Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
23/05/2024, 05:54
Static task
static1
Behavioral task
behavioral1
Sample
e674dcb82a716f2e3983cf2999272000_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
e674dcb82a716f2e3983cf2999272000_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
e674dcb82a716f2e3983cf2999272000_NeikiAnalytics.exe
-
Size
71KB
-
MD5
e674dcb82a716f2e3983cf2999272000
-
SHA1
94db1059935a2b97cca4e0aff4b8273590ce3e86
-
SHA256
68eb57d61c46b9dc4366f6e3b5e38dfc48dbf040a2a2880b7a8d3b05db4f91f6
-
SHA512
3c071a314b9442dbd9d0f259969db8c086826c371fbc719c0f8f0fc2f6a4db8797f716ede618e1e8175103080cedb56ca83b82184c511b4984875e82edad59f8
-
SSDEEP
768:hZZ6Zyf9wIh3SDyA0BIy/jIx+TZjUPx80sxCOopBoRxZzq3Yy+gMqMXmDLHr+cSD:1ldDCxGZwPm0/p8xY3clZcsVz
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2016 udfeahet.exe -
Loads dropped DLL 1 IoCs
pid Process 840 e674dcb82a716f2e3983cf2999272000_NeikiAnalytics.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\udfeahet.exe e674dcb82a716f2e3983cf2999272000_NeikiAnalytics.exe File created C:\WINDOWS\SysWOW64\udfeahet.exe e674dcb82a716f2e3983cf2999272000_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e674dcb82a716f2e3983cf2999272000_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e674dcb82a716f2e3983cf2999272000_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
PID:840 -
C:\WINDOWS\SysWOW64\udfeahet.exe"C:\WINDOWS\system32\udfeahet.exe"2⤵
- Executes dropped EXE
PID:2016
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD5b66b54080fe711f55467c68e3e8791b7
SHA14ff989488c5f3b07928821012b330edd0d7911ce
SHA25613b085163d3dfba60eca9ddc2362c42d7a51e1332fdd6a883034284da666d0a1
SHA512e3a61d51ae8c407350448e1aa3317b1d64258dd77500d7d01be1c55607777289e0f53e5b6b82853d365edc1b52773ba13eed1f1760c8fe90ca1eca4af88bf93b