Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    15/05/2024, 14:31

General

  • Target

    d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe

  • Size

    141KB

  • MD5

    d6788ec7914b17e6dbca2ae73c4433d0

  • SHA1

    099677f3c1e21410c2bd799964de05b555905fbc

  • SHA256

    8082aae83e7f75c17faa10758920f9630e9d654ec2fbb7a41b53a2ed597980ba

  • SHA512

    a2945a52da4e891f9589d50956dd81d1527bae7382d568ba4b04fa4a7c2d7d1950637ba902ba3e1c1ed481650d4fc733e0b88d0b7d3545762b8af91a43a51fc3

  • SSDEEP

    768:/7BlpQpARFbh2UM/zX1vqX1v+1WbW1rjrA9ZONZOD5ZTXB85c5cfYfy:/7ZQpApUsKiX26C

Score
9/10

Malware Config

Signatures

  • Renames multiple (3434) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini.tmp

    Filesize

    141KB

    MD5

    6e580c6031a6a161f75d8ef0dd9848fa

    SHA1

    53d75b2c00c8061506404462174d6eea68a62b3c

    SHA256

    b401fc3f07aa2127d06bad993f30b2d8aeb85dadca84ce649cafb3414b23f9c8

    SHA512

    d18cb8ed97ff22e59b25f0e2a481ec4a5c608becc64c9e6c34f78f1da7cb03ffdf17b0adc2a23251aa42868a1b62958de5404b06d29102d5021a8a90dc7b02cd

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    150KB

    MD5

    463b7277b49402fa1b2e9a7e06b0cee1

    SHA1

    9e14c649e08fc28c4a8120ef5cf9f1e7ffef5084

    SHA256

    e942341472443efdfa79a8741adc6f8bfe460200e4364211e9f734faf4ba076a

    SHA512

    577d5bda9aac95360f57686553b2db5e4cb0dbfc2f2cb53b4545046f1d22bf52f50fd9feed9da977044d74c1487f83395d566854c3c09de00232d057c6331050

  • memory/2036-0-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2036-588-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB