Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27/06/2024, 11:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe
-
Size
90KB
-
MD5
80d2a1552f4db9890d2c2dc118f02040
-
SHA1
e8d9056fb113d088dc68e622479e29a0fbdc907d
-
SHA256
8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639
-
SHA512
49c2c6b34c288ea8a1022e55fbab96a1ac6c15ad2a3048cfbeff1191dcfd476006b3bdcb3b485925cc5a6fb388e0617a929e409aabeb9c889bba8d7c9651ef7e
-
SSDEEP
768:f6F85fJTL9dKzMomchzSyohdjTRg5EZl3HQbfEDOKS++ojbVOOf:Sq51WzMvcdSywJdjl3wFs+dOf
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\USR_Shohdi_Photo_USR.rsu 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\USR_Shohdi_Photo_USR.rsu 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jmc.usr 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.usr 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\INFOPATH.EXE 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\crashreporter.usr 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\default-browser-agent.usr 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\Install\{5629EE71-1934-428C-A492-DBD2787497EC}\chrome_installer.usr 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Games\FreeCell\FreeCell.usr 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Games\Purble Place\PurblePlace.usr 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.usr 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.usr 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.usr 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\7-Zip\Uninstall.exe 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome.exe 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.usr 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\vsta_ep32.usr 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\ssvagent.usr 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\firefox.usr 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Games\Mahjong\Mahjong.exe 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.usr 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.usr 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\VideoLAN\VLC\uninstall.exe 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.usr 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\Install\{5629EE71-1934-428C-A492-DBD2787497EC}\chrome_installer.exe 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.usr 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.EXE 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\7-Zip\7zG.exe 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.usr 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\BCSSync.usr 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\VideoLAN\VLC\uninstall.usr 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.usr 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.usr 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\plugin-container.usr 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\vsta_ep32.exe 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\misc.usr 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome.usr 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.usr 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\javaw.exe 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\GROOVE.usr 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.usr 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Games\Hearts\Hearts.usr 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.usr 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\MSPUB.usr 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Games\Hearts\Hearts.exe 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\USR_Shohdi_Photo_USR.exe 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2844 8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
PID:2844
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD580d2a1552f4db9890d2c2dc118f02040
SHA1e8d9056fb113d088dc68e622479e29a0fbdc907d
SHA2568378638bbb98d95290b51c45675814335802defd0c19ce7e751925fa19f99639
SHA51249c2c6b34c288ea8a1022e55fbab96a1ac6c15ad2a3048cfbeff1191dcfd476006b3bdcb3b485925cc5a6fb388e0617a929e409aabeb9c889bba8d7c9651ef7e