Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/05/2024, 11:29

General

  • Target

    d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe

  • Size

    84KB

  • MD5

    d21a93ea107b8396c94d5d00e8136800

  • SHA1

    ca7a2bbd39d0af9d8c4175a11cd6af9517cd7cd4

  • SHA256

    749b2326c1e8f24b704daf4df3f7ea7c6b49f61e8a3bd81c161a77d19a00fb67

  • SHA512

    14179a20822dfd6ce6c9966da74bcbaa9b70886abb8e0b27142b3217c28248cc73a804411a7bd39f64fe1195a1427ab88bbb07fe39aec819eb11ff54619d9953

  • SSDEEP

    1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKPq0:6rWpcOPxPke+e3fFpsJOfFpsJbgET

Score
9/10

Malware Config

Signatures

  • Renames multiple (5107) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:5288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3906287020-2915474608-1755617787-1000\desktop.ini.tmp

    Filesize

    84KB

    MD5

    b8e63269d613b292db5eb99c55e254de

    SHA1

    bb0f12dca8795acf01b4b2ffba045f1fe8a85b80

    SHA256

    ecf082d137eeaea18a49f629f6783bc597f119900b31136449fc97dea83b5a88

    SHA512

    e1cbf8659deb1cae9c6938bc36859be61934503515954abf4d8130af43214f575e375e7acb068e8b747352741451dbc872608d5b4106638f3118226f990d0340

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    183KB

    MD5

    078bf4600c74f74f2e248992c9065cf4

    SHA1

    b11f0c63f47ff528d83c9228ba51ec775df36350

    SHA256

    0ae0fc61e04dbb6796834a301e93037f7cf0e2b653ebf02e28841e1fcb6c5278

    SHA512

    a1adea2552e836752fcc290fa54da669dee1f247a3d3e63f0b0f39cb803e98557e2f6c9208270434da54b334033c3b3275949e2f6a4c6f91633f61bba4d00f69