Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    15/05/2024, 14:42

General

  • Target

    d6e0e2ba4b1a69feba576c3d55a5deb0_NeikiAnalytics.exe

  • Size

    149KB

  • MD5

    d6e0e2ba4b1a69feba576c3d55a5deb0

  • SHA1

    5a4414fc7ac0feebf3c42aa6086b67d0b436f834

  • SHA256

    1bb37480d5d0ee89c74a4c6993bb5b6826a510635e8bfb235c672af567aed0a1

  • SHA512

    f3165f6a39b827ff55242a676f8346f35087d628cb436e58092e51b85a2dd2e7c8ef49ea4ca1757e7cd9b9a78c01bd3557ece5687bd08b19c5752868c9f79cf5

  • SSDEEP

    1536:67Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCD:+nymCAIuZAIuYSMjoqtMHfhfqnx

Score
9/10

Malware Config

Signatures

  • Renames multiple (3428) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d6e0e2ba4b1a69feba576c3d55a5deb0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\d6e0e2ba4b1a69feba576c3d55a5deb0_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:1660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3452737119-3959686427-228443150-1000\desktop.ini.tmp

    Filesize

    149KB

    MD5

    899cb785824cc89f7a20d8b6b5ffa1fa

    SHA1

    46e324a1d33150216f1b27a12af0269a0fcbf3b0

    SHA256

    75dfaa7c253b1a87fcef8da508e9410de34808cdd9f3ab8fd1f4473524ab8e89

    SHA512

    3b4fa76a3baf7161500f801f267b09cca89ad7905dc3024118ac7ec54f6edea83d04720b44704c21dda9df435cb145e86400f863d6f64128545bf65756391cae

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    158KB

    MD5

    a3db3e8827745f62e2216088d58a5075

    SHA1

    d05709a78f3fd5b08d8bb2f3dc5cf8e7dbb7488b

    SHA256

    e1cf732e737a572ccca4fd0398257fb79a6636f13a0992e842247c338b9c5654

    SHA512

    da36eaa23e4ccede14226c7b4bc4bdb0c4952216097549c63c29793ac698e2ea240687accc1357c314e04528b73c3bf44ce9b9e7f59d6368bcb7ec4b168d9674

  • memory/1660-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1660-552-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB