Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    07/05/2024, 21:19

General

  • Target

    389b84669c243f3f824fbb9950c7cb40_NEIKI.exe

  • Size

    76KB

  • MD5

    389b84669c243f3f824fbb9950c7cb40

  • SHA1

    10a17a90663c89221d46090c4cf68fb6c13a95dc

  • SHA256

    a4b1e67a65e50eebe55d8c262e442882639861aeb56bd7044223dec5ebf7829b

  • SHA512

    46ec5b2b89a972f27d9d9f5c97c591357530201c1f983afd458cace3661355d966a0c28920940026deb8dc95aa3cf757fd9fa194117f1408b1d7e30a54179e7f

  • SSDEEP

    768:W7Blp9pARFbhQSox/6Sox/ME4JAIAepE4JAIAeuDlmlQPc3f6Pc3f5TGotuMOiJd:W7Z9pApQESOHepOHe8G+6E65TGAR9v1r

Score
9/10

Malware Config

Signatures

  • Renames multiple (3447) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\389b84669c243f3f824fbb9950c7cb40_NEIKI.exe
    "C:\Users\Admin\AppData\Local\Temp\389b84669c243f3f824fbb9950c7cb40_NEIKI.exe"
    1⤵
    • Drops file in Program Files directory
    PID:1132

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini.tmp

    Filesize

    76KB

    MD5

    5da8806e66d27817c43746cbdb5da60c

    SHA1

    1078ca1339f5c011405dc87ea7f0314fbc32c8ba

    SHA256

    e3a95a9461231a2612aad59ad7ee28b549e9eeb3d2b59bc6ec89eb997d9261bc

    SHA512

    cb61688d7bfc48a282ef1c8d1511878db882b2c8454820d8dfb89f7b0071777b01042f744c3fcc0a7430fac579a5765135de4abf5d11f940ef7e6b3641774673

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    85KB

    MD5

    73e6775b409557ad39394a5697d2e44f

    SHA1

    9747a9bb5b8d04f821d0aaf4fee996d4afa2cf34

    SHA256

    d75395dc7368513578762aeab9386f7f141ab5c7d8cd443f60ecd8fcaebdf62f

    SHA512

    7451b0a7733996b235270b782eb492e38580b1bab39caaf694afaa07e85f16b8a3e00db7fdef62cdacd467991dd47ad8ff0a4cd6ddfd14bfd0408d20ef5a6efd