Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    99s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/05/2024, 04:27

General

  • Target

    6a3ac7fc4a4fce8db1871e3b9ea23ae0_NeikiAnalytics.exe

  • Size

    70KB

  • MD5

    6a3ac7fc4a4fce8db1871e3b9ea23ae0

  • SHA1

    9b614f2ecaf5db03e82a0688742df16cd80c1c26

  • SHA256

    33808fbb0f03ef1ddbde4fbc63e6661e54ce88ba5989e31f408aedb2f1cad98e

  • SHA512

    9d53c7375b8295d8bd6a909decc0915f6d9461d0e47ae640763f1de980d394bed8ff7c0deba46f6991112b16895af2395b0c42165e9d679cc9c378df7516641c

  • SSDEEP

    768:W7BlpDpARFbhYQkQjjI6OvSox/6Sox/hotyuftxtjYJIJDYJIJX66Fl3Cv:W7ZDpApYbWjIlE77ufL2e+e16al3Cv

Score
9/10

Malware Config

Signatures

  • Renames multiple (5197) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6a3ac7fc4a4fce8db1871e3b9ea23ae0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\6a3ac7fc4a4fce8db1871e3b9ea23ae0_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:4276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp

    Filesize

    70KB

    MD5

    8b04330324c48da313b5dfacdabbf433

    SHA1

    d2e69b9d2c92795faed316371a07fd0df7b36701

    SHA256

    9a9205526029aa39688a21d23b4a9e7cf7e339252697593e2bd39d58bfcdd1a9

    SHA512

    957d6a0618e81894e90ed04b70d89570645c13d65e91ea4d5c90ed94a94ff25cfd94130734ee5e74f62ad0c96749b946cbf28163f10b9ef30f731a0d639e1cc1

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    169KB

    MD5

    df41475ef8a249591351c0b0b7d15832

    SHA1

    fbba09f6171283cd3a93ce39446255ec80d03253

    SHA256

    5cf973236088ee6c530110dd10c10b3f4f22e552be72fc0cc8e3aab5dbc3008e

    SHA512

    b24898307616b91567ec209689d7d9cb9d11884ed4a2bd926ef2ca439a2714ba32d2133ebb6bf0bcc438c9b12fc046fdb80e09f03101ecb6fa78ef731a8cbf40