Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24/05/2024, 21:04
Static task
static1
Behavioral task
behavioral1
Sample
22015f989e953a5056e00fcb8db6ca60_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
22015f989e953a5056e00fcb8db6ca60_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
22015f989e953a5056e00fcb8db6ca60_NeikiAnalytics.exe
-
Size
73KB
-
MD5
22015f989e953a5056e00fcb8db6ca60
-
SHA1
d495c4aef672100b9416bc03d7f5425f42dcf7bc
-
SHA256
5d9bc8a86214dc37e575b3bb30c9012f764b800ce4a0b2a7e5df4538036c7e85
-
SHA512
ece8c3587c9215b0b8987fffdf125067afe169fc32e930a5a4547553be5a28a3365a98f89df8d5f2fb1b18ac1281d8eb0f293c72552537f7b7e8ec3f957fc9dc
-
SSDEEP
1536:hbuxMtjkSWsK5QPqfhVWbdsmA+RjPFLC+e5hRT0ZGUGf2g:hptI3sNPqfcxA+HFshRTOg
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 60 [email protected] -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1804 wrote to memory of 3044 1804 22015f989e953a5056e00fcb8db6ca60_NeikiAnalytics.exe 84 PID 1804 wrote to memory of 3044 1804 22015f989e953a5056e00fcb8db6ca60_NeikiAnalytics.exe 84 PID 1804 wrote to memory of 3044 1804 22015f989e953a5056e00fcb8db6ca60_NeikiAnalytics.exe 84 PID 3044 wrote to memory of 60 3044 cmd.exe 85 PID 3044 wrote to memory of 60 3044 cmd.exe 85 PID 3044 wrote to memory of 60 3044 cmd.exe 85 PID 60 wrote to memory of 1928 60 [email protected] 86 PID 60 wrote to memory of 1928 60 [email protected] 86 PID 60 wrote to memory of 1928 60 [email protected] 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\22015f989e953a5056e00fcb8db6ca60_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\22015f989e953a5056e00fcb8db6ca60_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\SysWOW64\cmd.exePID:3044
-
C:\Users\Admin\AppData\Local\Temp\[email protected]PID:60
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 00.exe4⤵PID:1928
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\[email protected]
Filesize73KB
MD589456c96fff0e321ef069063fa67bc0a
SHA12afdecbf87d292a197e48f0c777d9447b2c31b3e
SHA25601aaf83554148ed136e597b762b715399b876a20a7a04144c903320d8c43c111
SHA5125addbe1a1c1bc0871f28b8fd7cb9e39cc53403e8721ed5e67985b15126fa03d7ed929b1b79be479cb91c0bf69e9003baf3850bd6f89c07c766cf99b02bbab79f
-
Filesize
2KB
MD57b621943a35e7f39cf89f50cc48d7b94
SHA12858a28cf60f38025fffcd0ba2ecfec8511c197d
SHA256bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991
SHA5124169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1