Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
23/05/2024, 01:49
Static task
static1
Behavioral task
behavioral1
Sample
714205d8779bd8405ddd576e667f18e0_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
714205d8779bd8405ddd576e667f18e0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
714205d8779bd8405ddd576e667f18e0_NeikiAnalytics.exe
-
Size
79KB
-
MD5
714205d8779bd8405ddd576e667f18e0
-
SHA1
da8f7d74d6287994f66a7d067ff235b0c8b8e323
-
SHA256
86dac3fbf4bb4f6d3b439a85ff425429eb1141187c185fa1a8fe3d98daaea985
-
SHA512
bf8ddf89cf58e6dc3c57b82efd5861be9560e0fb01129e05a12b5b06a0cbfe6b100795ab7fd93c391577919dac39bbc2e311fd105b3a110858f72062559203a1
-
SSDEEP
768:tCru/fSIw/E6zy4n8uZ5tUXMJ+fROUmELY2glEbM3j+rd+fpRiTWNReOOkCru/fd:dSTzy48untU8fOMEI3jyYfPiuOsd
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1884 wrote to memory of 2416 1884 714205d8779bd8405ddd576e667f18e0_NeikiAnalytics.exe 29 PID 1884 wrote to memory of 2416 1884 714205d8779bd8405ddd576e667f18e0_NeikiAnalytics.exe 29 PID 1884 wrote to memory of 2416 1884 714205d8779bd8405ddd576e667f18e0_NeikiAnalytics.exe 29 PID 1884 wrote to memory of 2416 1884 714205d8779bd8405ddd576e667f18e0_NeikiAnalytics.exe 29 PID 2416 wrote to memory of 2680 2416 cmd.exe 30 PID 2416 wrote to memory of 2680 2416 cmd.exe 30 PID 2416 wrote to memory of 2680 2416 cmd.exe 30 PID 2416 wrote to memory of 2680 2416 cmd.exe 30 PID 2680 wrote to memory of 2720 2680 iexpress.exe 31 PID 2680 wrote to memory of 2720 2680 iexpress.exe 31 PID 2680 wrote to memory of 2720 2680 iexpress.exe 31 PID 2680 wrote to memory of 2720 2680 iexpress.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\714205d8779bd8405ddd576e667f18e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\714205d8779bd8405ddd576e667f18e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\1C57.tmp\1.bat" "C:\Users\Admin\AppData\Local\Temp\714205d8779bd8405ddd576e667f18e0_NeikiAnalytics.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\iexpress.exeiexpress /n /q /m C:\Users\Admin\AppData\Local\Temp\popup.sed3⤵
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\makecab.exeC:\Windows\SysWOW64\makecab.exe /f "~%TargetName%.DDF"4⤵PID:2720
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD502dba5f37067292355c6d01a57d4ef48
SHA17c67ab3f99fbf7a53018dd295d2968c525db83d9
SHA2568b74c812ba9e6c536da7edd4101e7e0dddeab8355e5aff095dd31b3f00560242
SHA51212201f949ee3198c8f4b39cc8edf90a114ecf42ddd5383ed0b87e4c78053cd517786dc7af83557e63a0483af74f4c0117d5568441ae761ff6958e758704d602a
-
Filesize
80KB
MD5b307a2ba88bff1417d905d34f1b45f03
SHA11732f29f17704db096e4cc4c4e55d2b581a9fd20
SHA256fb0fd92afd772ab1c3efdf5d1c039d7147a3e1920b57285d44f327c8269d572e
SHA51200ef32eac0b5b3aadecd0473d472a21cde7ab04ec51cd523f2ad684310c839aaf0b933cc917a1311a830c7fcf88a0b44de5455fcc27db7972fbbd9675d35cbc4
-
Filesize
724B
MD5c3ca008abd6997c4b036a7e8be75cb2c
SHA105f7a3527bb04c691b08f040f562582035398829
SHA25629ef6bf47dcc8c67f1abe1b269d3518d6a4ebe125daa1ea460779638cb9782a3
SHA512bee0baf3cb83144239077f99f5ca2a6ca7b618f7f51a53e03613ae697e8bc76fa28f5d006296b469be8e1fffeeb35668b5fe87b260b1380cc003815ea9efb083