Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/05/2024, 05:39

General

  • Target

    5008f70ee60c5f895eab1f84bbe95e30_NeikiAnalytics.exe

  • Size

    79KB

  • MD5

    5008f70ee60c5f895eab1f84bbe95e30

  • SHA1

    7bb641149a1a10f7920aa752fa730ed10bc13820

  • SHA256

    7a4e5b83f6dd240e5a1cf9213d210a177ebcb8df3d91b9b5ac50789da7cd1ae2

  • SHA512

    17110bb56d11ae06d6ebae2cce37af8b7396ee479525a59ffdf9c522853eae0253321c50c6fe8c885fe979527c55b7ff480f901e36354b959a5d71cf7a7067c9

  • SSDEEP

    1536:zvvSjrPgawlHWzMLP0OOQA8AkqUhMb2nuy5wgIP0CSJ+5yAB8GMGlZ5G:zvvSj8aKHWgLP0bGdqU7uy5w9WMyAN5G

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5008f70ee60c5f895eab1f84bbe95e30_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\5008f70ee60c5f895eab1f84bbe95e30_NeikiAnalytics.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:372
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:4948

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\[email protected]

      Filesize

      79KB

      MD5

      c863ae783984785a08fd65a2a8c2ba8b

      SHA1

      a56724079e03101cb75d83d090de07b863cc3c44

      SHA256

      93c336c4404d39311d3947947534b8ebb0c50961d02413d32717c4991a10b3d9

      SHA512

      52256dc25cb078aed3d6e39e662a031f18df5220c68ef54e866033b91b0d58d1e013872438a9929a386595ed959c7d368b30a96588ec2627bb4a0bbc9fca2d3c

    • memory/372-6-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB

    • memory/4416-5-0x0000000000400000-0x000000000041B000-memory.dmp

      Filesize

      108KB