Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
24s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16/05/2024, 14:29
Static task
static1
Behavioral task
behavioral1
Sample
e20378233e152e294187c52de5607850_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e20378233e152e294187c52de5607850_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
e20378233e152e294187c52de5607850_NeikiAnalytics.exe
-
Size
538KB
-
MD5
e20378233e152e294187c52de5607850
-
SHA1
314a4f7f1284c18a48ff6ba08a4b5d87288bd15e
-
SHA256
e7b8b8eb6306809f9eeb2a092f8b3582eb735791b7896d7fdb00e8a7f65689e1
-
SHA512
92936641c5864311a6858207d6bf08b5d0bcf562c56c35ebc83eb3b4a20d8107922f561fa1770d6b7a79d3410ff19349604d18e332dfbf9ac330e042cf3fe9a3
-
SSDEEP
12288:wlbd+h1gL5pRTcAkS/3hzN8qE43fm78Vb:Wbd+w5jcAkSYqyEb
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 5024 MSWDM.EXE 100 MSWDM.EXE 4644 E20378233E152E294187C52DE5607850_NEIKIANALYTICS.EXE 4104 MSWDM.EXE -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE" MSWDM.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE" e20378233e152e294187c52de5607850_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE" e20378233e152e294187c52de5607850_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE" MSWDM.EXE -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\WINDOWS\MSWDM.EXE e20378233e152e294187c52de5607850_NeikiAnalytics.exe File opened for modification C:\Windows\dev4844.tmp e20378233e152e294187c52de5607850_NeikiAnalytics.exe File opened for modification C:\Windows\dev4844.tmp MSWDM.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 100 MSWDM.EXE 100 MSWDM.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 212 wrote to memory of 5024 212 e20378233e152e294187c52de5607850_NeikiAnalytics.exe 83 PID 212 wrote to memory of 5024 212 e20378233e152e294187c52de5607850_NeikiAnalytics.exe 83 PID 212 wrote to memory of 5024 212 e20378233e152e294187c52de5607850_NeikiAnalytics.exe 83 PID 212 wrote to memory of 100 212 e20378233e152e294187c52de5607850_NeikiAnalytics.exe 84 PID 212 wrote to memory of 100 212 e20378233e152e294187c52de5607850_NeikiAnalytics.exe 84 PID 212 wrote to memory of 100 212 e20378233e152e294187c52de5607850_NeikiAnalytics.exe 84 PID 100 wrote to memory of 4644 100 MSWDM.EXE 85 PID 100 wrote to memory of 4644 100 MSWDM.EXE 85 PID 100 wrote to memory of 4104 100 MSWDM.EXE 87 PID 100 wrote to memory of 4104 100 MSWDM.EXE 87 PID 100 wrote to memory of 4104 100 MSWDM.EXE 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\e20378233e152e294187c52de5607850_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e20378233e152e294187c52de5607850_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:212 -
C:\WINDOWS\MSWDM.EXE"C:\WINDOWS\MSWDM.EXE"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5024
-
-
C:\WINDOWS\MSWDM.EXE-r!C:\Windows\dev4844.tmp!C:\Users\Admin\AppData\Local\Temp\e20378233e152e294187c52de5607850_NeikiAnalytics.exe! !2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:100 -
C:\Users\Admin\AppData\Local\Temp\E20378233E152E294187C52DE5607850_NEIKIANALYTICS.EXE
- Executes dropped EXE
PID:4644
-
-
C:\WINDOWS\MSWDM.EXE-e!C:\Windows\dev4844.tmp!C:\Users\Admin\AppData\Local\Temp\E20378233E152E294187C52DE5607850_NEIKIANALYTICS.EXE!3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4104
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
538KB
MD5167795774589f49c6c93b1d6b0917f19
SHA1b57a2a54b3e45c230b0235edf2dddfee09803e67
SHA25620d3b78985981d335986635474719d6b95d3a3f19a85afe8a04a5407deec854a
SHA5127ea4d0c1350c41759b01c155eb8fd229c6128d232f6ca1110ac902adc73a351e45b2becd4ac51bcdfed0b53a26e1dad990083e2cadebd925b0fa67b526dbe8aa
-
Filesize
80KB
MD5ca1665aebc386a9e1e00e62a6f24bccd
SHA1ace8a60b685b6e870d0952fd7de8b1157112db6a
SHA2569a7574d09ccc52c090ac586db59b15f7295fb15f6c2a1492558cb6d4cfdd5d3d
SHA512bd227870c2e6b67e11e532e43aecdd0af65745a31cc0beed86032bb00879a3eddeb9ddeae7bcc7089fee758179e2b7b9f567957f7f2fcfc69ed766d5feaa6d17
-
Filesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628