Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
16/05/2024, 11:49
Static task
static1
Behavioral task
behavioral1
Sample
dd506d571a7697244adf4e504ad335c0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
dd506d571a7697244adf4e504ad335c0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
dd506d571a7697244adf4e504ad335c0_NeikiAnalytics.exe
-
Size
96KB
-
MD5
dd506d571a7697244adf4e504ad335c0
-
SHA1
7341cdf9a932e6892dfc4afd7ed61047050dafc3
-
SHA256
8a646ce4cd15aed49beae8805bed37b9ab6ebce7e23df35bc70873946da910bd
-
SHA512
274b775ea9b9e934e9518a32d8b3a75210046f50df68fca9ee81562017054f46365a8d8c72395b2af07c58af12f7905d4b006e353ed5af01331d25fc8d637628
-
SSDEEP
3072:vAowVFgjQiUkEwtSXqhwDKopH0jIInjjnjjnjnjnjnjj3Q1aaCCCNapEa6hOhCZ4:oAjTUkf7
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2536 microsofthelp.exe -
Executes dropped EXE 1 IoCs
pid Process 2536 microsofthelp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe" dd506d571a7697244adf4e504ad335c0_NeikiAnalytics.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\microsofthelp.exe dd506d571a7697244adf4e504ad335c0_NeikiAnalytics.exe File created C:\Windows\HidePlugin.dll microsofthelp.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2732 wrote to memory of 2536 2732 dd506d571a7697244adf4e504ad335c0_NeikiAnalytics.exe 83 PID 2732 wrote to memory of 2536 2732 dd506d571a7697244adf4e504ad335c0_NeikiAnalytics.exe 83 PID 2732 wrote to memory of 2536 2732 dd506d571a7697244adf4e504ad335c0_NeikiAnalytics.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd506d571a7697244adf4e504ad335c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\dd506d571a7697244adf4e504ad335c0_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\microsofthelp.exe"C:\Windows\microsofthelp.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Drops file in Windows directory
PID:2536
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD5347df92e116952b38419d5b500026b20
SHA1b786b6975292685adef7ac1350be0cdc2bb7f3e2
SHA256585078475be23ee8bbe020bc9c1ead02ce6c95c3a20a18bad7d5b9dc114f0411
SHA5127d59a9b3c6328aa473ce3d60c82e67c4af9758c0be3a2060786b512a62fbb91366832e31ab5d3b8b248a1094681c7a6d33ce0a911ec9608541c5a717f49d78a3