Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23/05/2024, 08:38
Static task
static1
Behavioral task
behavioral1
Sample
2a22dde93006ad8828ffb1c671a43d00_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2a22dde93006ad8828ffb1c671a43d00_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
2a22dde93006ad8828ffb1c671a43d00_NeikiAnalytics.exe
-
Size
79KB
-
MD5
2a22dde93006ad8828ffb1c671a43d00
-
SHA1
20fb7b8e85665cc33cc6a7a602ec0f21fda2b4e1
-
SHA256
62476694c99eb5c6299945513501dcdbdc6dc03ec39527bc75c383da8845084f
-
SHA512
a213395ecb142ce25aeb3ea0f638e562222a35b52383e9682c5c5810bc5c6a1fcdb183a78a9f080c8b9768cd8f8bf1b1f68c7bc93297c338ed285ab90949568a
-
SSDEEP
1536:zvhLVkSFqmJOQA8AkqUhMb2nuy5wgIP0CSJ+5yBB8GMGlZ5G:zvfkStIGdqU7uy5w9WMyBN5G
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2864 [email protected] -
Loads dropped DLL 2 IoCs
pid Process 2860 cmd.exe 2860 cmd.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2684 wrote to memory of 2860 2684 2a22dde93006ad8828ffb1c671a43d00_NeikiAnalytics.exe 29 PID 2684 wrote to memory of 2860 2684 2a22dde93006ad8828ffb1c671a43d00_NeikiAnalytics.exe 29 PID 2684 wrote to memory of 2860 2684 2a22dde93006ad8828ffb1c671a43d00_NeikiAnalytics.exe 29 PID 2684 wrote to memory of 2860 2684 2a22dde93006ad8828ffb1c671a43d00_NeikiAnalytics.exe 29 PID 2860 wrote to memory of 2864 2860 cmd.exe 30 PID 2860 wrote to memory of 2864 2860 cmd.exe 30 PID 2860 wrote to memory of 2864 2860 cmd.exe 30 PID 2860 wrote to memory of 2864 2860 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a22dde93006ad8828ffb1c671a43d00_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2a22dde93006ad8828ffb1c671a43d00_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c [email protected]2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\[email protected]PID:2864
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\[email protected]
Filesize79KB
MD552526c30f12b32718c0dd2e6d39ccc17
SHA1c752e712114034ae2737743c5694ffcf6cb8d3b6
SHA2569668e91dda7d4264345130b56c5a1a06123747c360ccffbbf3deb5636c7e1bb5
SHA51276df5b6403d643c116d0038b77432ba5ce8f121d66a399e868463285e33b9bf5ba267b7fc3d44d4cfaed3794cf9ffc4cca62e944f6ea8993e39ddb4ec966baf6