Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/05/2024, 00:16

General

  • Target

    2a41526fb96b610c2c17d86e21f70550_NeikiAnalytics.exe

  • Size

    114KB

  • MD5

    2a41526fb96b610c2c17d86e21f70550

  • SHA1

    bd22ed704848fbd774e8daa8794eb716d92777f4

  • SHA256

    e339b98e177687f76faf5774e44ba7dc0730974678663e128d56190f40032805

  • SHA512

    4667f076f12554e2a6c4fafcfe5297fd2f6388a6c0cd330ac8e2eafbc7f78b920420fefc3545e9e7985b4b565c90a71c19e08058b9dd8122249e5fddee380578

  • SSDEEP

    3072:6e7WpHIyRF9ESWu0SWuDmhSauvEKxVTLJtxoVz8FUDrYYaCusjdEKxVTLJtxoVze:RqlIyFESWu0SWuGSi

Score
9/10

Malware Config

Signatures

  • Renames multiple (4822) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2a41526fb96b610c2c17d86e21f70550_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\2a41526fb96b610c2c17d86e21f70550_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:4532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp

    Filesize

    114KB

    MD5

    264895371b904151a8d8ee59a9f33e53

    SHA1

    49b9037da2da594f5eaa1b2ee3e1c15b0d1b0132

    SHA256

    e25a9d75861f044a60be318d6f55550c3a7d41aa6025a22d8ce53e62c8db0156

    SHA512

    b63ff5af37ed33f8058c2e67ef198f40fa6b444184a98cb08ebd60d06ead29ef66537c5d9a255cb8f87aec80c9fccd6e3b92d7e2183b397bb6c2a2cdea30a347

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    213KB

    MD5

    6e527c03f535bc77379df642a9df6f93

    SHA1

    eec62ff6d1af225d814172a80f25493d8b4fbfc5

    SHA256

    a9c13fe1384ab774fa72c1027b7c333e07239eeacb9db0c79cc919fcf9d3dd1a

    SHA512

    c7f83a3b5d67a4f0135e97bf97249f19660f89ab647df2310edf90211a9e0e77c57d0a11f92993433aa842e0063f08e20be323c66ba9410cd755c9362f3e99a5