Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
16/06/2024, 00:18
Static task
static1
Behavioral task
behavioral1
Sample
c5f7b6d669ff3b85fa5d7bd6e4e16130_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
c5f7b6d669ff3b85fa5d7bd6e4e16130_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
c5f7b6d669ff3b85fa5d7bd6e4e16130_NeikiAnalytics.exe
-
Size
4.2MB
-
MD5
c5f7b6d669ff3b85fa5d7bd6e4e16130
-
SHA1
9de79260f51149d80303a781923963d4ac5325e7
-
SHA256
5b0098bc06d6c48e0af71aaa91dccdf66d95774ba7f26c7c5fd607b560cd610a
-
SHA512
e80ae9aa653cdeddd0bc135174b9bed6a2612c53944d9d09c284f3d8ab08f6cef577e227c2c964f657c56f131edfdba84fd828ec72459d30ce42b60fc649d411
-
SSDEEP
98304:Cmhd1UryeToJewgWvEn0cDXbuVLUjH5oxFbxhVLUjH5oxFbx:ClzozgWMn0c7buVUjZEdhVUjZEd
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2876 2118.tmp -
Executes dropped EXE 1 IoCs
pid Process 2876 2118.tmp -
Loads dropped DLL 2 IoCs
pid Process 836 c5f7b6d669ff3b85fa5d7bd6e4e16130_NeikiAnalytics.exe 836 c5f7b6d669ff3b85fa5d7bd6e4e16130_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 836 wrote to memory of 2876 836 c5f7b6d669ff3b85fa5d7bd6e4e16130_NeikiAnalytics.exe 28 PID 836 wrote to memory of 2876 836 c5f7b6d669ff3b85fa5d7bd6e4e16130_NeikiAnalytics.exe 28 PID 836 wrote to memory of 2876 836 c5f7b6d669ff3b85fa5d7bd6e4e16130_NeikiAnalytics.exe 28 PID 836 wrote to memory of 2876 836 c5f7b6d669ff3b85fa5d7bd6e4e16130_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5f7b6d669ff3b85fa5d7bd6e4e16130_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\c5f7b6d669ff3b85fa5d7bd6e4e16130_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Users\Admin\AppData\Local\Temp\2118.tmp"C:\Users\Admin\AppData\Local\Temp\2118.tmp" --splashC:\Users\Admin\AppData\Local\Temp\c5f7b6d669ff3b85fa5d7bd6e4e16130_NeikiAnalytics.exe 9B15695836C8A53A0A8352BADE5846A09BD7EC1F90121F846AF5FDEDB2F85F60F9CC49D8F0B33C99AF819C75F6E94F2A6B3D8A0EC0E491E6E11721799F596CF42⤵
- Deletes itself
- Executes dropped EXE
PID:2876
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.2MB
MD57327a7b7894c788e367c0e537c0bbf8b
SHA17cff2c1e4587098ad186ae5315b05de0f7c8f9e1
SHA256bdcfbcf9c981f278a6bcffeb78673032ad502b67ef09aa31db8154c81395cb31
SHA512ba02ce5b832b7ea7cc6266ebcddc23939a594d9f8b56bfcc1256fe185b59a4cd56d130c56c9082100eaa3818b5fb7553a70b49fb2026696c53d30089a2f35c67