Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
28/05/2024, 21:19
Static task
static1
Behavioral task
behavioral1
Sample
07e821f4b951513b02f432a3f73a8070_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
07e821f4b951513b02f432a3f73a8070_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
07e821f4b951513b02f432a3f73a8070_NeikiAnalytics.exe
-
Size
73KB
-
MD5
07e821f4b951513b02f432a3f73a8070
-
SHA1
a45c3c0730676f99161ff4afe3b00f0e6bcd90e0
-
SHA256
8bc7cd9cf0a5705fc902092f5835d8ca8423797030334a5c0494027a8e817be4
-
SHA512
39eb2206cb72f12373e2e470d63cc83eee74d00c5155a6a4da72832c4fc5577dbc76168d2e61c88dd3afe81540ed1846caf63d4338c69be447bcae97c53c1bf1
-
SSDEEP
1536:hbe0vnJWQA+ZCK5QPqfhVWbdsmA+RjPFLC+e5hI0ZGUGf2g:h60kQA+0NPqfcxA+HFshIOg
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 5144 [email protected] -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4444 wrote to memory of 4780 4444 07e821f4b951513b02f432a3f73a8070_NeikiAnalytics.exe 83 PID 4444 wrote to memory of 4780 4444 07e821f4b951513b02f432a3f73a8070_NeikiAnalytics.exe 83 PID 4444 wrote to memory of 4780 4444 07e821f4b951513b02f432a3f73a8070_NeikiAnalytics.exe 83 PID 4780 wrote to memory of 5144 4780 cmd.exe 84 PID 4780 wrote to memory of 5144 4780 cmd.exe 84 PID 4780 wrote to memory of 5144 4780 cmd.exe 84 PID 5144 wrote to memory of 6020 5144 [email protected] 85 PID 5144 wrote to memory of 6020 5144 [email protected] 85 PID 5144 wrote to memory of 6020 5144 [email protected] 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\07e821f4b951513b02f432a3f73a8070_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\07e821f4b951513b02f432a3f73a8070_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\SysWOW64\cmd.exePID:4780
-
C:\Users\Admin\AppData\Local\Temp\[email protected]PID:5144
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 00.exe4⤵PID:6020
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\[email protected]
Filesize73KB
MD55ae48d975ea3de6675691ac5670fbc2a
SHA1764158b366aea821e5c91e05dc305be4c2815b21
SHA256fed2cb189be8b9a45647c68b13095bcbb8923e7eec62355796b173d0775de61b
SHA5122b4f3b493f3adc479a306dc1f420a5897ad01aaa6ae7dbbf185d2e3fcd8a23a2db741e44b137b512fa055f0171a43a6147004b4fa37c431323ef7c09e6427a19
-
Filesize
2KB
MD57b621943a35e7f39cf89f50cc48d7b94
SHA12858a28cf60f38025fffcd0ba2ecfec8511c197d
SHA256bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991
SHA5124169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1