Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    14/05/2024, 03:20

General

  • Target

    66e5cf0b8d1620dbabbb5ac95585e870_NeikiAnalytics.exe

  • Size

    81KB

  • MD5

    66e5cf0b8d1620dbabbb5ac95585e870

  • SHA1

    f6d7bc1231a6c029fd445bd09c63633c52bdb2e9

  • SHA256

    8d66d8a5f29f0854be95ed4a75865a5b19d82eed5023450d4538da29d284d8e7

  • SHA512

    5b88f063835d04821dfdee57bf97855deef1f0c52935084361cac3603de301ca8ecd4f7ce67a8f5e00fd7887ac76b0d3972fe2e69e8f08511ee6bf04ab49ef70

  • SSDEEP

    1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7YWtMQQQH:6e7WpMaxeb0CYJ97lEYNR7ZtL

Score
9/10

Malware Config

Signatures

  • Renames multiple (3492) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\66e5cf0b8d1620dbabbb5ac95585e870_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\66e5cf0b8d1620dbabbb5ac95585e870_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3452737119-3959686427-228443150-1000\desktop.ini.tmp

    Filesize

    81KB

    MD5

    bb9e0d7f58b127ee87be322ab1cd0fdf

    SHA1

    e15316c6215ce3d808bb802651b8ad6803c16944

    SHA256

    220694a43451c6da8852ae750052e04c5e7cf6b17c59ec2d92b018c34e2b0818

    SHA512

    0439c2db29a3348d17e200f677410b231d12b22b8175ef5b259b88a7d576af1159e24667506ed7ecdd11f6e4525f24d99059d76ad00cafd35815d39a2f60bb0f

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    90KB

    MD5

    96ba995d71ef96d26189c927bf5af3f3

    SHA1

    f5003c91df37a93cae46a2e017b2655cb842de32

    SHA256

    330c251c9e907ca455ed79cc471db5cfebcac4fcdf5c3a85636ff3d995915389

    SHA512

    2fd41934f331bbf024432b6beb7fe7ac96ed14a2b07fac2ef9bc644f2dfff6f9f34a5b8541c805571723b6839621743aa9879d42ba147a41e2018e6d2f7967e8