Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 08:44
Behavioral task
behavioral1
Sample
b2332d053ad2a4ccb97cc57e54ebd7a0_NeikiAnalytics.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b2332d053ad2a4ccb97cc57e54ebd7a0_NeikiAnalytics.pdf
Resource
win10v2004-20240508-en
General
-
Target
b2332d053ad2a4ccb97cc57e54ebd7a0_NeikiAnalytics.pdf
-
Size
351KB
-
MD5
b2332d053ad2a4ccb97cc57e54ebd7a0
-
SHA1
10ce75c92a9dc593d82593422f6b023f3f9dfd19
-
SHA256
86375153d8576755e28f9f7f80948f5df04738ef2bf21e5e8e3fde05af09f04d
-
SHA512
39fb32412a1ccba186df3a36f4454205ddf704117ab01b8578f8c1b49d1ddf7b41f84a56aba81c7b59ee456934253164986a0e61ba9dda0f127d423038d372cc
-
SSDEEP
6144:p6Fc6B4cQgggggox19iKpBUgQhxlBGcFseNfx2aP8ygx7S66rP7t+s8MB6:p6FcxX7ghlsIfx2aPHgRSVt+NMI
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1312 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1312 AcroRd32.exe 1312 AcroRd32.exe 1312 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\b2332d053ad2a4ccb97cc57e54ebd7a0_NeikiAnalytics.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1312
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5f4ec1d32fac400bb3ccb3ad7f5c90edc
SHA18a7f12ca6d8a974a3dbc298c50b3c4368351e99a
SHA256669045492062c95d3e039febd4d653de54ec6c4171deb2db5e70290a307ec1bb
SHA512ce0d94ede9e6fad93fc81c06b43c28b5f9a58b2610adfa4027d4f803bef6d9a8ab06db0bb79e918a8733d8f7ceba1f4203ed5b46d692ecef25b089338006ead1