token: SeRestorePrivilege 4152 msiexec.exe Token: SeShutdownPrivilege 4152 msiexec.exe Token: SeDebugPrivilege 4152 msiexec.exe Token: SeAuditPrivilege 4152 msiexec.exe Token: SeSystemEnvironmentPrivilege 4152 msiexec.exe Token: SeChangeNotifyPrivilege 4152 msiexec.exe Token: SeRemoteShutdownPrivilege 4152 msiexec.exe Token: SeUndockPrivilege 4152 msiexec.exe Token: SeSyncAgentPrivilege 4152 msiexec.exe Token: SeEnableDelegationPrivilege 4152 msiexec.exe Token: SeManageVolumePrivilege 4152 msiexec.exe Token: SeImpersonatePrivilege 4152 msiexec.exe Token: SeCreateGlobalPrivilege 4152 msiexec.exe Token: SeCreateTokenPrivilege 4152 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4152 msiexec.exe Token: SeLockMemoryPrivilege 4152 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4152 msiexec.exe 4152 msiexec.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4364 wrote to memory of 1084 4364 62afd4d16db5edf8233efccde51d25d0_NeikiAnalytics.exe 84 PID 4364 wrote to memory of 1084 4364 62afd4d16db5edf8233efccde51d25d0_NeikiAnalytics.exe 84 PID 4364 wrote to memory of 1084 4364 62afd4d16db5edf8233efccde51d25d0_NeikiAnalytics.exe 84 PID 4364 wrote to memory of 4152 4364 62afd4d16db5edf8233efccde51d25d0_NeikiAnalytics.exe 87 PID 4364 wrote to memory of 4152 4364 62afd4d16db5edf8233efccde51d25d0_NeikiAnalytics.exe 87 PID 4364 wrote to memory of 4152 4364 62afd4d16db5edf8233efccde51d25d0_NeikiAnalytics.exe 87 PID 1448 wrote to memory of 5096 1448 msiexec.exe 90 PID 1448 wrote to memory of 5096 1448 msiexec.exe 90 PID 1448 wrote to memory of 5096 1448 msiexec.exe 90 PID 5096 wrote to memory of 2500 5096 MsiExec.exe 91 PID 5096 wrote to memory of 2500 5096 MsiExec.exe 91 PID 5096 wrote to memory of 2500 5096 MsiExec.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\62afd4d16db5edf8233efccde51d25d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\62afd4d16db5edf8233efccde51d25d0_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\VSD40D2.tmp\DotNetFXCustom\dotnetchk.exe"C:\Users\Admin\AppData\Local\Temp\VSD40D2.tmp\DotNetFXCustom\dotnetchk.exe"2⤵
- Executes dropped EXE
PID:1084
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\setup.msi"2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4152
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding EEC37348B6854A4A478E896E8B7EDBD0 C2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI43A0.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240600062 1 Elsinore.ScreenConnect.InstallerActions!Elsinore.ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
PID:2500
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
278KB
MD5917510603fea350089f54461aacf68b3
SHA15658cb673ad85a5a180369b6c2f5cdbf2218c249
SHA2565b1a39a19bd6a1518279f26410167f421f4bd13424c4991864a0d01918716cd3
SHA512d7109b6708960df83dcbb2d9f1bc20fbd4900198bb5da22175c4c931bc1a798be3dbb686db8df31955e6d9af12756f5c548aef053ca5e8b607e2eebf70bb073d
-
Filesize
194KB
MD523924527bd86ca334c12dd83e88d2a50
SHA14b8b83805ea8b55bc396c0fa35316034fc5816ca
SHA2563300e34d00dd61786c5de10a9e3937100bf34dc6e1d8e0e6d4ecede05ada12a9
SHA5126d864bd19247628c25ad2a2a96c8d3b286207e7318472c5fe2294dab581d6f0104bd3df66ca304d1f2c0bb849f0aaab865022701b99b601788a52e20934d4bbd
-
Filesize
19KB
MD5f42d069afa3ee6baf401cc3b7e3cda4e
SHA1acf9d6da264c1956a15fa6d3721ab59c7c0d91c7
SHA256bfad49fd279aefc7fd9189fa4e27015921bf49bf923483526135c401ebf1aa28
SHA512248a9bb3d8b80cd3deffdf4a817a2d190dd105b391ac0b1828b53b3c09fcc10f0dce4afc0c17a21d7078d50961e431114695aab538f6bf659d39e4be44def7aa
-
Filesize
176KB
MD51e5a0962f20e91ca18bc150266e6f49e
SHA1e71caab3b88b2913178ca2ae549a00455679cd4e
SHA256fa74ae4d5e62a1cc7cfeaa55d84fe9bddab06651b6744fb4469074e79317da99
SHA51209021a2183536d07d915e413bd70fbd47f6afcf9fa9b8deb886f473c7b3dc3ee3e042c126f644be70f42f491692fab0a25b49ef88099caf272eec75c5bd2fc1f
-
Filesize
85KB
MD54992d98e6772a5fd7256c4c7fe978a11
SHA16cf70905908b59553e1b92e057c3e7c13bd7b6a4
SHA2565494efb1859e625eff5c2b51a66058fd7ffe1aa619594f62900a0bef392012d0
SHA5128afdda6a49a4c61c62e329f3d15dc31c98327fd720e654972b14f98112b79d293648cad0dd08b3d12e48e020dd21fe40f9fc0a6c78014e1434a1703f40f6f4d8
-
Filesize
770KB
MD570206698d16e35dec55695647938eb5f
SHA1b04ae41f5ead31ca6ff46161acb82868a38b7077
SHA256db713be6eba2bf2d24d740daf0249ed2b22fbdd534c3890197411ea2cee3df61
SHA5128a0ce37b2f33b7aaa0ac4f74c6d719124c873d32eb75c62417ee156f56eee1bbd072daf54cbf716ef54e884cce593202a36a815cef77e874530af0187b4de89f