Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
14/06/2024, 01:05
Static task
static1
Behavioral task
behavioral1
Sample
95b029f654b302b0e1c575f9593b47c0_NeikiAnalytics.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
95b029f654b302b0e1c575f9593b47c0_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
95b029f654b302b0e1c575f9593b47c0_NeikiAnalytics.exe
-
Size
90KB
-
MD5
95b029f654b302b0e1c575f9593b47c0
-
SHA1
77a4b869898276ab80fd081802dafcdbc565b0a2
-
SHA256
d6ef3396c8c547a102f767c29ddf5ca5e2854ef052eb7307e3b77cb87eaab70d
-
SHA512
908fd5c0054fc4a841f46b362324a5343211bbade23f6c3201cc8fffb7d45ab70acf989b7725b8afa6b72b263cb55d93f7d72e7afa33d1ecfbea4781d6671602
-
SSDEEP
1536:01Tzy48untU8fOMEI3jyYfPiuOB6dVWMSRlUrRN:+zltUeOsaSdVulCj
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2364 wrote to memory of 2388 2364 95b029f654b302b0e1c575f9593b47c0_NeikiAnalytics.exe 29 PID 2364 wrote to memory of 2388 2364 95b029f654b302b0e1c575f9593b47c0_NeikiAnalytics.exe 29 PID 2364 wrote to memory of 2388 2364 95b029f654b302b0e1c575f9593b47c0_NeikiAnalytics.exe 29 PID 2364 wrote to memory of 2388 2364 95b029f654b302b0e1c575f9593b47c0_NeikiAnalytics.exe 29 PID 2388 wrote to memory of 1716 2388 cmd.exe 30 PID 2388 wrote to memory of 1716 2388 cmd.exe 30 PID 2388 wrote to memory of 1716 2388 cmd.exe 30 PID 2388 wrote to memory of 1716 2388 cmd.exe 30 PID 1716 wrote to memory of 1420 1716 iexpress.exe 31 PID 1716 wrote to memory of 1420 1716 iexpress.exe 31 PID 1716 wrote to memory of 1420 1716 iexpress.exe 31 PID 1716 wrote to memory of 1420 1716 iexpress.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\95b029f654b302b0e1c575f9593b47c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\95b029f654b302b0e1c575f9593b47c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\4F0.tmp\1.bat" "C:\Users\Admin\AppData\Local\Temp\95b029f654b302b0e1c575f9593b47c0_NeikiAnalytics.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\iexpress.exeiexpress /n /q /m C:\Users\Admin\AppData\Local\Temp\popup.sed3⤵
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\makecab.exeC:\Windows\SysWOW64\makecab.exe /f "~%TargetName%.DDF"4⤵PID:1420
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD502dba5f37067292355c6d01a57d4ef48
SHA17c67ab3f99fbf7a53018dd295d2968c525db83d9
SHA2568b74c812ba9e6c536da7edd4101e7e0dddeab8355e5aff095dd31b3f00560242
SHA51212201f949ee3198c8f4b39cc8edf90a114ecf42ddd5383ed0b87e4c78053cd517786dc7af83557e63a0483af74f4c0117d5568441ae761ff6958e758704d602a
-
Filesize
91KB
MD5c498abf84a0ef186c3bb0e3507a2cc64
SHA1385481e215689faf779c87c73c2d4c81b9498911
SHA256e1ff5ba593a86e1a1e14e95367098d659c4e860943c0acb80f4ad3addca62774
SHA512ae39b725f9bd1a61b0b70bf94ab1d756351d77e11d7e1ef061f32e3d98c783e90eeed2651b1e768126ec5fbe31825f656f87a44b0aa6771959f6b7d68b60611a
-
Filesize
724B
MD5c3ca008abd6997c4b036a7e8be75cb2c
SHA105f7a3527bb04c691b08f040f562582035398829
SHA25629ef6bf47dcc8c67f1abe1b269d3518d6a4ebe125daa1ea460779638cb9782a3
SHA512bee0baf3cb83144239077f99f5ca2a6ca7b618f7f51a53e03613ae697e8bc76fa28f5d006296b469be8e1fffeeb35668b5fe87b260b1380cc003815ea9efb083