Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/05/2024, 03:20

General

  • Target

    66e5cf0b8d1620dbabbb5ac95585e870_NeikiAnalytics.exe

  • Size

    81KB

  • MD5

    66e5cf0b8d1620dbabbb5ac95585e870

  • SHA1

    f6d7bc1231a6c029fd445bd09c63633c52bdb2e9

  • SHA256

    8d66d8a5f29f0854be95ed4a75865a5b19d82eed5023450d4538da29d284d8e7

  • SHA512

    5b88f063835d04821dfdee57bf97855deef1f0c52935084361cac3603de301ca8ecd4f7ce67a8f5e00fd7887ac76b0d3972fe2e69e8f08511ee6bf04ab49ef70

  • SSDEEP

    1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7YWtMQQQH:6e7WpMaxeb0CYJ97lEYNR7ZtL

Score
9/10

Malware Config

Signatures

  • Renames multiple (5197) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\66e5cf0b8d1620dbabbb5ac95585e870_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\66e5cf0b8d1620dbabbb5ac95585e870_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:3596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp

    Filesize

    81KB

    MD5

    d0489d0638726e1ce56b8e76e7635b47

    SHA1

    daba243e716f433a7ff330cfa43f30b5addfb4c6

    SHA256

    b19ccce942d826f8ebdb66df3740fe97daff90ceaf2bfc0eb14f8f17dbc265b9

    SHA512

    ca1b33492f0780e5a4987795b22cc9d872c42a5157ae38f12abfa09c4df0bb1dfa61d41faf185b4890f87de487e2fe4a7979b825bc6179a1a5c6794d86700cad

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    180KB

    MD5

    4997e626c2a8231b7a4b8fc4ad0e6e87

    SHA1

    df95a3df494d547649caedf5e096dcd08fa7edef

    SHA256

    55267dbfcf0b18509cc0dff60e3ac64210c6e46b7b81de4dfa5c026748f07419

    SHA512

    abe9a0a4caf29a76d5f1d691885f1edb01f8c5b329ead34f4de1f747c6371b9dfe5dc29c11c0bfb88ab130a112c1fc2bffe2fafc12827ef182e46386269e17f1