Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
29/05/2024, 12:32
Static task
static1
Behavioral task
behavioral1
Sample
53cb6ea612539e1803aab9000403b1d0_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
53cb6ea612539e1803aab9000403b1d0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
53cb6ea612539e1803aab9000403b1d0_NeikiAnalytics.exe
-
Size
73KB
-
MD5
53cb6ea612539e1803aab9000403b1d0
-
SHA1
0c6c19fb655121b3813249c2c67fdc6263f62620
-
SHA256
bf929fa80bb18a95fa8583daa5a8813d20cb3c1b8acafa5896fb187c7037a2d7
-
SHA512
de6d80259009a741befac9d8a1e6deffa16e696e3f81e65cb9c1e2b13bd9cef216a6677aba0140b1d04e7e232b9b69266c2a11474ce4e69189d412d784b0925d
-
SSDEEP
1536:hb/pRBv9CNAK5QPqfhVWbdsmA+RjPFLC+e5hh0ZGUGf2g:hVPlCSNPqfcxA+HFshhOg
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3004 [email protected] -
Loads dropped DLL 2 IoCs
pid Process 2988 cmd.exe 2988 cmd.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2968 wrote to memory of 2988 2968 53cb6ea612539e1803aab9000403b1d0_NeikiAnalytics.exe 29 PID 2968 wrote to memory of 2988 2968 53cb6ea612539e1803aab9000403b1d0_NeikiAnalytics.exe 29 PID 2968 wrote to memory of 2988 2968 53cb6ea612539e1803aab9000403b1d0_NeikiAnalytics.exe 29 PID 2968 wrote to memory of 2988 2968 53cb6ea612539e1803aab9000403b1d0_NeikiAnalytics.exe 29 PID 2988 wrote to memory of 3004 2988 cmd.exe 30 PID 2988 wrote to memory of 3004 2988 cmd.exe 30 PID 2988 wrote to memory of 3004 2988 cmd.exe 30 PID 2988 wrote to memory of 3004 2988 cmd.exe 30 PID 3004 wrote to memory of 2432 3004 [email protected] 31 PID 3004 wrote to memory of 2432 3004 [email protected] 31 PID 3004 wrote to memory of 2432 3004 [email protected] 31 PID 3004 wrote to memory of 2432 3004 [email protected] 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\53cb6ea612539e1803aab9000403b1d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\53cb6ea612539e1803aab9000403b1d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c [email protected]2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\[email protected]PID:3004
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 00.exe4⤵PID:2432
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\[email protected]
Filesize73KB
MD5baf35e384c1a4a55adebee4441af2ad8
SHA1cf5d64b548e58258e1fa06fdf3bbf303f243595b
SHA256554a1b29278d954523f20746b516e18076e9026d4085ccbea1c6b282ff14c69e
SHA512c748c1151ac86392d56f20553ab00fcae1c5cead145640811490b04182b186e100de4b01241eaa58d0bc05f771e1a4fda7033afc59b21df84387b04910d17529