Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/05/2024, 15:03

General

  • Target

    21d87a5c58d29772da4c13efeb85feb0_NeikiAnalytics.exe

  • Size

    217KB

  • MD5

    21d87a5c58d29772da4c13efeb85feb0

  • SHA1

    2825706d0ddfe3cbe1d906ae112f06bb4d7a4a8a

  • SHA256

    cc96e7196494378b36f4baf1c43f62198435c3bdb7eaf68a10f24a8efebd5b6c

  • SHA512

    a25a5c05cf519914c256a362f0b8204c78d30e7dcccd9818e01fe39afa947dc3849aa14a044e6f1be186274f17b9948664622a09d61da75f386cb25709cb6585

  • SSDEEP

    3072:+nymCAIuZAIuYSMjoqtMHfhf9fAIuZAIuYSMjoqtMHfhfCTx:JmCAIuZAIuDMVtM/LfAIuZAIuDMVtM/0

Score
9/10

Malware Config

Signatures

  • Renames multiple (4527) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\21d87a5c58d29772da4c13efeb85feb0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\21d87a5c58d29772da4c13efeb85feb0_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3906287020-2915474608-1755617787-1000\desktop.ini.tmp

    Filesize

    217KB

    MD5

    42bc04e5a79609694cffc5983d6c8ccf

    SHA1

    af6e10d02df8fe05f10a5df5e87dadcaeb3b4fbd

    SHA256

    3850865c694f50cc2a3abc700eff0e3406164efcc1957c38ee54f8b451460104

    SHA512

    cb26fb50554411ed9c722b2b4e9ec86dedaeb13b7d98dbe7941f46536d97ded65e71a94a2a49e4b07eb9ed5a2d43dceb64355147936e17340099937f421f2b88

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    316KB

    MD5

    838a542a0e1001200bc57764a1ad7cd2

    SHA1

    e75d62d5c2b0d0d2ce14bd790e37f3bd42e4f080

    SHA256

    0a44d9d9110d47ba84ef68ffc82798340ed8b9e37c76f9d35aca15c44ac777e7

    SHA512

    a930f743dfc1b21348959ba503b2552d258b5c6656c1633e1040cb62d17ac7a3e8ba4ac478c591f78aee913411e3c06d33b8058910f32ec377b2df9c05000cfb

  • memory/2956-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2956-1574-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB