Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23/05/2024, 19:49
Behavioral task
behavioral1
Sample
ed36736490094178a2c105786abaa900_NeikiAnalytics.pdf
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
ed36736490094178a2c105786abaa900_NeikiAnalytics.pdf
Resource
win10v2004-20240508-en
General
-
Target
ed36736490094178a2c105786abaa900_NeikiAnalytics.pdf
-
Size
82KB
-
MD5
ed36736490094178a2c105786abaa900
-
SHA1
4a8b61797c7ac719eb6f0cdd4a85d4f8a786eba5
-
SHA256
c5d6ce86201ffe023414ae139ab6d722c423126180080a2dc9d2e3dda1c884b3
-
SHA512
7123c619d6d7149b5bbefae4ea6a8c2a955bd460db1e94d382debafbd02dbe52f0ec42f680bc304ee55aa8d7676fb91db2a68c04a8b1c7e449ad09237080baa6
-
SSDEEP
1536:WPgvuWOQzvzknfc2NSpV45LpsmU+fFfOZL+xxVNVZotkEVMVCZiaV:Ww/TYFNSpV4Bpsn+fFfwL4xVNIktCZT
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2408 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2408 AcroRd32.exe 2408 AcroRd32.exe 2408 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ed36736490094178a2c105786abaa900_NeikiAnalytics.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2408
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD55cb1fc52dc6cfacdaeb6fc499fc94e8f
SHA12650b8334f6025d542b84322002f452fdd8a8ee9
SHA25619376e0b41be98c7768b2366d23cfb8fec6bd2d5c494f54f3e358bef3e4df09f
SHA512eaf478f2443a5a1f2bde9b30dd70403169b820cd7392546d2b89af3650a4f003f97d3f81f3bf059dbff6f186b7f5b5b3cbc219c2fb8306fd105395786e88ece6