Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    09/05/2024, 19:24

General

  • Target

    d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe

  • Size

    126KB

  • MD5

    d688c4a527821dffbc140e1f5a9f2ce0

  • SHA1

    77ece95dba11e26d5ad80e2d85efde275e338b23

  • SHA256

    0c8058b86863aa411f1a6216e1438869ffb83d3d8a4b22d09b58fb6d0466a489

  • SHA512

    654d7b795a50e28d191bef7c3b94e85489be4c8c123bff89fa281518d886b2d421abb3ebb1fa720e4324ac8921695d8b86ecd9ee480c807962b8f65839392061

  • SSDEEP

    1536:W7ZQpApjIWe+eoO6O2lpiMZiMLJvlwJvl9:6QWpBe+eoO6OaiMZiMLJdwJd9

Score
9/10

Malware Config

Signatures

  • Renames multiple (3432) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:1680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2248906074-2862704502-246302768-1000\desktop.ini.tmp

    Filesize

    126KB

    MD5

    0ea8ab967dd1a56cd2c08a3e26b23c91

    SHA1

    cfabfe366fb09f275ee88e56d492ca5b328a8d8b

    SHA256

    f47ebfba2ef25e49defb2354ce960d619d41a4234049ce0a0b838d9e222524bd

    SHA512

    3c614901840aaf80137f5c4fcfdac6f30e82b9f41b159269dc9ad83158758f419ed14e89f7fab03839b9f82c92a218f787547596b09041bba4ff27d6bfb784f6

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    135KB

    MD5

    5a7892295d5336036976fc181ad67f70

    SHA1

    3ad152d76ac73f0e68c9d36a69dbf66c8afadfe5

    SHA256

    e28b7aef337c8d4a478c58a490170b22768196649db401c9dfbe098c13e41c4b

    SHA512

    2878ad570afa7d8e6c22a20f9e107e71b64dc190378a3b2fa07b684c38341496ea39dce187a05fc56ef5657a0ca4dd608e80ce125eb7efc612e59d5b9d502603