Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23/05/2024, 10:40
Static task
static1
Behavioral task
behavioral1
Sample
6972f23886f8934a0decc6096cbefe60_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6972f23886f8934a0decc6096cbefe60_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
6972f23886f8934a0decc6096cbefe60_NeikiAnalytics.exe
-
Size
79KB
-
MD5
6972f23886f8934a0decc6096cbefe60
-
SHA1
3c9e56f0712ca1dff512e6148003768f00ca0977
-
SHA256
f919580d42310fcb2a53203c6e96466329172f4b6cb70f6226f1df39d7761070
-
SHA512
16ee737b626f164fda8eb5c823975d7bcd2cc587997e94036b24d3f113544a54cbb1e757f1e90fa989637a84646bbe17de22a1f73914a369e24be7d6adc60f95
-
SSDEEP
1536:zvI+hUIvhCXa+buOQA8AkqUhMb2nuy5wgIP0CSJ+5ypB8GMGlZ5G:zvIMUV77GdqU7uy5w9WMypN5G
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2276 [email protected] -
Loads dropped DLL 2 IoCs
pid Process 2056 cmd.exe 2056 cmd.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2980 wrote to memory of 2056 2980 6972f23886f8934a0decc6096cbefe60_NeikiAnalytics.exe 29 PID 2980 wrote to memory of 2056 2980 6972f23886f8934a0decc6096cbefe60_NeikiAnalytics.exe 29 PID 2980 wrote to memory of 2056 2980 6972f23886f8934a0decc6096cbefe60_NeikiAnalytics.exe 29 PID 2980 wrote to memory of 2056 2980 6972f23886f8934a0decc6096cbefe60_NeikiAnalytics.exe 29 PID 2056 wrote to memory of 2276 2056 cmd.exe 30 PID 2056 wrote to memory of 2276 2056 cmd.exe 30 PID 2056 wrote to memory of 2276 2056 cmd.exe 30 PID 2056 wrote to memory of 2276 2056 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\6972f23886f8934a0decc6096cbefe60_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6972f23886f8934a0decc6096cbefe60_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c [email protected]2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\[email protected]PID:2276
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\[email protected]
Filesize79KB
MD5d1c42ca78aa694d916a67d85f7060472
SHA17fc5e435406e2a9e40ff11d389968240bf878ba2
SHA25604a5d874710161d7a6acab9ceeb2945a13c01b0fbabfc27ebebc3294dd4e52bc
SHA512d26e065844a71968f339569ec115eb16bf4893cf82e9985856f7159f4cc19df94ff867290880fb7b77ea6fbf3504a1c1efd0fbb275725fcd01222907c8a20c99