Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
78afc3a9c6f...cs.exe
windows7-x64
78afc3a9c6f...cs.exe
windows10-2004-x64
7$PLUGINSDI...ay.dll
windows7-x64
3$PLUGINSDI...ay.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...sh.dll
windows7-x64
1$PLUGINSDI...sh.dll
windows10-2004-x64
1$PLUGINSDI...on.dll
windows7-x64
7$PLUGINSDI...on.dll
windows10-2004-x64
7Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
29/06/2024, 08:26
Behavioral task
behavioral1
Sample
8afc3a9c6f5cc5ccd661bacd585d602fa75e26a6b4c1e02fb149fcba80d23667_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
8afc3a9c6f5cc5ccd661bacd585d602fa75e26a6b4c1e02fb149fcba80d23667_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/NSISArray.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/NSISArray.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/newadvsplash.dll
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/newadvsplash.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/version.dll
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/version.dll
Resource
win10v2004-20240508-en
General
-
Target
8afc3a9c6f5cc5ccd661bacd585d602fa75e26a6b4c1e02fb149fcba80d23667_NeikiAnalytics.exe
-
Size
115KB
-
MD5
c5d2bcbe795409e28968a1014f125830
-
SHA1
f7d6f4c1369e4ec0c181fa54b0b53c17fe9934c0
-
SHA256
8afc3a9c6f5cc5ccd661bacd585d602fa75e26a6b4c1e02fb149fcba80d23667
-
SHA512
fdc3f91d32df6807e39511c2018184e13440d622f0d29779063f5442db6a7b9c8d3ec23f3331c9f1ccd530588de55c38d1e8f216490426d675f189a3af7be6cb
-
SSDEEP
3072:OgXdZt9P6D3XJA45ecEXQnn3UQwIAwP5kTkO0nc6++ENVmw:Oe34eFcEAn/bRkKc6Umw
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x003200000001655d-43.dat acprotect -
Loads dropped DLL 10 IoCs
pid Process 1572 8afc3a9c6f5cc5ccd661bacd585d602fa75e26a6b4c1e02fb149fcba80d23667_NeikiAnalytics.exe 1572 8afc3a9c6f5cc5ccd661bacd585d602fa75e26a6b4c1e02fb149fcba80d23667_NeikiAnalytics.exe 1572 8afc3a9c6f5cc5ccd661bacd585d602fa75e26a6b4c1e02fb149fcba80d23667_NeikiAnalytics.exe 1572 8afc3a9c6f5cc5ccd661bacd585d602fa75e26a6b4c1e02fb149fcba80d23667_NeikiAnalytics.exe 1572 8afc3a9c6f5cc5ccd661bacd585d602fa75e26a6b4c1e02fb149fcba80d23667_NeikiAnalytics.exe 1572 8afc3a9c6f5cc5ccd661bacd585d602fa75e26a6b4c1e02fb149fcba80d23667_NeikiAnalytics.exe 1572 8afc3a9c6f5cc5ccd661bacd585d602fa75e26a6b4c1e02fb149fcba80d23667_NeikiAnalytics.exe 1572 8afc3a9c6f5cc5ccd661bacd585d602fa75e26a6b4c1e02fb149fcba80d23667_NeikiAnalytics.exe 1572 8afc3a9c6f5cc5ccd661bacd585d602fa75e26a6b4c1e02fb149fcba80d23667_NeikiAnalytics.exe 1572 8afc3a9c6f5cc5ccd661bacd585d602fa75e26a6b4c1e02fb149fcba80d23667_NeikiAnalytics.exe -
resource yara_rule behavioral1/files/0x003200000001655d-43.dat upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD5f7199ab921dae609a588ca5ec85b0058
SHA1d17bd6d907692ace79847fbb3b92e98b049e7c11
SHA2568675428a64dce458ff1c96ca1699d7b67ad540e8f71319ca9d11c970d34033fb
SHA512c656943c500e78c3429e9838f63c2de48f82c468e05cd3915ff38de22ff9214aefb8273c02b6577f5d220a9da4b6177ee71ca8b09508019e5b24b2fbd582f1ef
-
Filesize
19KB
MD514b848866035dea39b912da628307231
SHA1d00c8963aee8038d8a22f098cef69b31007196e5
SHA2566a129a9eefae85a9412e889e0c74fdaa21d20254fa13cacef5429885775017dc
SHA5124538058426c742bf7d823d1cac5303eeff8bf0b524459262181ac79695eead705e7590ae63ce996b8e3afd9a6c8d1fec503f9a11772ebe5c5c4e01930ed97b16
-
Filesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
8KB
MD57ee14dff57fb6e6c644b318d16768f4c
SHA19a5d5b31ab56ab01e9b0bd76c51b8b4605a8ccce
SHA25653377d0710f551182edbab4150935425948535d11b92bf08a1c2dcf989723bd7
SHA5120565ff2bdbdf044c5f90bd45475d478b48cdbd5e19569976291b1bdd703e61355410c65f29f2c9213faf56251beb16d342c8625288dad6afc670717b9636d51f
-
Filesize
6KB
MD5ebc5bb904cdac1c67ada3fa733229966
SHA13c6abfa0ddef7f3289f38326077a5041389b15d2
SHA2563eba921ef649b71f98d9378dee8105b38d2464c9ccde37a694e4a0cd77d22a75
SHA512fa71afcc166093fbd076a84f10d055f5a686618711d053ab60d8bd060e78cb2fdc15fa35f363822c9913413251c718d01ddd6432ab128816d98f9aabf5612c9f