Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
25/06/2024, 01:11
Static task
static1
Behavioral task
behavioral1
Sample
1b1cc7b95b2f0e128e3d3d509b8a3a963bd8b9d854a1cc5d0d199ba74d18faa4_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
1b1cc7b95b2f0e128e3d3d509b8a3a963bd8b9d854a1cc5d0d199ba74d18faa4_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
1b1cc7b95b2f0e128e3d3d509b8a3a963bd8b9d854a1cc5d0d199ba74d18faa4_NeikiAnalytics.exe
-
Size
202KB
-
MD5
0ba028b2b966fd1554e0b6aaffa0c030
-
SHA1
ee7d318e2dfa3f3ea9b5dd74e0cffa8904d54c07
-
SHA256
1b1cc7b95b2f0e128e3d3d509b8a3a963bd8b9d854a1cc5d0d199ba74d18faa4
-
SHA512
3fcf438fd91dc9c30b99400037c4a0b57ca35c49ba3531f4d8910d67d2dc9a18c449de2c4834256cd7fb28b151730dcdf1d461f464fbf7c295d71f2e857c7992
-
SSDEEP
6144:Oes5Hl4Bb/rW6YboPFaNozVfDNqyyxZLcq6Qowd4YodgEixBkrP:TBrWpoPFaNoZfDNqyoZLcqdowd4YoViq
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1700 1b1cc7b95b2f0e128e3d3d509b8a3a963bd8b9d854a1cc5d0d199ba74d18faa4_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
pid Process 1700 1b1cc7b95b2f0e128e3d3d509b8a3a963bd8b9d854a1cc5d0d199ba74d18faa4_NeikiAnalytics.exe -
Loads dropped DLL 1 IoCs
pid Process 2184 1b1cc7b95b2f0e128e3d3d509b8a3a963bd8b9d854a1cc5d0d199ba74d18faa4_NeikiAnalytics.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2184 1b1cc7b95b2f0e128e3d3d509b8a3a963bd8b9d854a1cc5d0d199ba74d18faa4_NeikiAnalytics.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 1700 1b1cc7b95b2f0e128e3d3d509b8a3a963bd8b9d854a1cc5d0d199ba74d18faa4_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2184 wrote to memory of 1700 2184 1b1cc7b95b2f0e128e3d3d509b8a3a963bd8b9d854a1cc5d0d199ba74d18faa4_NeikiAnalytics.exe 29 PID 2184 wrote to memory of 1700 2184 1b1cc7b95b2f0e128e3d3d509b8a3a963bd8b9d854a1cc5d0d199ba74d18faa4_NeikiAnalytics.exe 29 PID 2184 wrote to memory of 1700 2184 1b1cc7b95b2f0e128e3d3d509b8a3a963bd8b9d854a1cc5d0d199ba74d18faa4_NeikiAnalytics.exe 29 PID 2184 wrote to memory of 1700 2184 1b1cc7b95b2f0e128e3d3d509b8a3a963bd8b9d854a1cc5d0d199ba74d18faa4_NeikiAnalytics.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b1cc7b95b2f0e128e3d3d509b8a3a963bd8b9d854a1cc5d0d199ba74d18faa4_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1b1cc7b95b2f0e128e3d3d509b8a3a963bd8b9d854a1cc5d0d199ba74d18faa4_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\1b1cc7b95b2f0e128e3d3d509b8a3a963bd8b9d854a1cc5d0d199ba74d18faa4_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\1b1cc7b95b2f0e128e3d3d509b8a3a963bd8b9d854a1cc5d0d199ba74d18faa4_NeikiAnalytics.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:1700
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\1b1cc7b95b2f0e128e3d3d509b8a3a963bd8b9d854a1cc5d0d199ba74d18faa4_NeikiAnalytics.exe
Filesize202KB
MD562a4eec5081416bd759458e1d9857d4c
SHA1cfc00b85c173e529c6815d48f9b4bfa0dfd236eb
SHA25644cbc88b49111b22a5ac80805d5a89fc2ee1b8593fe7e1dfb7a58055e635b5fd
SHA51228b1df0a9db8a4e0eafffb2a6d91cb6896052032f2b8b9ecf094fe047e7bb237b59be9d2ef90f5f3b23f8049e369864f5dce0721a35c1ae295950560f71544b6