Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03/06/2024, 01:26
Static task
static1
Behavioral task
behavioral1
Sample
9616bf9a464a3204272cb703c4417c10_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9616bf9a464a3204272cb703c4417c10_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
9616bf9a464a3204272cb703c4417c10_NeikiAnalytics.exe
-
Size
586KB
-
MD5
9616bf9a464a3204272cb703c4417c10
-
SHA1
04ed77ba6b9c4634754fd8de9c367b6b4054d1b1
-
SHA256
31361137a5ff9f03f34b5d6642706a1cfe7b6bfa9c33aadf923a3d32647ea7cb
-
SHA512
b25547fc11a8976e7efa199b93e2f00468d16255b7c6fecebac9c01acf5aaa2bd78ca5cf7e4d43e36979d0bff8c7b2f02a5ea8513ba9b84480f1fcd6fc27c88e
-
SSDEEP
12288:2plrVbDdQaqdS/RfraFE/H8uB2Wm0SXsNr5FU:SxR1+FCcuvm0as
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2952 Education.exe -
Loads dropped DLL 2 IoCs
pid Process 2776 9616bf9a464a3204272cb703c4417c10_NeikiAnalytics.exe 2776 9616bf9a464a3204272cb703c4417c10_NeikiAnalytics.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Inside\Education.exe 9616bf9a464a3204272cb703c4417c10_NeikiAnalytics.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2776 9616bf9a464a3204272cb703c4417c10_NeikiAnalytics.exe 2776 9616bf9a464a3204272cb703c4417c10_NeikiAnalytics.exe 2776 9616bf9a464a3204272cb703c4417c10_NeikiAnalytics.exe 2776 9616bf9a464a3204272cb703c4417c10_NeikiAnalytics.exe 2952 Education.exe 2952 Education.exe 2952 Education.exe 2952 Education.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2776 wrote to memory of 2952 2776 9616bf9a464a3204272cb703c4417c10_NeikiAnalytics.exe 28 PID 2776 wrote to memory of 2952 2776 9616bf9a464a3204272cb703c4417c10_NeikiAnalytics.exe 28 PID 2776 wrote to memory of 2952 2776 9616bf9a464a3204272cb703c4417c10_NeikiAnalytics.exe 28 PID 2776 wrote to memory of 2952 2776 9616bf9a464a3204272cb703c4417c10_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\9616bf9a464a3204272cb703c4417c10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9616bf9a464a3204272cb703c4417c10_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Program Files\Inside\Education.exe"C:\Program Files\Inside\Education.exe" "33201"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2952
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
586KB
MD54618d6d6c55cbfb6ab9d2172e37cdc1e
SHA122aecdc42599cfebe10ec252aa55c1389e45f2cc
SHA256fc3d27c20681415f1af59535b1e109f92d7e092dae6756275426440819019483
SHA51250efd8ec90ade2ee81c15562069a53a08345f4505f5a23f2764fde216994282581d08b86af11bc1f6b56f4cfe532e024421e92cefd8a39ad64f111c4dd2af185