Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
19/05/2024, 21:57
Static task
static1
Behavioral task
behavioral1
Sample
44d05288f77e0b29b05acdce71bb8b80_NeikiAnalytics.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
44d05288f77e0b29b05acdce71bb8b80_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
44d05288f77e0b29b05acdce71bb8b80_NeikiAnalytics.exe
-
Size
448KB
-
MD5
44d05288f77e0b29b05acdce71bb8b80
-
SHA1
2b0db3c5a06ee2a628c3b2449003c91ba2b00fe8
-
SHA256
88a8d0586c2fa6a1f3921675dfb35fb4d626b8a5a16d57c1bf3302d03e295e26
-
SHA512
301e4c09a4248453721d899668e01a4a6db0ff4e12d73fadaa84014f5b3fd7424a3703ed1ad26ef157c5673e87b9c73232737cd70a01c8b716fbb8cd4c382dd0
-
SSDEEP
6144:fUORK1ttbV3kSobTYZGiNdnikoh+KiRgRccYqK1kDk0FOL4MtkyOGGKD0GE:fytbV3kSoXaLnxosly2dwD184pYGQdE
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2312 cmd.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2636 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2984 44d05288f77e0b29b05acdce71bb8b80_NeikiAnalytics.exe 2984 44d05288f77e0b29b05acdce71bb8b80_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2984 44d05288f77e0b29b05acdce71bb8b80_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2984 wrote to memory of 2312 2984 44d05288f77e0b29b05acdce71bb8b80_NeikiAnalytics.exe 28 PID 2984 wrote to memory of 2312 2984 44d05288f77e0b29b05acdce71bb8b80_NeikiAnalytics.exe 28 PID 2984 wrote to memory of 2312 2984 44d05288f77e0b29b05acdce71bb8b80_NeikiAnalytics.exe 28 PID 2312 wrote to memory of 2636 2312 cmd.exe 30 PID 2312 wrote to memory of 2636 2312 cmd.exe 30 PID 2312 wrote to memory of 2636 2312 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\44d05288f77e0b29b05acdce71bb8b80_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\44d05288f77e0b29b05acdce71bb8b80_NeikiAnalytics.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\system32\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\44d05288f77e0b29b05acdce71bb8b80_NeikiAnalytics.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 60003⤵
- Runs ping.exe
PID:2636
-
-