Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27/05/2024, 11:21
Static task
static1
Behavioral task
behavioral1
Sample
ba4d4e9f7e1c6e0eb443f0d47b1d75b0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ba4d4e9f7e1c6e0eb443f0d47b1d75b0_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
ba4d4e9f7e1c6e0eb443f0d47b1d75b0_NeikiAnalytics.exe
-
Size
73KB
-
MD5
ba4d4e9f7e1c6e0eb443f0d47b1d75b0
-
SHA1
38efc38db7a2abd4dfbf72c4521c4c94d2877a43
-
SHA256
a9e79533627f50cd098052465da09ebaf6ce721dcdd89fe7fb342fcd299b748d
-
SHA512
b528df1308060e94fd143aca42d3cd46a226130bb12ad8941580dc624a3b29af99d95d22bb7a94e5c9bbae11fe5b05921f8174f1b29f31ebe0c6a54a4c3846d9
-
SSDEEP
1536:hbuJeqj8qK5QPqfhVWbdsmA+RjPFLC+e5hM0ZGUGf2g:hKJfNPqfcxA+HFshMOg
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3352 [email protected] -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4436 wrote to memory of 1652 4436 ba4d4e9f7e1c6e0eb443f0d47b1d75b0_NeikiAnalytics.exe 92 PID 4436 wrote to memory of 1652 4436 ba4d4e9f7e1c6e0eb443f0d47b1d75b0_NeikiAnalytics.exe 92 PID 4436 wrote to memory of 1652 4436 ba4d4e9f7e1c6e0eb443f0d47b1d75b0_NeikiAnalytics.exe 92 PID 1652 wrote to memory of 3352 1652 cmd.exe 93 PID 1652 wrote to memory of 3352 1652 cmd.exe 93 PID 1652 wrote to memory of 3352 1652 cmd.exe 93 PID 3352 wrote to memory of 1220 3352 [email protected] 94 PID 3352 wrote to memory of 1220 3352 [email protected] 94 PID 3352 wrote to memory of 1220 3352 [email protected] 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba4d4e9f7e1c6e0eb443f0d47b1d75b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ba4d4e9f7e1c6e0eb443f0d47b1d75b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\SysWOW64\cmd.exePID:1652
-
C:\Users\Admin\AppData\Local\Temp\[email protected]PID:3352
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 00.exe4⤵PID:1220
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4112 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:81⤵PID:2804
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\[email protected]
Filesize73KB
MD56401cadaea4f18fbcd4a6e66455291f0
SHA18d00d0e53c232d10fad1f1e90b1fba70eeade036
SHA256cbb41bb3969c598f412ec33a5bb1dde10fbdcc1b37b2b575a4f59be04082ed54
SHA512df8b57256e68945a1b6705b16a87e133f8ee47b51e623e0ad563c98aaa3eef30223f3d8b9417fe462c474f2084818f5621cf1207b10731d9d8b89668e9b59392
-
Filesize
2KB
MD57b621943a35e7f39cf89f50cc48d7b94
SHA12858a28cf60f38025fffcd0ba2ecfec8511c197d
SHA256bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991
SHA5124169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1