Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
131s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03/06/2024, 04:26
Static task
static1
Behavioral task
behavioral1
Sample
9b74a4ca221c2e1b0be9b17c0775ddc0_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
9b74a4ca221c2e1b0be9b17c0775ddc0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
9b74a4ca221c2e1b0be9b17c0775ddc0_NeikiAnalytics.exe
-
Size
79KB
-
MD5
9b74a4ca221c2e1b0be9b17c0775ddc0
-
SHA1
2bbde37b317da865d5fb9f2db1ca02d5ee1e13dd
-
SHA256
6e0ebc882363ee02132324b4071383aa6720bf285f92e39012351603acde700f
-
SHA512
d974df05a9a20e6f2fbeff9eb6aea2cd5252650806b9b4fd677e6dd195fc3897edcbecc06fa9b35f5600636c3bbf3f07744f0ac843c13c9698c82b1c6f32d65f
-
SSDEEP
1536:zvYONtUW2tbTs1OQA8AkqUhMb2nuy5wgIP0CSJ+5y9PB8GMGlZ5G:zvYODUTpfGdqU7uy5w9WMy9PN5G
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1484 [email protected] -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4448 wrote to memory of 1388 4448 9b74a4ca221c2e1b0be9b17c0775ddc0_NeikiAnalytics.exe 84 PID 4448 wrote to memory of 1388 4448 9b74a4ca221c2e1b0be9b17c0775ddc0_NeikiAnalytics.exe 84 PID 4448 wrote to memory of 1388 4448 9b74a4ca221c2e1b0be9b17c0775ddc0_NeikiAnalytics.exe 84 PID 1388 wrote to memory of 1484 1388 cmd.exe 85 PID 1388 wrote to memory of 1484 1388 cmd.exe 85 PID 1388 wrote to memory of 1484 1388 cmd.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b74a4ca221c2e1b0be9b17c0775ddc0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9b74a4ca221c2e1b0be9b17c0775ddc0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\SysWOW64\cmd.exePID:1388
-
C:\Users\Admin\AppData\Local\Temp\[email protected]PID:1484
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\[email protected]
Filesize79KB
MD54c22909f6ca7ecf0dd3c3ba30cd871b1
SHA1d4190f19e0fc75c022c8518892acf4bc8ef51a46
SHA2564a094e7c996fedf3170c47b91390e6a8fea0de1ad652bd565b98c42fc477357e
SHA512bdb1b64ea8f0494e981ba26da8ab2e19043d13c93bb88a7fda3fe1fa447ce96acfde3544bee209a06b1bd85b5041812ef057174c45635e974931b2111a175774