Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

3

Static

static

3

c744edb309...cs.exe

windows7-x64

1

c744edb309...cs.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/05/2024, 06:40 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c744edb309ef2e0aa3e16e01b53f6390_NeikiAnalytics.exe

  • Size

    14KB

  • MD5

    c744edb309ef2e0aa3e16e01b53f6390

  • SHA1

    a58b837b7f228915f1ec7e5592af7ffb8278e9f6

  • SHA256

    725a82f39f467edbd29823823218fed12b08c0109118c3202f1eb3942180fd96

  • SHA512

    3f0d7ec102de14c02ea227da2e01f9ed69515789dd6e2caa508de7539f5f2db976b36b0a4fff470855db61fb161f2ef3c1a3204e8cd9e1d2702d5802bd6703ff

  • SSDEEP

    384:r+AtkabgwtJAgpzUfeQDVp8jWcaDE045HR000:anCJAZfjp8jWcgAX000

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c744edb309ef2e0aa3e16e01b53f6390_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\c744edb309ef2e0aa3e16e01b53f6390_NeikiAnalytics.exe"
    1⤵
      PID:1904
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1904 -s 220
        2⤵
        • Program crash
        PID:5008
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1904 -ip 1904
      1⤵
        PID:2964
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3552 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
        1⤵
          PID:2596

        Network

        • flag-us
          DNS
          172.210.232.199.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          172.210.232.199.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          97.17.167.52.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          97.17.167.52.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          72.32.126.40.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          72.32.126.40.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          95.221.229.192.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          95.221.229.192.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          133.211.185.52.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          133.211.185.52.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          196.249.167.52.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          196.249.167.52.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          26.165.165.52.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          26.165.165.52.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          56.126.166.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          56.126.166.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          10.179.89.13.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          10.179.89.13.in-addr.arpa
          IN PTR
          Response
        • 13.107.253.64:443
          46 B
           40 B
           1
          1
        • 172.217.169.74:443
          46 B
           40 B
           1
          1
        • 8.8.8.8:53
          172.210.232.199.in-addr.arpa
          dns
          74 B
           128 B
           1
          1

          DNS Request

          172.210.232.199.in-addr.arpa

        • 8.8.8.8:53
          97.17.167.52.in-addr.arpa
          dns
          71 B
           145 B
           1
          1

          DNS Request

          97.17.167.52.in-addr.arpa

        • 8.8.8.8:53
          72.32.126.40.in-addr.arpa
          dns
          71 B
           157 B
           1
          1

          DNS Request

          72.32.126.40.in-addr.arpa

        • 8.8.8.8:53
          95.221.229.192.in-addr.arpa
          dns
          73 B
           144 B
           1
          1

          DNS Request

          95.221.229.192.in-addr.arpa

        • 8.8.8.8:53
          133.211.185.52.in-addr.arpa
          dns
          73 B
           147 B
           1
          1

          DNS Request

          133.211.185.52.in-addr.arpa

        • 8.8.8.8:53
          196.249.167.52.in-addr.arpa
          dns
          73 B
           147 B
           1
          1

          DNS Request

          196.249.167.52.in-addr.arpa

        • 8.8.8.8:53
          26.165.165.52.in-addr.arpa
          dns
          72 B
           146 B
           1
          1

          DNS Request

          26.165.165.52.in-addr.arpa

        • 8.8.8.8:53
          56.126.166.20.in-addr.arpa
          dns
          72 B
           158 B
           1
          1

          DNS Request

          56.126.166.20.in-addr.arpa

        • 8.8.8.8:53
          10.179.89.13.in-addr.arpa
          dns
          71 B
           145 B
           1
          1

          DNS Request

          10.179.89.13.in-addr.arpa

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1904-0-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

          Download

        We care about your privacy.

        This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.