Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
08/05/2024, 19:53
Static task
static1
Behavioral task
behavioral1
Sample
2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
Resource
win10v2004-20240508-en
General
-
Target
2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
-
Size
71KB
-
MD5
2d5cd13a1fc63739d3dc96005a7d2440
-
SHA1
9859c274ffc5d1182222b700cba8148834b1806a
-
SHA256
8d3f610407c9f59e19283748bf129ffc0d41ea8bbce4341682f267c334f866e1
-
SHA512
45568834f01eca1949adf86519cb1e3b0ba62f522abfbd66410990109be32f2d3c0fdb27fc36593321ddf53ba063acfaba719334c53b313f2e239307d9f6c4eb
-
SSDEEP
768:W7BlphA7pARFbhVSpFCpFi/1KxAzMlcH3GEHUAn3EM2utGHtGiZh:W7ZhA7pApVyCi/1iAzFH37HJ0XuYvZh
Malware Config
Signatures
-
Renames multiple (5174) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\msvcp140.dll.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-locale-l1-1-0.dll.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcDemoR_BypassTrial365-ppd.xrm-ms.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_F_COL.HXK.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN022.XML.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Primitives.dll.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Debug.dll.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.HttpListener.dll.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ul-oob.xrm-ms.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_K_COL.HXK.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXT.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.BackEnd.dll.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-80.png.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsBase.resources.dll.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterBold.ttf.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\Java\jdk-1.8\lib\orb.idl.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Office Theme.thmx.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-oob.xrm-ms.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ppd.xrm-ms.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\7-Zip\Lang\vi.txt.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationTypes.dll.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\Internet Explorer\IEShims.dll.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\sRGB.pf.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-phn.xrm-ms.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-stdio-l1-1-0.dll.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Resources.Extensions.dll.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationProvider.resources.dll.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\7-Zip\Lang\ka.txt.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-synch-l1-1-0.dll.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-heap-l1-1-0.dll.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ul-oob.xrm-ms.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-oob.xrm-ms.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOADFPS.DLL.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL093.XML.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ul-oob.xrm-ms.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-pl.xrm-ms.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\PROCDB.XLAM.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Registry.dll.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\Java\jre-1.8\lib\security\public_suffix_list.dat.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Author2XML.XSL.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.IsolatedStorage.dll.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Controls.Ribbon.dll.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-pl.xrm-ms.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ul-oob.xrm-ms.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\Common Files\Services\verisign.bmp.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-private-l1-1-0.dll.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-ppd.xrm-ms.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7FR.dub.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.Linq.dll.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsFormsIntegration.resources.dll.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ppd.xrm-ms.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProDemoR_BypassTrial180-ul-oob.xrm-ms.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 8.0.2 (x64).swidtag.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ppd.xrm-ms.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ppd.xrm-ms.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-oob.xrm-ms.tmp 2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5ad59172abe4502b5cbf2eee43016126e
SHA167f225440bf0b17a8b5b5734cf273dbc67d3d51f
SHA256da29ee452197ca9f1da67797139dfd03c16452ed9a947bd0dd22e3a87a4a5400
SHA512af4cb3f56c2ebee0ba2c6febd851f8f42faedd41cb007202b754856030373e63c961dff7810cac000316ca69a4c0fbd94d45f0bc2f4349cce5381b8462f29b76
-
Filesize
170KB
MD57304139aa7e641c3a71ebb3de54ca8be
SHA1c82ad8ecef8ce03c41426828f88bcaf2ff960a70
SHA25660eee58805508c66bf4fb5be1505c4873becfee4ecb72a9525e58a32304b484c
SHA5122167dec6dde052bbc15088fda6ba54a953c215c4c0ebf6c4e1781635059864ff704e3d35f2d8a3acdb4fb9b5cf1511bde35ab01998d61c634a303f605f39d83d