Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

13/05/2024, 10:09

240513-l7ag4ahf7s 9

13/05/2024, 10:05

240513-l4hpasae49 9

13/05/2024, 08:36

240513-khmkpaee61 9

Analysis

  • max time kernel
    149s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    13/05/2024, 08:36

General

  • Target

    aaac11137aa88a7acc11e5070e674900_NeikiAnalytics.exe

  • Size

    152KB

  • MD5

    aaac11137aa88a7acc11e5070e674900

  • SHA1

    a571fb84922b258933262d20e4b48095effc57e1

  • SHA256

    b52b2e8b5319905b765716c775033dca3cc0b191c3ac410d34de1fde8a07b005

  • SHA512

    97de855675c11b2595a88046becad33f8c695be3620641058e6c54ce16ac47de04b77dea058e83ce337bbafc4cf6099883e104ce1f8f0dead45099545989fb55

  • SSDEEP

    3072:KQSo1EZGtKgZGtK/PgtU1wAIuZAIuXwFwtd3:KQSo1EZGtKgZGtK/CAIuZAIuH

Score
9/10

Malware Config

Signatures

  • Renames multiple (3156) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aaac11137aa88a7acc11e5070e674900_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\aaac11137aa88a7acc11e5070e674900_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:1244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2248906074-2862704502-246302768-1000\desktop.ini.tmp

    Filesize

    152KB

    MD5

    d5a757f8b1cab237efece1c78382a691

    SHA1

    6fda14439e159437f8834f0be1f647b50a28a129

    SHA256

    6a11b446c7b0adcc2229307c223a063f277d800d8223f94d7dd2dc2f822a42e0

    SHA512

    15ddea8d984e649b8fd400caa2a41ee550d6599a28ebb97da7c2e0debcc1e9ded6eea3adca509d6a9f3b2fc079342cd4cdfd47d28f5d4a38a2055862151630b4

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    161KB

    MD5

    0009ecaaa5c24173219ee55402aaa5e6

    SHA1

    17505add4a3a156a6deb168d8162bc863c9b7c4d

    SHA256

    6298ca7fcd5817721320c05d6297a0d5fc3b191ace0c159271de6ef527677af6

    SHA512

    ba29ec391b8c2a5271279bd9b306dba5046c5cd975d52d13907c5d05b995fd71ab224d97a93d69817e10838a05a121f8878e8dd355fc3dd1538a40402cb52ee0

  • memory/1244-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/1244-74-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB