Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    19/05/2024, 22:19

General

  • Target

    49f8da82b4ffd62131e04f27bfd503f0_NeikiAnalytics.exe

  • Size

    113KB

  • MD5

    49f8da82b4ffd62131e04f27bfd503f0

  • SHA1

    b55802e6f1123440eae10ffabfce6e8f8001a6b5

  • SHA256

    2f629d061cd8244c024dd0921fe701e6e9c27a9303b4cc8ac5efb080ed833224

  • SHA512

    0fe80c0e5e56975bf02837148e4f13b72f775871aa04cd1a17075840557669d6afb1e4b1f58a64b2cda473547a4dc2f95e15e031326e2e6b97dda6466aa5b99b

  • SSDEEP

    1536:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsNTWn1++PJHJXA/OsIZfzc3/Q8asZ:+nyiQSohsUspQSohsUsl

Score
9/10

Malware Config

Signatures

  • Renames multiple (3436) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\49f8da82b4ffd62131e04f27bfd503f0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\49f8da82b4ffd62131e04f27bfd503f0_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3452737119-3959686427-228443150-1000\desktop.ini.tmp

    Filesize

    113KB

    MD5

    175b2570ad90fcf5755075a2807751b8

    SHA1

    d7c0e830047601501492c0a3f2a772a8ddd9f8d7

    SHA256

    9f8fe261b1286fa25585d9da409921ee23d636764a094e4040c67f8a1d3ff8ca

    SHA512

    d45ffb4e7aedd145f0dcd0ff2bea6d7f115bbccf5a379b5ee4449418fd55b400c9543a94cccb2d3d0c2f1aef0d26526eca002715ae88db1be7d9417faa22a380

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    122KB

    MD5

    63e6478a73dccbdf2e10f47a960374e4

    SHA1

    fc204190ae9a1f58677eb40d330cb5ea6acda9b7

    SHA256

    3c473373c6fca54f81b88fcbf9fe6d246bbd61dde772b205c7edd7350ba16388

    SHA512

    cf7b27be033898a7a274f84ad786085afa67557292a3d10418ac6fd38539adbfa427328b05473a0360cff91dad6af420f741094790716bdaaee31092916c7f13

  • memory/2792-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2792-648-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB