Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23/05/2024, 10:45
Behavioral task
behavioral1
Sample
461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe
-
Size
1.6MB
-
MD5
461166691585b3f1dc6a8a90ad14df60
-
SHA1
cfa3fb80260f81ef6a4b3e53edc6de8e13be59bc
-
SHA256
453242da5b43a5e3aa2754dce79eccafad38c6d045dd24a5df52d2f19e508d7b
-
SHA512
565fde9ea90bbcc0e58345b8608c2a60d1548c48b49d5ea52d788d65c4a73b98854d8b66f7a1e1ecd8246117cb22e1de59b77d699fad9012e22b7540e537fa07
-
SSDEEP
24576:vCaehx36QZvHdPnLxRYUVlqcH9TDR3GmoKeBSwyS3GS8jgNGeu8oS9YJzYF7kMVI:ar36QVBLLnPj35GLMC2jgNGZ8+JzCA
Malware Config
Signatures
-
XMRig Miner payload 15 IoCs
resource yara_rule behavioral1/memory/3004-4-0x000000013F260000-0x000000013F9A5000-memory.dmp xmrig behavioral1/memory/3004-5-0x000000013F260000-0x000000013F9A5000-memory.dmp xmrig behavioral1/memory/3004-6-0x000000013F260000-0x000000013F9A5000-memory.dmp xmrig behavioral1/memory/3004-9-0x000000013F260000-0x000000013F9A5000-memory.dmp xmrig behavioral1/memory/3004-10-0x000000013F260000-0x000000013F9A5000-memory.dmp xmrig behavioral1/memory/3004-11-0x000000013F260000-0x000000013F9A5000-memory.dmp xmrig behavioral1/memory/3004-12-0x000000013F260000-0x000000013F9A5000-memory.dmp xmrig behavioral1/memory/3004-13-0x000000013F260000-0x000000013F9A5000-memory.dmp xmrig behavioral1/memory/3004-14-0x000000013F260000-0x000000013F9A5000-memory.dmp xmrig behavioral1/memory/3004-15-0x000000013F260000-0x000000013F9A5000-memory.dmp xmrig behavioral1/memory/3004-16-0x000000013F260000-0x000000013F9A5000-memory.dmp xmrig behavioral1/memory/3004-17-0x000000013F260000-0x000000013F9A5000-memory.dmp xmrig behavioral1/memory/3004-18-0x000000013F260000-0x000000013F9A5000-memory.dmp xmrig behavioral1/memory/3004-19-0x000000013F260000-0x000000013F9A5000-memory.dmp xmrig behavioral1/memory/3004-20-0x000000013F260000-0x000000013F9A5000-memory.dmp xmrig -
resource yara_rule behavioral1/memory/3004-0-0x000000013F260000-0x000000013F9A5000-memory.dmp upx behavioral1/memory/3004-4-0x000000013F260000-0x000000013F9A5000-memory.dmp upx behavioral1/memory/3004-5-0x000000013F260000-0x000000013F9A5000-memory.dmp upx behavioral1/memory/3004-6-0x000000013F260000-0x000000013F9A5000-memory.dmp upx behavioral1/memory/3004-9-0x000000013F260000-0x000000013F9A5000-memory.dmp upx behavioral1/memory/3004-10-0x000000013F260000-0x000000013F9A5000-memory.dmp upx behavioral1/memory/3004-11-0x000000013F260000-0x000000013F9A5000-memory.dmp upx behavioral1/memory/3004-12-0x000000013F260000-0x000000013F9A5000-memory.dmp upx behavioral1/memory/3004-13-0x000000013F260000-0x000000013F9A5000-memory.dmp upx behavioral1/memory/3004-14-0x000000013F260000-0x000000013F9A5000-memory.dmp upx behavioral1/memory/3004-15-0x000000013F260000-0x000000013F9A5000-memory.dmp upx behavioral1/memory/3004-16-0x000000013F260000-0x000000013F9A5000-memory.dmp upx behavioral1/memory/3004-17-0x000000013F260000-0x000000013F9A5000-memory.dmp upx behavioral1/memory/3004-18-0x000000013F260000-0x000000013F9A5000-memory.dmp upx behavioral1/memory/3004-19-0x000000013F260000-0x000000013F9A5000-memory.dmp upx behavioral1/memory/3004-20-0x000000013F260000-0x000000013F9A5000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe Token: SeLockMemoryPrivilege 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3004 461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\461166691585b3f1dc6a8a90ad14df60_NeikiAnalytics.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3004