Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
03/06/2024, 02:06
Static task
static1
Behavioral task
behavioral1
Sample
97b97fa0ec4048598df54e5b2d924e20_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
97b97fa0ec4048598df54e5b2d924e20_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
97b97fa0ec4048598df54e5b2d924e20_NeikiAnalytics.exe
-
Size
4.2MB
-
MD5
97b97fa0ec4048598df54e5b2d924e20
-
SHA1
0c07bc05cd6eb980f8c0b774910187d3bc143947
-
SHA256
6a79458c810f45d3071b2314b7a47ce86016736551a898152e2c1a87549b9bfc
-
SHA512
f377f5eb032ad9115eab7faa98d3b8a8f7446fee0cdd2955555742495c88e4708af81e83312d50448658ccf28d09acae5b963010ccc1ad261628ff5b22f87ff8
-
SSDEEP
98304:Cmhd1Uryek5W8kphWj8vIJtsVLUjH5oxFbxhVLUjH5oxFbx:ClEoFgtsVUjZEdhVUjZEd
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1740 1A73.tmp -
Executes dropped EXE 1 IoCs
pid Process 1740 1A73.tmp -
Loads dropped DLL 2 IoCs
pid Process 2460 97b97fa0ec4048598df54e5b2d924e20_NeikiAnalytics.exe 2460 97b97fa0ec4048598df54e5b2d924e20_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2460 wrote to memory of 1740 2460 97b97fa0ec4048598df54e5b2d924e20_NeikiAnalytics.exe 28 PID 2460 wrote to memory of 1740 2460 97b97fa0ec4048598df54e5b2d924e20_NeikiAnalytics.exe 28 PID 2460 wrote to memory of 1740 2460 97b97fa0ec4048598df54e5b2d924e20_NeikiAnalytics.exe 28 PID 2460 wrote to memory of 1740 2460 97b97fa0ec4048598df54e5b2d924e20_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\97b97fa0ec4048598df54e5b2d924e20_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\97b97fa0ec4048598df54e5b2d924e20_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\1A73.tmp"C:\Users\Admin\AppData\Local\Temp\1A73.tmp" --splashC:\Users\Admin\AppData\Local\Temp\97b97fa0ec4048598df54e5b2d924e20_NeikiAnalytics.exe F125A4BF498B153F4FA66E09BED9117F2FBDFC73BD57D262EDF598DF2C9AAE9B92E8E37BBC658DD638F09C02F2605F56A1A2A435EF9997FD8BEAD5FFB863C33D2⤵
- Deletes itself
- Executes dropped EXE
PID:1740
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.2MB
MD5b802669b85820ad7c9732833c2a1ed71
SHA13554a09c90c53d00f475f15ee0425dc10db41c7d
SHA256d20f71a0c2f97728ff4c7d42e9014652f1df02e8b8f86b0403991c6a08f4e66e
SHA512b73ab5ddc02f1c42381b819e7b4f0c1bbbe04208ea70c6fb96777d46d6acf0e52f00775c6def19d7528f4efb99c4d4912255f34af32784680e03bcfb3bbc8694