Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    25/06/2024, 01:11

General

  • Target

    1b1cc7b95b2f0e128e3d3d509b8a3a963bd8b9d854a1cc5d0d199ba74d18faa4_NeikiAnalytics.exe

  • Size

    202KB

  • MD5

    0ba028b2b966fd1554e0b6aaffa0c030

  • SHA1

    ee7d318e2dfa3f3ea9b5dd74e0cffa8904d54c07

  • SHA256

    1b1cc7b95b2f0e128e3d3d509b8a3a963bd8b9d854a1cc5d0d199ba74d18faa4

  • SHA512

    3fcf438fd91dc9c30b99400037c4a0b57ca35c49ba3531f4d8910d67d2dc9a18c449de2c4834256cd7fb28b151730dcdf1d461f464fbf7c295d71f2e857c7992

  • SSDEEP

    6144:Oes5Hl4Bb/rW6YboPFaNozVfDNqyyxZLcq6Qowd4YodgEixBkrP:TBrWpoPFaNoZfDNqyoZLcqdowd4YoViq

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1b1cc7b95b2f0e128e3d3d509b8a3a963bd8b9d854a1cc5d0d199ba74d18faa4_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\1b1cc7b95b2f0e128e3d3d509b8a3a963bd8b9d854a1cc5d0d199ba74d18faa4_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2184
    • C:\Users\Admin\AppData\Local\Temp\1b1cc7b95b2f0e128e3d3d509b8a3a963bd8b9d854a1cc5d0d199ba74d18faa4_NeikiAnalytics.exe
      C:\Users\Admin\AppData\Local\Temp\1b1cc7b95b2f0e128e3d3d509b8a3a963bd8b9d854a1cc5d0d199ba74d18faa4_NeikiAnalytics.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:1700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\1b1cc7b95b2f0e128e3d3d509b8a3a963bd8b9d854a1cc5d0d199ba74d18faa4_NeikiAnalytics.exe

    Filesize

    202KB

    MD5

    62a4eec5081416bd759458e1d9857d4c

    SHA1

    cfc00b85c173e529c6815d48f9b4bfa0dfd236eb

    SHA256

    44cbc88b49111b22a5ac80805d5a89fc2ee1b8593fe7e1dfb7a58055e635b5fd

    SHA512

    28b1df0a9db8a4e0eafffb2a6d91cb6896052032f2b8b9ecf094fe047e7bb237b59be9d2ef90f5f3b23f8049e369864f5dce0721a35c1ae295950560f71544b6

  • memory/1700-11-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/1700-13-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/1700-17-0x0000000000130000-0x000000000016E000-memory.dmp

    Filesize

    248KB

  • memory/1700-18-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/2184-0-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/2184-8-0x0000000000180000-0x00000000001BE000-memory.dmp

    Filesize

    248KB

  • memory/2184-10-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB