Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    13/06/2024, 11:39

General

  • Target

    78d77fb12f77ccaa70c7e6ee0b325100_NeikiAnalytics.exe

  • Size

    223KB

  • MD5

    78d77fb12f77ccaa70c7e6ee0b325100

  • SHA1

    7184d5a7d00bf0b1fbfb2bbc60906e1ef1622b5b

  • SHA256

    672357abda41b35346349e564291cc0c6f1a6ec89e9e88f62a029ad38130533f

  • SHA512

    402e6a63591c8f6878f255d2190e99354ea8d3c462c8af21a34259f528d4318f67daeb59faf01036897701c147ef522cf7ad081a383f3b0d0a0a318ad8bc4fc7

  • SSDEEP

    3072:+a2Od6alGA7a2rhqZeqBiLq+NYL69HWtpBUgZLz3SWJQ9kmNBSfcrcwjqjXhjueo:+nRA79NqZeoi+CHQvZ3xaGLVVWP

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\78d77fb12f77ccaa70c7e6ee0b325100_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\78d77fb12f77ccaa70c7e6ee0b325100_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1972
    • C:\Users\Admin\AppData\Local\Temp\78d77fb12f77ccaa70c7e6ee0b325100_NeikiAnalytics.exe
      C:\Users\Admin\AppData\Local\Temp\78d77fb12f77ccaa70c7e6ee0b325100_NeikiAnalytics.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\78d77fb12f77ccaa70c7e6ee0b325100_NeikiAnalytics.exe

    Filesize

    223KB

    MD5

    2be29bee96bb1f05ecf1c73fd519e869

    SHA1

    63e636a352656b04dda1a0e62203143c87f6fd7e

    SHA256

    6e06e2dcc4d5d0c1607fd2712da9aeea47954b6c44b8f5a6f3e7052217db4a93

    SHA512

    bc7cab2cee8ddedbf6f3d7075ea85e25e9cc728d6001f905d4aa01fce58889ef9875705fa347f04c9c5bd2ef3c42e010508c8f47f66a3caf5d3408ba07afc5ba

  • memory/1972-0-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

  • memory/1972-8-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

  • memory/2832-10-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

  • memory/2832-11-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/2832-16-0x0000000000130000-0x0000000000176000-memory.dmp

    Filesize

    280KB

  • memory/2832-17-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB