Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 14:23
Static task
static1
Behavioral task
behavioral1
Sample
0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe
-
Size
2.7MB
-
MD5
0863e1268bf146972594281dfea8c840
-
SHA1
162ae9c5144580aa6fb8911b0a418be6a4548c40
-
SHA256
1c8399a59b5347641a665ed1744894ea9c513068740dc0f909ed6da7f6030e47
-
SHA512
ef4c6cc62bf10a1e82b2867fb629dcbb44eef1f9f3dbaf8961921303f6bd6b7c07ad5796d2989bcd73d111748a7d83f0a95b444692956189506322b5e248d956
-
SSDEEP
49152:+R0p8xHycIq+GI27nGroMPTJPer1c2HSjpjK3LBX9w4Sx:+R0pI/IQlUoMPdmpSpz4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2212 devdobloc.exe -
Loads dropped DLL 1 IoCs
pid Process 2824 0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\Adobe3M\\devdobloc.exe" 0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\LabZKV\\dobaloc.exe" 0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2824 0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe 2824 0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe 2212 devdobloc.exe 2824 0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe 2212 devdobloc.exe 2824 0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe 2212 devdobloc.exe 2824 0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe 2212 devdobloc.exe 2824 0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe 2212 devdobloc.exe 2824 0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe 2212 devdobloc.exe 2824 0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe 2212 devdobloc.exe 2824 0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe 2212 devdobloc.exe 2824 0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe 2212 devdobloc.exe 2824 0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe 2212 devdobloc.exe 2824 0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe 2212 devdobloc.exe 2824 0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe 2212 devdobloc.exe 2824 0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe 2212 devdobloc.exe 2824 0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe 2212 devdobloc.exe 2824 0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe 2212 devdobloc.exe 2824 0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe 2212 devdobloc.exe 2824 0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe 2212 devdobloc.exe 2824 0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe 2212 devdobloc.exe 2824 0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe 2212 devdobloc.exe 2824 0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe 2212 devdobloc.exe 2824 0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe 2212 devdobloc.exe 2824 0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe 2212 devdobloc.exe 2824 0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe 2212 devdobloc.exe 2824 0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe 2212 devdobloc.exe 2824 0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe 2212 devdobloc.exe 2824 0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe 2212 devdobloc.exe 2824 0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe 2212 devdobloc.exe 2824 0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe 2212 devdobloc.exe 2824 0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe 2212 devdobloc.exe 2824 0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe 2212 devdobloc.exe 2824 0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe 2212 devdobloc.exe 2824 0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2824 wrote to memory of 2212 2824 0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe 28 PID 2824 wrote to memory of 2212 2824 0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe 28 PID 2824 wrote to memory of 2212 2824 0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe 28 PID 2824 wrote to memory of 2212 2824 0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0863e1268bf146972594281dfea8c840_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Adobe3M\devdobloc.exeC:\Adobe3M\devdobloc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2212
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5d0e007a41156f4e8078b8b2433c91f5d
SHA137493abf89b9188cf31da31dab2d07e5e8fce3b8
SHA2566f7fed035cec554d40803be04c4a54f51e798d2aeb40cc3456f92f74214bd073
SHA512ee32d58364c9f90d01fea91400adc437e5f01b5d4c18c661948b2efabbf90697424a5628033f806e597e4e1680fbfafcce9451453c6379c62fbc0b46e58e3823
-
Filesize
204B
MD5476547fe98f0740fcaf14484866fb0ae
SHA1798bdcabdcc1e9b00a97421807741544fa433944
SHA256b1934ef1f8a61782439f983c9685bfd2ca7d24cbc54f9c03430632eb278f007c
SHA5122af68f11e946c151ed50aa8e125eb6067658369804e7298632f01be224945f265a2d64c4c206a215dfb78295f7088182ce51c2b45072c0291a4d34257704480e
-
Filesize
2.7MB
MD5d1bff2325beadb1cbb8d37230a2eb9e8
SHA14a9087468af5c6715cd39fabe7fd7c2187306bfb
SHA256af9071af8d215af160a8d2d3cc68456e16b4ee80e3831f2dd396e9bf85c9cc5b
SHA5126df42a26e62ce1f7dc82274d420eab910f023c607e36ac5aa7701e6244f8b73fa51ca83b99a969beabfcedf3beb120a68f483f1d1b950d56c7ab803cdc8100aa