Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
21/05/2024, 09:28
Static task
static1
Behavioral task
behavioral1
Sample
2c2f712e273925094d427a034e1b8d71bc55dc2d464a73095969f36041425d1a_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2c2f712e273925094d427a034e1b8d71bc55dc2d464a73095969f36041425d1a_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
2c2f712e273925094d427a034e1b8d71bc55dc2d464a73095969f36041425d1a_NeikiAnalytics.exe
-
Size
1.1MB
-
MD5
6d556c7f2e369909751dd05c36f68fc0
-
SHA1
daed187d954e65fd0eae244e5827beec1ea94d8b
-
SHA256
2c2f712e273925094d427a034e1b8d71bc55dc2d464a73095969f36041425d1a
-
SHA512
0898288b61ce86a485a72f5de1b82d0a13f52b22230d0f28a805c0b2ae7b224c9e7c382518ef1e51645e2ed9e0c79d5a9cce8af63cb31fe9bbfe5d0031664ebc
-
SSDEEP
12288:gsVaX0DQJd7qD7/jVDa/ZSoPDm3Xx/MCtjm:gsVaX0sJsa/ZSoPDQ+ey
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2472 2c2f712e273925094d427a034e1b8d71bc55dc2d464a73095969f36041425d1a_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
pid Process 2472 2c2f712e273925094d427a034e1b8d71bc55dc2d464a73095969f36041425d1a_NeikiAnalytics.exe -
Program crash 3 IoCs
pid pid_target Process procid_target 2040 3708 WerFault.exe 90 3660 2472 WerFault.exe 95 2228 2472 WerFault.exe 95 -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3708 2c2f712e273925094d427a034e1b8d71bc55dc2d464a73095969f36041425d1a_NeikiAnalytics.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2472 2c2f712e273925094d427a034e1b8d71bc55dc2d464a73095969f36041425d1a_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3708 wrote to memory of 2472 3708 2c2f712e273925094d427a034e1b8d71bc55dc2d464a73095969f36041425d1a_NeikiAnalytics.exe 95 PID 3708 wrote to memory of 2472 3708 2c2f712e273925094d427a034e1b8d71bc55dc2d464a73095969f36041425d1a_NeikiAnalytics.exe 95 PID 3708 wrote to memory of 2472 3708 2c2f712e273925094d427a034e1b8d71bc55dc2d464a73095969f36041425d1a_NeikiAnalytics.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c2f712e273925094d427a034e1b8d71bc55dc2d464a73095969f36041425d1a_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2c2f712e273925094d427a034e1b8d71bc55dc2d464a73095969f36041425d1a_NeikiAnalytics.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3708 -s 3442⤵
- Program crash
PID:2040
-
-
C:\Users\Admin\AppData\Local\Temp\2c2f712e273925094d427a034e1b8d71bc55dc2d464a73095969f36041425d1a_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\2c2f712e273925094d427a034e1b8d71bc55dc2d464a73095969f36041425d1a_NeikiAnalytics.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2472 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 3443⤵
- Program crash
PID:3660
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 3723⤵
- Program crash
PID:2228
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 3708 -ip 37081⤵PID:1672
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2472 -ip 24721⤵PID:2688
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2472 -ip 24721⤵PID:4004
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:81⤵PID:1144
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\2c2f712e273925094d427a034e1b8d71bc55dc2d464a73095969f36041425d1a_NeikiAnalytics.exe
Filesize1.1MB
MD5d843a120fdf925387bbc93e57e131491
SHA1ed4bc10867d65822ae46d01ce1c42053439ea6fd
SHA2560514c7b7391f01a1fe027ec6f66f076926b162ea88c68472842e469718c6a78a
SHA512efb9b923d075970a269ace4329a6a987773fb5ea2421bc5d1ace3bb04d3d3e71457a3df858022b4b33bed21030718e9cbd36cd4f26b743f5244e396e65e4157a