Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11/06/2024, 04:20
Static task
static1
Behavioral task
behavioral1
Sample
275e42090d20bdfc4d434c840c1a8240_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
275e42090d20bdfc4d434c840c1a8240_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
275e42090d20bdfc4d434c840c1a8240_NeikiAnalytics.exe
-
Size
416KB
-
MD5
275e42090d20bdfc4d434c840c1a8240
-
SHA1
49ff65a1b81255f57ebc408e4d2632e1d6ead542
-
SHA256
1937e58368d011938ba8207b960bd7ebc881ac9e6f09ad25a2e3bdfce255b93c
-
SHA512
936a4f766a516a45840bfc6a75e55e8ac08d5a0e4e5e157b186e9d3397674b69ccb22697bab1f547d33caf27dcc2e6e857363627575c2ee365412fb597715030
-
SSDEEP
6144:AewfUVIhGEY4MBPd/DvQGZl079H0W7cyqCxSngmMBqfycuPbUl0i5cD5J6KE:AeusKGEY4MBPdVY7j0npM4dl0v5JdE
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 552 275e42090d20bdfc4d434c840c1a8240_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
pid Process 552 275e42090d20bdfc4d434c840c1a8240_NeikiAnalytics.exe -
Program crash 7 IoCs
pid pid_target Process procid_target 2740 2784 WerFault.exe 81 2428 552 WerFault.exe 88 3180 552 WerFault.exe 88 1000 552 WerFault.exe 88 1148 552 WerFault.exe 88 4260 552 WerFault.exe 88 4948 552 WerFault.exe 88 -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2784 275e42090d20bdfc4d434c840c1a8240_NeikiAnalytics.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 552 275e42090d20bdfc4d434c840c1a8240_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2784 wrote to memory of 552 2784 275e42090d20bdfc4d434c840c1a8240_NeikiAnalytics.exe 88 PID 2784 wrote to memory of 552 2784 275e42090d20bdfc4d434c840c1a8240_NeikiAnalytics.exe 88 PID 2784 wrote to memory of 552 2784 275e42090d20bdfc4d434c840c1a8240_NeikiAnalytics.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\275e42090d20bdfc4d434c840c1a8240_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\275e42090d20bdfc4d434c840c1a8240_NeikiAnalytics.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 3842⤵
- Program crash
PID:2740
-
-
C:\Users\Admin\AppData\Local\Temp\275e42090d20bdfc4d434c840c1a8240_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\275e42090d20bdfc4d434c840c1a8240_NeikiAnalytics.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:552 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 3523⤵
- Program crash
PID:2428
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 7683⤵
- Program crash
PID:3180
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 8083⤵
- Program crash
PID:1000
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 8163⤵
- Program crash
PID:1148
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 7763⤵
- Program crash
PID:4260
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 7963⤵
- Program crash
PID:4948
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2784 -ip 27841⤵PID:984
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 552 -ip 5521⤵PID:3368
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 552 -ip 5521⤵PID:4316
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 552 -ip 5521⤵PID:3232
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 552 -ip 5521⤵PID:1688
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 552 -ip 5521⤵PID:1424
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 552 -ip 5521⤵PID:2076
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
416KB
MD591e2e817327d4fee41849c8a909a2d4c
SHA132b0688957578c186ccd219e02904bdf61bf25c5
SHA25685e8928aa834501aa800ff018641b85feda2245f2bff76dfc7c68f3c806097b1
SHA5125b5311a92a023e776b02c29fbdaf2d341f3ed38a2792bc84606893fe499e3eec9a7ad9ac206bc5df574a19a4d623136a55eb37a9a2dd5dba570041511bd443cc