Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
21/05/2024, 05:41
Static task
static1
Behavioral task
behavioral1
Sample
0775baae35f4b2b59e296ee34850585bb0203e94c232caaa132ce5d2c96cc2ce_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0775baae35f4b2b59e296ee34850585bb0203e94c232caaa132ce5d2c96cc2ce_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
0775baae35f4b2b59e296ee34850585bb0203e94c232caaa132ce5d2c96cc2ce_NeikiAnalytics.exe
-
Size
35KB
-
MD5
06ecb3d0e823561279b8202bed1d7dc0
-
SHA1
a5b33de0c4d1d17e8e09d3645333d0a8c38b7685
-
SHA256
0775baae35f4b2b59e296ee34850585bb0203e94c232caaa132ce5d2c96cc2ce
-
SHA512
30de00a005553248c17d21b5aaf615faab8b70ab3b316c01261968a08553c56a0ef2e1e35da7e408ffd9a3232b08bf2b0854c3127a213c4ce0abf04ba280ada6
-
SSDEEP
768:/qPJtHA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNh1:/qnA6C1VqaqhtgVRNToV7TtRu8rM0wYV
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1992 microsofthelp.exe -
Executes dropped EXE 1 IoCs
pid Process 1992 microsofthelp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe" 0775baae35f4b2b59e296ee34850585bb0203e94c232caaa132ce5d2c96cc2ce_NeikiAnalytics.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\microsofthelp.exe 0775baae35f4b2b59e296ee34850585bb0203e94c232caaa132ce5d2c96cc2ce_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1848 wrote to memory of 1992 1848 0775baae35f4b2b59e296ee34850585bb0203e94c232caaa132ce5d2c96cc2ce_NeikiAnalytics.exe 28 PID 1848 wrote to memory of 1992 1848 0775baae35f4b2b59e296ee34850585bb0203e94c232caaa132ce5d2c96cc2ce_NeikiAnalytics.exe 28 PID 1848 wrote to memory of 1992 1848 0775baae35f4b2b59e296ee34850585bb0203e94c232caaa132ce5d2c96cc2ce_NeikiAnalytics.exe 28 PID 1848 wrote to memory of 1992 1848 0775baae35f4b2b59e296ee34850585bb0203e94c232caaa132ce5d2c96cc2ce_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\0775baae35f4b2b59e296ee34850585bb0203e94c232caaa132ce5d2c96cc2ce_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0775baae35f4b2b59e296ee34850585bb0203e94c232caaa132ce5d2c96cc2ce_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\microsofthelp.exe"C:\Windows\microsofthelp.exe"2⤵
- Deletes itself
- Executes dropped EXE
PID:1992
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35KB
MD579d4869a79cb2f30472cf07775ba8650
SHA12d6a412c6c7053f20ab024d26cee5927bd7cce5b
SHA256b16a7706ff1fe5c6d6de70e725aa87f25c47eacd02cc0ecd5180506d23f8ee6f
SHA512077fbbf78b8364a9ea400689a790c7a0309431f578edfa5b28b7bee27c158d1b8d5d65a3348d904e88ed3fa632433d534e1dacf3878d5290dae1c1751830bc44