Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    10/05/2024, 12:22

General

  • Target

    defacf11530734af4ada2da80b72cf00_NeikiAnalytics.exe

  • Size

    268KB

  • MD5

    defacf11530734af4ada2da80b72cf00

  • SHA1

    77640974728e7500c6c4f4fab8481f38aa7cbb40

  • SHA256

    35c2e84c91a6974d835a3dbfa39a5877b0e5773e6e0893e40e0ec186a039cf9e

  • SHA512

    fe190fbf491b5dbe1ec9d8a55eb116f0a19bdbd5a3dab44dd82579b40575e7dc0aefc939d40a86603fab72735056b33345cc6184e6f19a2c7e3cafa39437da84

  • SSDEEP

    6144:RqlIyFESWu0SWuGS4nNcbLnKjz47fiD+NZXoxSFM:tyKn+bLKjTDgZXon

Score
9/10

Malware Config

Signatures

  • Renames multiple (2842) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\defacf11530734af4ada2da80b72cf00_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\defacf11530734af4ada2da80b72cf00_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:1728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini.tmp

    Filesize

    269KB

    MD5

    02be07bf3d62b49e360c6deef24a0a72

    SHA1

    ecf069459a29fd742b11ef4a236b373a8bbdb511

    SHA256

    707f7620293e9c832cd41c357b8934fb242e8576fc121f6554871e7e553acb02

    SHA512

    44794badaf987e99940411cf10a56b747882dd4ee2bcd9c1385b4add565efa7af7feef661efd99cee8b30f7e0afb47f69f65c49e832eba92ca886c2b234ce4f9

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    278KB

    MD5

    8614ef2e96dbe8d142ced0861a8805e7

    SHA1

    619e94763a198f78c394397931a4525590b70817

    SHA256

    845ff011e8f3117e1eb4d4cd150f0b72e329422a8da1ba9fc57d42ff3dc9737f

    SHA512

    86b04f2576ce6e24686a26ecc30d10b75d0b3a94dc75a4c55132d18c1f556d14bc3f49ee201168ff6e2fd16a6cda1fe82856c9b30c4a2d162c972d97be5b4bba