Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
28/06/2024, 13:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe
Resource
win7-20240611-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe
-
Size
2.6MB
-
MD5
6011884027c7190e27d8394a06de6ab0
-
SHA1
4bf3aa2fe0d732e0de1e484baf5c7d28045cc2b7
-
SHA256
9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e
-
SHA512
04b6350cd22974d830c81400cac432b40877c8ffd431ddb15e46af7bf1c39eaad9344370115e6fc8e683970bce8037a448a525e9668203d0e698a36f7ec59c89
-
SSDEEP
49152:dT17pq/X+p1y+kGd7mpHg0KB4O8b8ITDnl1Zka:dTtpZjy+77O
Score
7/10
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wq7AQdF3.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wq7AQdF3.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\IAMSERV = "C:\\Windows\\qMhTU.exe" 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\g: 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened (read-only) \??\i: 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened (read-only) \??\p: 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened (read-only) \??\t: 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened (read-only) \??\x: 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened (read-only) \??\y: 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened (read-only) \??\z: 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened (read-only) \??\m: 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened (read-only) \??\q: 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened (read-only) \??\r: 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened (read-only) \??\w: 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened (read-only) \??\e: 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened (read-only) \??\h: 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened (read-only) \??\o: 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened (read-only) \??\u: 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened (read-only) \??\j: 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened (read-only) \??\k: 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened (read-only) \??\l: 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened (read-only) \??\n: 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened (read-only) \??\s: 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened (read-only) \??\v: 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe -
Modifies WinLogon 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification \??\c:\Windows\SysWOW64\shutdown.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File created \??\c:\Windows\SysWOW64\takeown.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened for modification \??\c:\Windows\SysWOW64\takeown.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File created \??\c:\Windows\SysWOW64\shutdown.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File created \??\c:\Windows\winsxs\x86_microsoft-windows-shutdown-event-tracker_31bf3856ad364e35_6.1.7600.16385_none_02aa6dd4294b8d5f\shutdown.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File created \??\c:\Windows\winsxs\x86_microsoft-windows-takeown_31bf3856ad364e35_6.1.7601.17514_none_fbf2cfb573e03306\takeown.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened for modification C:\Windows\qMhTU.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-shutdown-event-tracker_31bf3856ad364e35_6.1.7600.16385_none_5ec90957e1a8fe95\shutdown.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-shutdown-event-tracker_31bf3856ad364e35_6.1.7600.16385_none_5ec90957e1a8fe95\shutdown.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-takeown_31bf3856ad364e35_6.1.7601.17514_none_58116b392c3da43c\takeown.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File created C:\Windows\qMhTU.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-takeown_31bf3856ad364e35_6.1.7601.17514_none_58116b392c3da43c\takeown.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened for modification \??\c:\Windows\winsxs\x86_microsoft-windows-shutdown-event-tracker_31bf3856ad364e35_6.1.7600.16385_none_02aa6dd4294b8d5f\shutdown.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe File opened for modification \??\c:\Windows\winsxs\x86_microsoft-windows-takeown_31bf3856ad364e35_6.1.7601.17514_none_fbf2cfb573e03306\takeown.exe 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe 2016 9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9987357d56165f70d770956036f866820d519501df699cd8f4ca9e5973bfdd8e_NeikiAnalytics.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2016
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD5799d489a243f74758af2c7ac13921098
SHA172d59d34a3414bd33e33d8bf7e3fcfb2e8427051
SHA256970a10fc5a3354f567a95254dbf5da1695d25f1923ce322ef621f86705294887
SHA5127e44d9f291c87d0dac2d05cbec8ea319738480b23de078b560ab83a559393075345891617ecb0855801f3041a21aeee6168fed64d09b5ea77d41ca6682e1c732