Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25/05/2024, 22:49
Behavioral task
behavioral1
Sample
2eb0b4a864d1e4702577dfedf90f6070_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2eb0b4a864d1e4702577dfedf90f6070_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
2eb0b4a864d1e4702577dfedf90f6070_NeikiAnalytics.exe
-
Size
134KB
-
MD5
2eb0b4a864d1e4702577dfedf90f6070
-
SHA1
8095c823a67b042433024baa17d602d90bab1336
-
SHA256
08ef7719581bf44f5ef88d689d78a6346b5eac02f446840dfd87a57e4d938ad2
-
SHA512
1dd755e1d89d9729299a7c7645dd5252731a62994a5856d17d38f6bf1bfeaba97f20916d0e34192cc02e92e4955cbc481eabade4a95f2031945b54f20fcf9b54
-
SSDEEP
1536:rF0AJELopHG9aa+9qX3apJzAKWYr0v7ioy6paK2AZqMIK7aGZh38Qmo:riAyLN9aa+9U2rW1ip6pr2At7NZuQmo
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1260 WwanSvc.exe -
Loads dropped DLL 1 IoCs
pid Process 2756 2eb0b4a864d1e4702577dfedf90f6070_NeikiAnalytics.exe -
resource yara_rule behavioral1/memory/2756-1-0x00000000008B0000-0x00000000008D8000-memory.dmp upx behavioral1/files/0x003500000001567f-2.dat upx behavioral1/memory/1260-6-0x0000000000E60000-0x0000000000E88000-memory.dmp upx behavioral1/memory/1260-8-0x0000000000E60000-0x0000000000E88000-memory.dmp upx behavioral1/memory/2756-9-0x00000000008B0000-0x00000000008D8000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Window Update = "\"C:\\ProgramData\\Update\\WwanSvc.exe\" /run" 2eb0b4a864d1e4702577dfedf90f6070_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2756 wrote to memory of 1260 2756 2eb0b4a864d1e4702577dfedf90f6070_NeikiAnalytics.exe 28 PID 2756 wrote to memory of 1260 2756 2eb0b4a864d1e4702577dfedf90f6070_NeikiAnalytics.exe 28 PID 2756 wrote to memory of 1260 2756 2eb0b4a864d1e4702577dfedf90f6070_NeikiAnalytics.exe 28 PID 2756 wrote to memory of 1260 2756 2eb0b4a864d1e4702577dfedf90f6070_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2eb0b4a864d1e4702577dfedf90f6070_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2eb0b4a864d1e4702577dfedf90f6070_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\ProgramData\Update\WwanSvc.exe"C:\ProgramData\Update\WwanSvc.exe" /run2⤵
- Executes dropped EXE
PID:1260
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
134KB
MD526b09ef025a697bd02585dc37b35fa6b
SHA1b26988bd5080b13fa4192e887622d2ca1953c028
SHA2568947214b26fe104b3cf17f0b0de07c4c7f98e523881269bef59e147a7c3bac8a
SHA5120820da9b9a8573f9529747c91915ee76a6a52dae04235d849e3317997c9978d2963e978f4d5486abb350924e5e580a17e7ca7e9b00be79795816c63740c52f38