Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
30/05/2024, 04:32
Static task
static1
Behavioral task
behavioral1
Sample
64af3d2a53a7a75cae2e8bd78759b6a0_NeikiAnalytics.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
64af3d2a53a7a75cae2e8bd78759b6a0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
64af3d2a53a7a75cae2e8bd78759b6a0_NeikiAnalytics.exe
-
Size
79KB
-
MD5
64af3d2a53a7a75cae2e8bd78759b6a0
-
SHA1
16cc794a137f696d3f6bed544981f906cf8784b5
-
SHA256
5953b35def7fcd3612188646885002b39a5898aba3c678a5a005cd9c81a0e81e
-
SHA512
a66246e0f89d9cd4ee0cc513ec3452975d54da4b06cef309143e281befaad09236896bb480b4b8da7357ce77cda83a8acdda25540256237abcba98601d980a1e
-
SSDEEP
1536:zvK8wXOsol+f9OQA8AkqUhMb2nuy5wgIP0CSJ+5yZAB8GMGlZ5G:zvKfNoQMGdqU7uy5w9WMy2N5G
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1840 [email protected] -
Loads dropped DLL 2 IoCs
pid Process 1664 cmd.exe 1664 cmd.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1656 wrote to memory of 1664 1656 64af3d2a53a7a75cae2e8bd78759b6a0_NeikiAnalytics.exe 29 PID 1656 wrote to memory of 1664 1656 64af3d2a53a7a75cae2e8bd78759b6a0_NeikiAnalytics.exe 29 PID 1656 wrote to memory of 1664 1656 64af3d2a53a7a75cae2e8bd78759b6a0_NeikiAnalytics.exe 29 PID 1656 wrote to memory of 1664 1656 64af3d2a53a7a75cae2e8bd78759b6a0_NeikiAnalytics.exe 29 PID 1664 wrote to memory of 1840 1664 cmd.exe 30 PID 1664 wrote to memory of 1840 1664 cmd.exe 30 PID 1664 wrote to memory of 1840 1664 cmd.exe 30 PID 1664 wrote to memory of 1840 1664 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\64af3d2a53a7a75cae2e8bd78759b6a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\64af3d2a53a7a75cae2e8bd78759b6a0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c [email protected]2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\[email protected]PID:1840
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\[email protected]
Filesize79KB
MD55e107aa5e525d284bf0df1ccfe17cf30
SHA1e5f6053dad186cbe31b4c652698ccd6c99365088
SHA25685b5aa2a50f61669ae4fb5206211885f6325f2b11a4d28b61789535468ad9b71
SHA5127827bc0718ab0a2f804c4e75f9adc7191c6353bd3072d5a227a82afad0bb56056373efdec7a52997f0aa3396eb4201a774165bc06fcf101cbede607d171ff78c