Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

aa3e57a180...cs.exe

windows7-x64

7

aa3e57a180...cs.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    29/06/2024, 11:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    aa3e57a1802971f3422b3e50ec1809a5b27292a1b76f1aac64705a3b886017ad_NeikiAnalytics.exe

  • Size

    448KB

  • MD5

    34f394fde88fcc4d9262f7b17a3b5ff0

  • SHA1

    e9c51524bb82c8275e17404e00bc24bd4db8d095

  • SHA256

    aa3e57a1802971f3422b3e50ec1809a5b27292a1b76f1aac64705a3b886017ad

  • SHA512

    5cf67a9bb9d0be748e3d118c02e8c6c1f3cd6bcef97ba6b9503abbe52779432a48dd0cc1e97209f05852c8b8d1f28d83458f128d849bddb432a2ae5d69cb125c

  • SSDEEP

    6144:7XlPZ6ppqxjO/lSXxI7T6cPSrl53BDu0W7cyqCxSngmMBqfycuPbUl0i5cD5J6Kb:7Xl8l/N253p80npM4dl0v5Jdmo

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aa3e57a1802971f3422b3e50ec1809a5b27292a1b76f1aac64705a3b886017ad_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\aa3e57a1802971f3422b3e50ec1809a5b27292a1b76f1aac64705a3b886017ad_NeikiAnalytics.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1276
    • C:\Users\Admin\AppData\Local\Temp\aa3e57a1802971f3422b3e50ec1809a5b27292a1b76f1aac64705a3b886017ad_NeikiAnalytics.exe
      C:\Users\Admin\AppData\Local\Temp\aa3e57a1802971f3422b3e50ec1809a5b27292a1b76f1aac64705a3b886017ad_NeikiAnalytics.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of UnmapMainImage
      PID:1680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\aa3e57a1802971f3422b3e50ec1809a5b27292a1b76f1aac64705a3b886017ad_NeikiAnalytics.exe
    Filesize

    448KB

    MD5

    086b44d7a15bff69f78a0dd5f591bf99

    SHA1

    8897171da283889e553ea36db6a1cbb9f01fe080

    SHA256

    e9a0e9f8f74ecfe942ce91b315f5caed6cf61d24b1991363d428d1bcbf65d11f

    SHA512

    685d4cf7f43607c40305391df1cd6ff014a36fc0561db17ac76c9434c15c8e9108d940a79e9b21329e85d64fce9745e2de8429dd786426b793a2f69d775a3136

    Download Submit

  • memory/1276-0-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/1276-6-0x0000000000230000-0x000000000026C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/1276-10-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/1680-12-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

    Download

  • memory/1680-11-0x0000000000130000-0x000000000016C000-memory.dmp

    Filesize

    240KB

    Download