Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03/06/2024, 22:26
Behavioral task
behavioral1
Sample
0af6b050799497fed70743ce97692ae0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0af6b050799497fed70743ce97692ae0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
0af6b050799497fed70743ce97692ae0_NeikiAnalytics.exe
-
Size
134KB
-
MD5
0af6b050799497fed70743ce97692ae0
-
SHA1
b4f6e012fcb183522deadcf9f736fe090eebc60a
-
SHA256
7c67ce984bac8822930012cab9358b8264cbd590badfadba802d908503949b62
-
SHA512
077bddfbd0d28281093fcf475111d017734eaf70af0bc6a2cb9baa98d0d30adad8ef30be615131a085f2b040933131f1e098301c3becc36cbeb502dad45a4184
-
SSDEEP
1536:rF0AJELopHG9aa+9qX3apJzAKWYr0v7ioy6paK2AZqMIK7aGZh38QN:riAyLN9aa+9U2rW1ip6pr2At7NZuQN
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2728 WwanSvc.exe -
Loads dropped DLL 1 IoCs
pid Process 2848 0af6b050799497fed70743ce97692ae0_NeikiAnalytics.exe -
resource yara_rule behavioral1/memory/2848-0-0x0000000001110000-0x0000000001138000-memory.dmp upx behavioral1/files/0x0035000000014712-2.dat upx behavioral1/memory/2728-6-0x0000000000DB0000-0x0000000000DD8000-memory.dmp upx behavioral1/memory/2848-7-0x0000000001110000-0x0000000001138000-memory.dmp upx behavioral1/memory/2728-9-0x0000000000DB0000-0x0000000000DD8000-memory.dmp upx behavioral1/memory/2848-10-0x0000000001110000-0x0000000001138000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Window Update = "\"C:\\ProgramData\\Update\\WwanSvc.exe\" /run" 0af6b050799497fed70743ce97692ae0_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2848 wrote to memory of 2728 2848 0af6b050799497fed70743ce97692ae0_NeikiAnalytics.exe 28 PID 2848 wrote to memory of 2728 2848 0af6b050799497fed70743ce97692ae0_NeikiAnalytics.exe 28 PID 2848 wrote to memory of 2728 2848 0af6b050799497fed70743ce97692ae0_NeikiAnalytics.exe 28 PID 2848 wrote to memory of 2728 2848 0af6b050799497fed70743ce97692ae0_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\0af6b050799497fed70743ce97692ae0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0af6b050799497fed70743ce97692ae0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\ProgramData\Update\WwanSvc.exe"C:\ProgramData\Update\WwanSvc.exe" /run2⤵
- Executes dropped EXE
PID:2728
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
134KB
MD5a8c48ba97015aef774809be985717f64
SHA1917a92e3ac68f772fedc777375689ee9bb30aa38
SHA25683dc57dd36d2983edb3bb709c78a6a643e4c2cda7ba58ea049ef1ebace6ed0fe
SHA512a69dd08bd8b743100c12bd7b34143d1007522d829c52dd4e27bd0e5b7a7656eca880a659a9b89e0a92830a065111a0802aa1f3b78328b126a0533a04c08ba77c