Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

7

305c46683b...cs.exe

windows7-x64

7

305c46683b...cs.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    140s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    25/06/2024, 04:41 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    305c46683b95746e2ec25d71325dd5ccb97e541f41b02d8760382f44f5c73b76_NeikiAnalytics.exe

  • Size

    83KB

  • MD5

    aba61398e23a300ea86f1a02f3669fb0

  • SHA1

    8c4d63f0a7b0a44b96dff28101044ba32ba4ac7f

  • SHA256

    305c46683b95746e2ec25d71325dd5ccb97e541f41b02d8760382f44f5c73b76

  • SHA512

    94d38a19a981f60c33505bc50df46fc46822add9063d6ab3f8c989d7d44b8e7d74c09e162e46bda28aa3517d3f3efac769d98e3245eac63f8cd187b34d8cf6cc

  • SSDEEP

    1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+3K:LJ0TAz6Mte4A+aaZx8EnCGVu3

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx

Processes

  • C:\Users\Admin\AppData\Local\Temp\305c46683b95746e2ec25d71325dd5ccb97e541f41b02d8760382f44f5c73b76_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\305c46683b95746e2ec25d71325dd5ccb97e541f41b02d8760382f44f5c73b76_NeikiAnalytics.exe"
    1⤵
      PID:2424

    Network

    • flag-us
      DNS
      wecan.hasthe.technology
      305c46683b95746e2ec25d71325dd5ccb97e541f41b02d8760382f44f5c73b76_NeikiAnalytics.exe
      Remote address:
      8.8.8.8:53
      Request
      wecan.hasthe.technology
      IN A
      Response
      wecan.hasthe.technology
      IN A
      172.67.183.40
      wecan.hasthe.technology
      IN A
      104.21.59.199
    • flag-us
      POST
      http://wecan.hasthe.technology/upload
      305c46683b95746e2ec25d71325dd5ccb97e541f41b02d8760382f44f5c73b76_NeikiAnalytics.exe
      Remote address:
      172.67.183.40:80
      Request
      POST /upload HTTP/1.1
      Host: wecan.hasthe.technology
      Accept: */*
      Content-Length: 85412
      Expect: 100-continue
      Content-Type: multipart/form-data; boundary=------------------------51fcc7f552ef999f
      Response
      HTTP/1.1 301 Moved Permanently
      Date: Tue, 25 Jun 2024 04:41:37 GMT
      Content-Type: text/html
      Content-Length: 167
      Connection: keep-alive
      Cache-Control: max-age=3600
      Expires: Tue, 25 Jun 2024 05:41:37 GMT
      Location: https://computernewb.com/collab-vm/
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ualAJuE9gUV0N%2F66OJ3wfCSoigHTDDVTgfhU0ykZ2IowAKYXWZ6QqWmjMrpllgOuk%2FmZNSnJWI1vjXIkgm%2FSdt1C6hKfDOfFOY3kVMXuu10539aYjdGEUT5z3ccpdqvGVItfcu9orZS2XQ%3D%3D"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 899249478ba1949c-LHR
    • flag-us
      POST
      http://wecan.hasthe.technology/upload
      305c46683b95746e2ec25d71325dd5ccb97e541f41b02d8760382f44f5c73b76_NeikiAnalytics.exe
      Remote address:
      172.67.183.40:80
      Request
      POST /upload HTTP/1.1
      Host: wecan.hasthe.technology
      Accept: */*
      Content-Length: 85412
      Expect: 100-continue
      Content-Type: multipart/form-data; boundary=------------------------4eda4444e0854756
      Response
      HTTP/1.1 301 Moved Permanently
      Date: Tue, 25 Jun 2024 04:42:07 GMT
      Content-Type: text/html
      Content-Length: 167
      Connection: keep-alive
      Cache-Control: max-age=3600
      Expires: Tue, 25 Jun 2024 05:42:07 GMT
      Location: https://computernewb.com/collab-vm/
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KKrXtSkBj%2B35cgExiSM9lZRoy4CK3%2Fd22BNy%2FCY5%2FJNeJI%2FCMB6CzQ3zJ3CSgutttlyaHEpWb3LrqQVvnlBpJDYrkaO80loCoasc%2FNHqhUQUltH%2FnPKaHF1pRMzucFQf8dyyWQ46CeFDDQ%3D%3D"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 89924a03ae7794fd-LHR
    • flag-us
      POST
      http://wecan.hasthe.technology/upload
      305c46683b95746e2ec25d71325dd5ccb97e541f41b02d8760382f44f5c73b76_NeikiAnalytics.exe
      Remote address:
      172.67.183.40:80
      Request
      POST /upload HTTP/1.1
      Host: wecan.hasthe.technology
      Accept: */*
      Content-Length: 85412
      Expect: 100-continue
      Content-Type: multipart/form-data; boundary=------------------------91e805432f0b37b8
      Response
      HTTP/1.1 301 Moved Permanently
      Date: Tue, 25 Jun 2024 04:42:37 GMT
      Content-Type: text/html
      Content-Length: 167
      Connection: keep-alive
      Cache-Control: max-age=3600
      Expires: Tue, 25 Jun 2024 05:42:37 GMT
      Location: https://computernewb.com/collab-vm/
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=coKdQErnGB9rg0J95qG5F3f%2BNgPjBIYVKqvihKvzty36agWLXiMhUMmgXQ8DFM2nkPpTO4o0BH4F%2B5%2FJZuk6IH7JOqBoT2%2FQyv2zugSmrUKZrit9y9434tnjUIBaqHi%2FFR7QHKn%2FKDrPMA%3D%3D"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 89924abfd9a8947c-LHR
    • flag-us
      POST
      http://wecan.hasthe.technology/upload
      305c46683b95746e2ec25d71325dd5ccb97e541f41b02d8760382f44f5c73b76_NeikiAnalytics.exe
      Remote address:
      172.67.183.40:80
      Request
      POST /upload HTTP/1.1
      Host: wecan.hasthe.technology
      Accept: */*
      Content-Length: 85412
      Expect: 100-continue
      Content-Type: multipart/form-data; boundary=------------------------7ea6c728000195aa
      Response
      HTTP/1.1 301 Moved Permanently
      Date: Tue, 25 Jun 2024 04:43:07 GMT
      Content-Type: text/html
      Content-Length: 167
      Connection: keep-alive
      Cache-Control: max-age=3600
      Expires: Tue, 25 Jun 2024 05:43:07 GMT
      Location: https://computernewb.com/collab-vm/
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PtfCBQB2nTR2zndXiqwp5PZQqv9KCdvR%2FEVgIFcaqDSWI%2B1LbA89MefZm%2Bn75xByv85ZWSLT5Zmas5k%2BviBaAl6JAZkJ5uOLCp7UCJJOX0EPMvvrAgDfDLXZ6INr2wgUD7FyWgYEhM%2BnGA%3D%3D"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 89924b7c0f1852c2-LHR
    • 172.67.183.40:80
      http://wecan.hasthe.technology/upload
      http
      305c46683b95746e2ec25d71325dd5ccb97e541f41b02d8760382f44f5c73b76_NeikiAnalytics.exe
      3.4kB
       1.2kB
       7
      8

      HTTP Request

      POST http://wecan.hasthe.technology/upload

      HTTP Response

      301
    • 172.67.183.40:80
      http://wecan.hasthe.technology/upload
      http
      305c46683b95746e2ec25d71325dd5ccb97e541f41b02d8760382f44f5c73b76_NeikiAnalytics.exe
      3.4kB
       1.2kB
       7
      9

      HTTP Request

      POST http://wecan.hasthe.technology/upload

      HTTP Response

      301
    • 172.67.183.40:80
      http://wecan.hasthe.technology/upload
      http
      305c46683b95746e2ec25d71325dd5ccb97e541f41b02d8760382f44f5c73b76_NeikiAnalytics.exe
      3.4kB
       1.2kB
       7
      9

      HTTP Request

      POST http://wecan.hasthe.technology/upload

      HTTP Response

      301
    • 172.67.183.40:80
      http://wecan.hasthe.technology/upload
      http
      305c46683b95746e2ec25d71325dd5ccb97e541f41b02d8760382f44f5c73b76_NeikiAnalytics.exe
      3.4kB
       1.2kB
       7
      9

      HTTP Request

      POST http://wecan.hasthe.technology/upload

      HTTP Response

      301
    • 8.8.8.8:53
      wecan.hasthe.technology
      dns
      305c46683b95746e2ec25d71325dd5ccb97e541f41b02d8760382f44f5c73b76_NeikiAnalytics.exe
      69 B
       101 B
       1
      1

      DNS Request

      wecan.hasthe.technology

      DNS Response

      172.67.183.40
      104.21.59.199

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\rifaien2-sWEltR4evQuaGUfK.exe
      Filesize

      83KB

      MD5

      ec22999f63ea7835f63125c4b188d2ab

      SHA1

      ed6a07f90f9dbb65ca425542158e3157b3494786

      SHA256

      90c6757ad1851300320d7716abaa7d006bb4f08d2763455cc48b69f05b38a284

      SHA512

      ec4ac9c7d9b9d439c85db8988904841984ab8c55281c6b67affa8f3d435353396d8a30dd5e1b6bb42777355112d3f7e05cf4e9937da6232be63d08606531800a

      Download Submit

    • memory/2424-0-0x0000000000400000-0x000000000042A000-memory.dmp

      Filesize

      168KB

      Download

    • memory/2424-1-0x0000000000400000-0x000000000042A000-memory.dmp

      Filesize

      168KB

      Download

    • memory/2424-7-0x0000000000400000-0x000000000042A000-memory.dmp

      Filesize

      168KB

      Download

    • memory/2424-14-0x0000000000400000-0x000000000042A000-memory.dmp

      Filesize

      168KB

      Download

    • memory/2424-21-0x0000000000400000-0x000000000042A000-memory.dmp

      Filesize

      168KB

      Download

    • memory/2424-28-0x0000000000400000-0x000000000042A000-memory.dmp

      Filesize

      168KB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.