Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
18s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
03/06/2024, 05:08
Static task
static1
Behavioral task
behavioral1
Sample
9c909de601e74f0aad3eab3b07a41e00_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
9c909de601e74f0aad3eab3b07a41e00_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
9c909de601e74f0aad3eab3b07a41e00_NeikiAnalytics.exe
-
Size
648KB
-
MD5
9c909de601e74f0aad3eab3b07a41e00
-
SHA1
7c8b0b3244a760f9d1e9c6fcc911ff7039ec71a9
-
SHA256
b37dfbc6227eb93f3d46946b0c1c2db0730a2a123a0e4692a88f92b8e84ca898
-
SHA512
9f4a7107be863cf8780f857fa325dc268713b45a4b766f66bddc407ebafa860bf92714f6e810cfaa5050f7c34ebb093e601a12dc59c5c9a11aa68f049ef24e4d
-
SSDEEP
12288:wlbd+Yaplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5/:Wbd+bYTqMi8CtBd2QHCHmTBW5/
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 216 MSWDM.EXE 3852 MSWDM.EXE 2620 9C909DE601E74F0AAD3EAB3B07A41E00_NEIKIANALYTICS.EXE 1892 MSWDM.EXE -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE" MSWDM.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE" MSWDM.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE" 9c909de601e74f0aad3eab3b07a41e00_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE" 9c909de601e74f0aad3eab3b07a41e00_NeikiAnalytics.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\WINDOWS\MSWDM.EXE 9c909de601e74f0aad3eab3b07a41e00_NeikiAnalytics.exe File opened for modification C:\Windows\dev5C78.tmp 9c909de601e74f0aad3eab3b07a41e00_NeikiAnalytics.exe File opened for modification C:\Windows\dev5C78.tmp MSWDM.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3852 MSWDM.EXE 3852 MSWDM.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3264 wrote to memory of 216 3264 9c909de601e74f0aad3eab3b07a41e00_NeikiAnalytics.exe 82 PID 3264 wrote to memory of 216 3264 9c909de601e74f0aad3eab3b07a41e00_NeikiAnalytics.exe 82 PID 3264 wrote to memory of 216 3264 9c909de601e74f0aad3eab3b07a41e00_NeikiAnalytics.exe 82 PID 3264 wrote to memory of 3852 3264 9c909de601e74f0aad3eab3b07a41e00_NeikiAnalytics.exe 83 PID 3264 wrote to memory of 3852 3264 9c909de601e74f0aad3eab3b07a41e00_NeikiAnalytics.exe 83 PID 3264 wrote to memory of 3852 3264 9c909de601e74f0aad3eab3b07a41e00_NeikiAnalytics.exe 83 PID 3852 wrote to memory of 2620 3852 MSWDM.EXE 84 PID 3852 wrote to memory of 2620 3852 MSWDM.EXE 84 PID 3852 wrote to memory of 1892 3852 MSWDM.EXE 87 PID 3852 wrote to memory of 1892 3852 MSWDM.EXE 87 PID 3852 wrote to memory of 1892 3852 MSWDM.EXE 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\9c909de601e74f0aad3eab3b07a41e00_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9c909de601e74f0aad3eab3b07a41e00_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\WINDOWS\MSWDM.EXE"C:\WINDOWS\MSWDM.EXE"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:216
-
-
C:\WINDOWS\MSWDM.EXE-r!C:\Windows\dev5C78.tmp!C:\Users\Admin\AppData\Local\Temp\9c909de601e74f0aad3eab3b07a41e00_NeikiAnalytics.exe! !2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\9C909DE601E74F0AAD3EAB3B07A41E00_NEIKIANALYTICS.EXE3⤵
- Executes dropped EXE
PID:2620
-
-
C:\WINDOWS\MSWDM.EXE-e!C:\Windows\dev5C78.tmp!C:\Users\Admin\AppData\Local\Temp\9C909DE601E74F0AAD3EAB3B07A41E00_NEIKIANALYTICS.EXE!3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1892
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
648KB
MD5e94f4784d79b9ee07bac634e02ba4ac4
SHA10538de7aa713f3ffa5ec5d0246957498bf37f45d
SHA2566421d471ab1f00adc2a9809eaa977366fccab59d5625d90070834ca15ae035db
SHA5126047d7c756d05be907b4784e5c7a6f662bbe32610681b176b4c26e8e98a2c38c9dfcf136745230987f0987b66d9f983684a1129ac3cb086d51d45213afdb0b1d
-
Filesize
80KB
MD5ca1665aebc386a9e1e00e62a6f24bccd
SHA1ace8a60b685b6e870d0952fd7de8b1157112db6a
SHA2569a7574d09ccc52c090ac586db59b15f7295fb15f6c2a1492558cb6d4cfdd5d3d
SHA512bd227870c2e6b67e11e532e43aecdd0af65745a31cc0beed86032bb00879a3eddeb9ddeae7bcc7089fee758179e2b7b9f567957f7f2fcfc69ed766d5feaa6d17
-
Filesize
568KB
MD504fb3ae7f05c8bc333125972ba907398
SHA1df22612647e9404a515d48ebad490349685250de
SHA2562fb898bacb587f2484c9c4aa6da2729079d93d1f923a017bb84beef87bf74fef
SHA51294c164a0b884c939ece30f5038d07b756702998d46786f9f613fbea2eb30bed4bc19a409f347bb4cc565898473b18155d580b453683223beaf30ed4079c251b2