Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 05:53
Static task
static1
Behavioral task
behavioral1
Sample
762afd15a858fd131aeaf161b68f6790_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
762afd15a858fd131aeaf161b68f6790_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
762afd15a858fd131aeaf161b68f6790_NeikiAnalytics.exe
-
Size
73KB
-
MD5
762afd15a858fd131aeaf161b68f6790
-
SHA1
c4b8a81a719f50139d29bac58cbfb7a0cea0c194
-
SHA256
10d6a69927d98237bdde0af0fb5413f3b7348503b2cd0ecc99ee86740993c465
-
SHA512
08b950647c5343afa0e399ea4874a1509cae8e93fb13af22017f1d9f6c33c39f9f008b38e4b3f5eaaf58ee998cb61fed1cfa62a9750961ace8ec8acd8e566b07
-
SSDEEP
1536:hbXSUzRv0EK5QPqfhVWbdsmA+RjPFLC+e5hqQ0ZGUGf2g:hrz7NPqfcxA+HFshvOg
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1520 [email protected] -
Loads dropped DLL 2 IoCs
pid Process 868 cmd.exe 868 cmd.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2856 wrote to memory of 868 2856 762afd15a858fd131aeaf161b68f6790_NeikiAnalytics.exe 29 PID 2856 wrote to memory of 868 2856 762afd15a858fd131aeaf161b68f6790_NeikiAnalytics.exe 29 PID 2856 wrote to memory of 868 2856 762afd15a858fd131aeaf161b68f6790_NeikiAnalytics.exe 29 PID 2856 wrote to memory of 868 2856 762afd15a858fd131aeaf161b68f6790_NeikiAnalytics.exe 29 PID 868 wrote to memory of 1520 868 cmd.exe 30 PID 868 wrote to memory of 1520 868 cmd.exe 30 PID 868 wrote to memory of 1520 868 cmd.exe 30 PID 868 wrote to memory of 1520 868 cmd.exe 30 PID 1520 wrote to memory of 1648 1520 [email protected] 31 PID 1520 wrote to memory of 1648 1520 [email protected] 31 PID 1520 wrote to memory of 1648 1520 [email protected] 31 PID 1520 wrote to memory of 1648 1520 [email protected] 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\762afd15a858fd131aeaf161b68f6790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\762afd15a858fd131aeaf161b68f6790_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c [email protected]2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Users\Admin\AppData\Local\Temp\[email protected]PID:1520
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 16256.exe4⤵PID:1648
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\[email protected]
Filesize73KB
MD5c65f730c2dac6556dd2e3f7ec32cdb79
SHA1a77abf1dcdf0e0e7f766342ec9736bbbe8dba530
SHA25681066834923488b562c0dee7c2b35e3c98672b0f767c8bdafb19f97158808f68
SHA512694de31824cafcd31152eb35e084ff37f289c9f9a28ff015042af030534385270f97e8916b3ab9a8d1c9f3cb9b3c87d7f99818434453018a9e02ad1234d9cc42