Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 11:54
Static task
static1
Behavioral task
behavioral1
Sample
aeb75dc0b759e1a5f4cff9bff55ace50_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
aeb75dc0b759e1a5f4cff9bff55ace50_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
aeb75dc0b759e1a5f4cff9bff55ace50_NeikiAnalytics.exe
-
Size
22KB
-
MD5
aeb75dc0b759e1a5f4cff9bff55ace50
-
SHA1
39156cbd227f99b2795fcbd45ab4d766a6917c1b
-
SHA256
5e2c2e6e156fb9b602c05954dd3cb6b778b5154d684fa549eb5dd6ea666af153
-
SHA512
bafb80caf25f55fe300eb94fcc1f66eac4bbf02bd27222cef3da4bf908d26cbf3bb2da8846bb25802dbcb4d9a33ef67f271a62c7f87dae6727517413f5acc115
-
SSDEEP
192:qytgAeuB2S7FFWlSkABcI+EWL/hTUozHLYDo2SIcIn8/wKUlT8AF8rV3u:qySFpcI5pTUo7L2FSmnmwKUl4AF8rY
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2960 cchip.exe -
Loads dropped DLL 1 IoCs
pid Process 2172 aeb75dc0b759e1a5f4cff9bff55ace50_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2172 wrote to memory of 2960 2172 aeb75dc0b759e1a5f4cff9bff55ace50_NeikiAnalytics.exe 28 PID 2172 wrote to memory of 2960 2172 aeb75dc0b759e1a5f4cff9bff55ace50_NeikiAnalytics.exe 28 PID 2172 wrote to memory of 2960 2172 aeb75dc0b759e1a5f4cff9bff55ace50_NeikiAnalytics.exe 28 PID 2172 wrote to memory of 2960 2172 aeb75dc0b759e1a5f4cff9bff55ace50_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\aeb75dc0b759e1a5f4cff9bff55ace50_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\aeb75dc0b759e1a5f4cff9bff55ace50_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\cchip.exe"C:\Users\Admin\AppData\Local\Temp\cchip.exe"2⤵
- Executes dropped EXE
PID:2960
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
22KB
MD52d57db14290f333596aead06582d1d1f
SHA14a5d4f9f47a2f4b3023507f87106ef3e549d1ced
SHA256393cd1aaeb77c689757b1390682076aba5911544bc726a0e4860ddd21e778efe
SHA5127e50767afa74cf054cc26a862962905507ac078d05db9682fe0ea76ce4dbee6024f9122c8989a85cd31f812509ac062fb35c1940e79438505f0756234f68004f