Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01/06/2024, 08:16
Static task
static1
Behavioral task
behavioral1
Sample
941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe
-
Size
3.4MB
-
MD5
941a42f6b8c997962779afaa07ff77b0
-
SHA1
a0aee8b63743533aaf23d80315805f094200a31f
-
SHA256
5870a469b0af9c6144d262ce78a1ab5293ad66c11510058ce12cfa296cfc6cd6
-
SHA512
a50d6f6dc74e59c4270051813a9d5ff0a284c0e9997997aa4d2c262c3eb9aa652b18a2f035036ad21e20d16ad8e93b5a69ea47394716315892c0c063438d70c8
-
SSDEEP
49152:R5qwqr0Ig7grNZbNsm+kwjI4TT86lorVlyR0WsgygRbNsm+kwjFvy:Hpq5NZZshK4n86WrWD3Zshfvy
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 3440 941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
pid Process 3440 941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 18 pastebin.com 19 pastebin.com -
Program crash 15 IoCs
pid pid_target Process procid_target 3772 5040 WerFault.exe 82 2148 3440 WerFault.exe 90 2288 3440 WerFault.exe 90 2580 3440 WerFault.exe 90 3028 3440 WerFault.exe 90 2984 3440 WerFault.exe 90 1056 3440 WerFault.exe 90 736 3440 WerFault.exe 90 1364 3440 WerFault.exe 90 3764 3440 WerFault.exe 90 4660 3440 WerFault.exe 90 3600 3440 WerFault.exe 90 2028 3440 WerFault.exe 90 3028 3440 WerFault.exe 90 1188 3440 WerFault.exe 90 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3440 941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe 3440 941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 5040 941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3440 941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5040 wrote to memory of 3440 5040 941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe 90 PID 5040 wrote to memory of 3440 5040 941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe 90 PID 5040 wrote to memory of 3440 5040 941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 3522⤵
- Program crash
PID:3772
-
-
C:\Users\Admin\AppData\Local\Temp\941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\941a42f6b8c997962779afaa07ff77b0_NeikiAnalytics.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:3440 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 3443⤵
- Program crash
PID:2148
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 6283⤵
- Program crash
PID:2288
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 6483⤵
- Program crash
PID:2580
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 6723⤵
- Program crash
PID:3028
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 7203⤵
- Program crash
PID:2984
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 9203⤵
- Program crash
PID:1056
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 14323⤵
- Program crash
PID:736
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 14643⤵
- Program crash
PID:1364
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 14443⤵
- Program crash
PID:3764
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 14643⤵
- Program crash
PID:4660
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 15083⤵
- Program crash
PID:3600
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 14643⤵
- Program crash
PID:2028
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 14163⤵
- Program crash
PID:3028
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 6323⤵
- Program crash
PID:1188
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5040 -ip 50401⤵PID:3016
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3440 -ip 34401⤵PID:1344
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3440 -ip 34401⤵PID:4252
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3440 -ip 34401⤵PID:4148
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3440 -ip 34401⤵PID:1916
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3440 -ip 34401⤵PID:1576
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3440 -ip 34401⤵PID:1492
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3440 -ip 34401⤵PID:804
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3440 -ip 34401⤵PID:1580
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3440 -ip 34401⤵PID:4408
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3440 -ip 34401⤵PID:3020
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3440 -ip 34401⤵PID:3388
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3440 -ip 34401⤵PID:4832
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3440 -ip 34401⤵PID:4820
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3440 -ip 34401⤵PID:2304
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.4MB
MD57e07ec120437a025ec9a00939fbde346
SHA1849fdefbc3817553541e7b6ef2705f6a79293977
SHA25641ca40240b81a4b24f92bbf9c813e3ab3116b2e600e66cfea88240cf7d1e44cd
SHA512ad185dfd20a2cd9975c65ddd3e3115109fe636bab3cce609bbc4ba83bc20d6851c9841f0bd0ecaefe1c7c7633e50bf4fefed2662d043b268eb3d02870997f9f0