Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    13/05/2024, 18:10

General

  • Target

    c0ae69264b7a87a7838ee70d8fe87db0_NeikiAnalytics.exe

  • Size

    84KB

  • MD5

    c0ae69264b7a87a7838ee70d8fe87db0

  • SHA1

    245637f0d58b12925f63f5b08e4e431343931606

  • SHA256

    bf6ef76b0cfbd0cac65a506ae96192fbcd25db8620d09447231e81d594578053

  • SHA512

    56995666a43254720452166e269d336b851804e3c8be0481e3bfb8db780401851e54ca33c0a0cf9a79ec8d3e7693de8ed6f8538dc9e8af630798192c4a13ceca

  • SSDEEP

    1536:W7ZhA7pApH1d9oVLQthbqbY9oVLQthbq51Rn6wt7tJFFxr:6e7WpP9oVLQthbYY9oVLQthbUrt7tFxr

Score
9/10

Malware Config

Signatures

  • Renames multiple (3513) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c0ae69264b7a87a7838ee70d8fe87db0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\c0ae69264b7a87a7838ee70d8fe87db0_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:1920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2248906074-2862704502-246302768-1000\desktop.ini.tmp

    Filesize

    84KB

    MD5

    84f8b552d1d79e4b91da7585be0991fe

    SHA1

    9e67b068a35e2140140c326eed0cb849733ba9b0

    SHA256

    116b9df78a36e9db0a8c99c24a38e823ea7da86b43292a85dc7b1a5f5c144aea

    SHA512

    f1ca3680928c83639b66bba0abd7cce8da974ca390307369d80e50522457c38fd826da263d9fc8f19d3162b9bd59d83bab68b7343c46115523debd99224ae8c6

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    93KB

    MD5

    f330294b9ed39c3d3cce31fe98c65b44

    SHA1

    7271946b3c25888aec59004b6fdf28045406a793

    SHA256

    6782e9df4958f0a20bee3d7184961aa9142155692e5803fdbba1b8213f14d4f0

    SHA512

    a9c72f06805c43a57a3f093307f1470a830f96b1f0e4e1aa54e11b8499219e1317704a8a50162eb08f43027091143da2044acd0f14bbadd00edbce92afe7dbcf