Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
130s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27/05/2024, 19:15
Static task
static1
Behavioral task
behavioral1
Sample
0ffa688f9ccb28a2c66066be36d65660_NeikiAnalytics.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
0ffa688f9ccb28a2c66066be36d65660_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
0ffa688f9ccb28a2c66066be36d65660_NeikiAnalytics.exe
-
Size
73KB
-
MD5
0ffa688f9ccb28a2c66066be36d65660
-
SHA1
a67bfc9a437ebd315d1019fff31cf5932f24ef1c
-
SHA256
39d6f503ff0eec1798dba11b2bc7d11cbf15ad1b470a364c0f86ec3069ea0e83
-
SHA512
0f5c44f7ea0d0a135480a06ddd977fb9f8ea560f6ea5d1c16ff9a48e041a3cddc6a502cbd01f2f068b38ca8ba44be0d73d47b80a54e9208d0d94e4b15075aeed
-
SSDEEP
1536:hbI582rcx0GK5QPqfhVWbdsmA+RjPFLC+e5hP0ZGUGf2g:hYAx0GNPqfcxA+HFshPOg
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3900 [email protected] -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1124 wrote to memory of 3288 1124 0ffa688f9ccb28a2c66066be36d65660_NeikiAnalytics.exe 84 PID 1124 wrote to memory of 3288 1124 0ffa688f9ccb28a2c66066be36d65660_NeikiAnalytics.exe 84 PID 1124 wrote to memory of 3288 1124 0ffa688f9ccb28a2c66066be36d65660_NeikiAnalytics.exe 84 PID 3288 wrote to memory of 3900 3288 cmd.exe 85 PID 3288 wrote to memory of 3900 3288 cmd.exe 85 PID 3288 wrote to memory of 3900 3288 cmd.exe 85 PID 3900 wrote to memory of 3024 3900 [email protected] 86 PID 3900 wrote to memory of 3024 3900 [email protected] 86 PID 3900 wrote to memory of 3024 3900 [email protected] 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ffa688f9ccb28a2c66066be36d65660_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0ffa688f9ccb28a2c66066be36d65660_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\SysWOW64\cmd.exePID:3288
-
C:\Users\Admin\AppData\Local\Temp\[email protected]PID:3900
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 00.exe4⤵PID:3024
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\[email protected]
Filesize73KB
MD588e8210666026b3156ff96ca27a26da4
SHA182c6b22764ed0b03c7c10fa9f793a8d964394aaa
SHA256240b6cce4e97e02ddc4b4330252eeb2d6bbec10eae18609ef75d3497d317d281
SHA512a4d8c6713ada290f13847c2a3b9f03b542c7079fc1a0708b6cba9e923f2727eb63492a123917e29c45c4a77923da495defb29d481e2162b2d6e6bf6454289c81
-
Filesize
2KB
MD57b621943a35e7f39cf89f50cc48d7b94
SHA12858a28cf60f38025fffcd0ba2ecfec8511c197d
SHA256bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991
SHA5124169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1