Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/05/2024, 15:56

General

  • Target

    eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe

  • Size

    81KB

  • MD5

    eed21ee6e2ac9b5c5e629b2031732750

  • SHA1

    d9220105de8050644b633736f3961fec09836470

  • SHA256

    96ffe67d45422a7ffd36be1b95608b7014d22afb4abdec76fe75c2b1b0b1fda4

  • SHA512

    f7f5c36903fded331e44613d2be8360071dc4e7f53c8eb1daac4895345e5e4d7649fecc5cfa3906e38203e0303525f3310610b0e8d8778189376ac6c5549ec18

  • SSDEEP

    1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/DfTfe:6e7WpMaxeb0CYJ97lEYNR73e+eKZDfTW

Score
9/10

Malware Config

Signatures

  • Renames multiple (4850) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:4688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3571316656-3665257725-2415531812-1000\desktop.ini.tmp

    Filesize

    82KB

    MD5

    8e580a151963102d5d4439be4c8f4d03

    SHA1

    2f146dda5a944d53ddfd4b395bfab43973517201

    SHA256

    22988f677e4c53cf43b6d5cee02db3778b4c4c2fd5ea45ca07b49c7330160187

    SHA512

    4b4a807fd3ee7f9711e16471ac2860f6e61823e1d1dc63ce0cd5c42a23ba4002cc8313ba2aef72cb9bf6c1b34ae0856d149ae5695aee8343adc65ce0d39bd6a6

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    181KB

    MD5

    a5b1fcb17a799c00fa0f4c262f9abd47

    SHA1

    4d79350accfc01a2ab71bc1c2279f68ce599cc40

    SHA256

    43a58808c8a8193177956c1fedfb9a6c7cd67bd80bbe86b415b27cefdb52ca73

    SHA512

    a07b8b97daabf95ee2898bdfa76927e1810665658e6928378c5d1649f22399b95711b8062e9cf785e72d5a1450161acd2fdd3e647717df80ea6874caab87629a