Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    14/05/2024, 23:18

General

  • Target

    4135c94ae6c1ae93b08b61c65a9b1c40_NeikiAnalytics.exe

  • Size

    131KB

  • MD5

    4135c94ae6c1ae93b08b61c65a9b1c40

  • SHA1

    8ff243c7a4a27667b33d49a7e1d032584be2ccc4

  • SHA256

    aaf58b8f0c6eaafa340eff9a8cb67ea35bf4034f9382f5f391c120d8c2e1349c

  • SHA512

    08c1026492751a492b28fdb2f24b50c2e2621ae2fcc48c257ab93e9692a9efe7101c44eacb8a52c043f832be3281d8658295f0f4c9a7691102aa05cb806a2482

  • SSDEEP

    1536:67Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCz:+nymCAIuZAIuYSMjoqtMHfhf5Sb

Score
9/10

Malware Config

Signatures

  • Renames multiple (3452) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4135c94ae6c1ae93b08b61c65a9b1c40_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\4135c94ae6c1ae93b08b61c65a9b1c40_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini.tmp

    Filesize

    131KB

    MD5

    c2ae201fdee1fe6ee4aaa8d2ee59b9cc

    SHA1

    9fa8b30e31e0dc0c84460718c5189f0d5d9449b2

    SHA256

    cb2efe55dd9b2b37cf57e205e4cbe0321650724d8f733e5743fb960b09f9c6dc

    SHA512

    768c7c97e7668a99563cd9f1b43483bf99d4d364bfeb7bae342d1a09179d943b02aebe783b09b6f83e9e1932a51c841d5af06c66ac61c8d11db5c0f5fcbb6129

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    140KB

    MD5

    b8ea15a819ebf0dc69ab41c2eaa81551

    SHA1

    83bb1f70b3e8b80e26c5ea0ac8c34040db68ea1b

    SHA256

    ed058a9bd0674da1b6a0da75efc17efff7e16d8e3071bb0d67675fae843542cd

    SHA512

    8f94cdca2836c1ad92b64fecc7859e14e2925dd25f736740d0381c8ea854309053ad0fc5cafe623d32b2a24ae3ef624e491a378d43ef8ef7c0e7e9cba0fd4a96

  • memory/2288-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2288-528-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB