Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 17:04
Behavioral task
behavioral1
Sample
2a361f9ce464eba7ba7e60aa7097aec0_NeikiAnalytics.pdf
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2a361f9ce464eba7ba7e60aa7097aec0_NeikiAnalytics.pdf
Resource
win10v2004-20240508-en
General
-
Target
2a361f9ce464eba7ba7e60aa7097aec0_NeikiAnalytics.pdf
-
Size
417KB
-
MD5
2a361f9ce464eba7ba7e60aa7097aec0
-
SHA1
c9654aadb83bfcb67de2d435188137215f0838dd
-
SHA256
6e78d908531d2e86311ee49a734e35f42e9a17edbb586b27df824d5ea2c5552e
-
SHA512
219b0b8fb0d68a43ebafb396243828c5b8badd7f71e95c516d8728b29fae24e6d8d79c532ed862d52cd384b4bfb24030b77b67c39401fa6a46ff22e73964abb4
-
SSDEEP
6144:JF7h0l6uQwzCQR8DGKRb02FYJmG4U62yF1FAWgBsN1tVymmUPJm1HEi6Q:JFl0YizCQaC4xIh4kykWgCX5mUPCHOQ
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3048 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3048 AcroRd32.exe 3048 AcroRd32.exe 3048 AcroRd32.exe 3048 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2a361f9ce464eba7ba7e60aa7097aec0_NeikiAnalytics.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3048
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5cf0280b65dc515f9fbfc28bb2eec35bb
SHA1d92d2a357319a36a04cab5566bad3542b7c5d48e
SHA25629ef31b6e2271665fcc8228d7991cf3fdf65dc1034f8a7ecb3c056cef847c8b7
SHA512904008cc275dada45eb3838e98e2f694394b447c8da61579559f9d791828477be1c2cc47994c23e907a1f16a4ce81931f3734fa831caf87b3057e2ab0057e1bf