Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/05/2024, 00:40

General

  • Target

    3036dbb3c02dcc79cff5e487abfbc2a0_NeikiAnalytics.exe

  • Size

    104KB

  • MD5

    3036dbb3c02dcc79cff5e487abfbc2a0

  • SHA1

    553af2489252f1b6905946418cfcb3b08a1b5204

  • SHA256

    00bcf482903672bb7896468b50b34ddce26254a684e7be575bd11561c23ce8ea

  • SHA512

    7327756df68ae6a0785e23850c80b650aeb06f8094bef533ed4082aad29d238342d6fae9f34db73f7331e3aec58474e0906e91a62c6810dde22e1808a1934c28

  • SSDEEP

    1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hf/m:hfAIuZAIuYSMjoqtMHfhfu

Score
9/10

Malware Config

Signatures

  • Renames multiple (4714) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3036dbb3c02dcc79cff5e487abfbc2a0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\3036dbb3c02dcc79cff5e487abfbc2a0_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3906287020-2915474608-1755617787-1000\desktop.ini.tmp

    Filesize

    104KB

    MD5

    af781ff19664f47d3422e97f33c53a9e

    SHA1

    476630ef62481f82af91754e304293331f764c0f

    SHA256

    165ce3c4252897ef949a218e35d6754402583f32fd4869482bacab8e898f3f8c

    SHA512

    e2f75ccf061787443b7abfe80a8c6effb386e8e1d11bced3bb36430636aa2870f35ac3b384c8ea1b03a8bcbab40df58a01b90dedbccea3a2e16430f4310077a4

  • C:\Program Files\7-Zip\7-zip.dll.exe

    Filesize

    203KB

    MD5

    2fdc5d24ec9432a71767645616af877e

    SHA1

    a5f592c593fdb5ffcd15ccb5d786e5f21186884a

    SHA256

    315f923b5094bcecab39cd1bd04541719a6607db91677fc4bd78dfe6e7361649

    SHA512

    6eeef3e632c1ffcfe1a540c57b6c81f2de3517b974e89a3e412942009628cb97bfe44b8277faf928d88f3c24958ffbcd0a7c0e9504a834d2c61413b0df26ce9b

  • memory/716-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/716-872-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB