Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    a7bef4732debeac586785dab42b9dd70_NEIKI

  • Size

    1.2MB

  • Sample

    240508-phvnhsef54

  • MD5

    a7bef4732debeac586785dab42b9dd70

  • SHA1

    68241697800ba9585386bc22544a2493e988dc71

  • SHA256

    88ef926661943a513da9db1b87a846ac5abb684bb4cd1627ca73be21ba5c7c86

  • SHA512

    fa822cac54a4a1240db575917689b6dbf8cf51129a072e916eccc38859be422ef8b3d8855fe4f976ec6d0abdb01ba8cfb02446114218a86f33a79b436ba6891a

  • SSDEEP

    12288:BgwuX+Zw9S0/Z3SfJKW96B/m4OvdiPGaPueEjzVqj83cBBS1UihZk5TzHO81HkwE:Ouq4ugJKpWdicLsBBS1UiuTr1HT4B

Malware Config

Targets

    • Target

      a7bef4732debeac586785dab42b9dd70_NEIKI

    • Size

      1.2MB

    • MD5

      a7bef4732debeac586785dab42b9dd70

    • SHA1

      68241697800ba9585386bc22544a2493e988dc71

    • SHA256

      88ef926661943a513da9db1b87a846ac5abb684bb4cd1627ca73be21ba5c7c86

    • SHA512

      fa822cac54a4a1240db575917689b6dbf8cf51129a072e916eccc38859be422ef8b3d8855fe4f976ec6d0abdb01ba8cfb02446114218a86f33a79b436ba6891a

    • SSDEEP

      12288:BgwuX+Zw9S0/Z3SfJKW96B/m4OvdiPGaPueEjzVqj83cBBS1UihZk5TzHO81HkwE:Ouq4ugJKpWdicLsBBS1UiuTr1HT4B

    • Renames multiple (219) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks