Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
80s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24/06/2024, 21:07
Static task
static1
Behavioral task
behavioral1
Sample
03ad5c7c8fb5e90d46a6b7b762a37a826e147b052632b3541588f3e121a58ced_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
03ad5c7c8fb5e90d46a6b7b762a37a826e147b052632b3541588f3e121a58ced_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
03ad5c7c8fb5e90d46a6b7b762a37a826e147b052632b3541588f3e121a58ced_NeikiAnalytics.exe
-
Size
32KB
-
MD5
afdd7a49c5a1b88779ef43e7d6142490
-
SHA1
dc51449b88dad09c8bbcf40b4bb52376ddc26148
-
SHA256
03ad5c7c8fb5e90d46a6b7b762a37a826e147b052632b3541588f3e121a58ced
-
SHA512
cbd5466cab7b57276a5eb76834828ecf183399f84f14427528219a25b0ced1c2f265a4a14fe21e56914a8b9133bf66f9dcabdda498ebee6c3bdd0824dbfb39c5
-
SSDEEP
384:Q98xUHQ+i8EBepM5Oy4Ng8zLeiUerZaGULt0BTfCAx7ZXQUwG5kAyAe0g:TweTCM8/gop1aGUJcOG9wGzY0g
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinHttp = "C:\\Users\\Admin\\AppData\\Local\\WinHttp.exe" regedit.exe -
Runs .reg file with regedit 1 IoCs
pid Process 4180 regedit.exe -
Suspicious behavior: RenamesItself 2 IoCs
pid Process 1504 03ad5c7c8fb5e90d46a6b7b762a37a826e147b052632b3541588f3e121a58ced_NeikiAnalytics.exe 1504 03ad5c7c8fb5e90d46a6b7b762a37a826e147b052632b3541588f3e121a58ced_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1504 wrote to memory of 4180 1504 03ad5c7c8fb5e90d46a6b7b762a37a826e147b052632b3541588f3e121a58ced_NeikiAnalytics.exe 80 PID 1504 wrote to memory of 4180 1504 03ad5c7c8fb5e90d46a6b7b762a37a826e147b052632b3541588f3e121a58ced_NeikiAnalytics.exe 80 PID 1504 wrote to memory of 4180 1504 03ad5c7c8fb5e90d46a6b7b762a37a826e147b052632b3541588f3e121a58ced_NeikiAnalytics.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\03ad5c7c8fb5e90d46a6b7b762a37a826e147b052632b3541588f3e121a58ced_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\03ad5c7c8fb5e90d46a6b7b762a37a826e147b052632b3541588f3e121a58ced_NeikiAnalytics.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\SysWOW64\regedit.exeregedit.exe /s C:\Users\Admin\AppData\Local\Temp\~dfds3.reg2⤵
- Adds Run key to start application
- Runs .reg file with regedit
PID:4180
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
166B
MD5f44153ef26be29552cf320325ad8b72e
SHA174ac72ba2ff0f871e59b11c95ad707372662370c
SHA256767009fb8726500a4bc54b2ee744cc3ada64fdf16a44e22ff9dfe7652e2a439f
SHA5121d42a4dba1d8d0df9f8fedfba384ffdbcff3103c8ba360f255b5d7e8a46128f40521e4d16cf6de04365b3b6ffad8bc681cf7042d92867ab3d912601a3d5e6e65
-
Filesize
32KB
MD5b2af8fff47c8abe8513fee33c00f48d1
SHA1099bb4f950a3469014b78a3906fe9783bdd6cbff
SHA25684e8847ec953fd77dfe2baca48d47279f235039e1098b4047af861b7493f100b
SHA512161ac51858fd6cd53170d2f4485dc893053e51f14f53446c2a1b2fafa68d77c6b04fa3d91f5289996fa3ed4c67d1a40f865aee82b34692d6ef3a527e8f91b3fb