Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    08/05/2024, 22:34

General

  • Target

    7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe

  • Size

    80KB

  • MD5

    7e4aff1c2e53b193ca76559f66e41940

  • SHA1

    98ee9565c4e7eab17c49b8709f598a9e61f19853

  • SHA256

    644f98aea11238ff95a1a1bd0d3dffca4345fa00a586d112dd36b0a78404d57c

  • SHA512

    6cd7e8fe694d24032d29f2f959dec732df4b004bfede092ad2569a55b67a03896f562d8a6f114d9c5c9e6acbe52c9571ee84109e960f1b6446ef84373a5e2021

  • SSDEEP

    384:GBt7Br5xjL8AgA71FbhvUf2OkxN2Okxj/zFd1vqFd1vlbLbK:W7BlpQpARFbh2UM/zX1vqX1vw

Score
9/10

Malware Config

Signatures

  • Renames multiple (3572) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
    "C:\Users\Admin\AppData\Local\Temp\7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe"
    1⤵
    • Drops file in Program Files directory
    PID:3016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-268080393-3149932598-1824759070-1000\desktop.ini.tmp

    Filesize

    81KB

    MD5

    8d34b56468328ed17776dc29f83b0ea4

    SHA1

    3b5a76192cf9e538275239e0c3f10013e6febf72

    SHA256

    5f6e87a3032af05cb274143951dba9215e15e413f59898025c50d83388d58c45

    SHA512

    70e681abe1799b480386dd493959f12e697aec69257cf0265f1d5753b0016f81b9f5917523c9a40455d403190bbdb9032eb63294230b892c5ee37ddd8895d92a

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    90KB

    MD5

    2c5406fb58664ddb4779971e5f11bb9e

    SHA1

    e28793da39e90f6d129a9cee374d242f93ddaf27

    SHA256

    36b4b9e0f444ae4c67f212c1ef8a93eff3a367494e835f65a17cf6c6a1133605

    SHA512

    61f5d57d65a864cb782d37fcdeaae96b7749a0f03dd55164145ba61f900ffd2196583b48e27251510e59d610364845a844cbea97f8455f5aeeb4e207ee61e81d