Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    27/05/2024, 05:47

General

  • Target

    212e84bd7ce6f9d4418bc6d1cc98aa30_NeikiAnalytics.exe

  • Size

    52KB

  • MD5

    212e84bd7ce6f9d4418bc6d1cc98aa30

  • SHA1

    f50142d9bed4cfacf275cac8412802cc806f2e1c

  • SHA256

    d9213386a39881dbb0ea1948759025288361bbd94a54904a5d44d16583265331

  • SHA512

    d1e70dae33305506f76a2cfdc4c0971422e8e13e42d0f8572195a4bfe237a3b652087ef19aa42dd228597ee70d3ab99dcf56674870eb83a49bdb9f7e6034ab2f

  • SSDEEP

    768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFFw:CTWn1++PJHJXA/OsIZfzc3/Q8yiM

Score
9/10

Malware Config

Signatures

  • Renames multiple (3552) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\212e84bd7ce6f9d4418bc6d1cc98aa30_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\212e84bd7ce6f9d4418bc6d1cc98aa30_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:1752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini.tmp

    Filesize

    52KB

    MD5

    f7a4b513252632b11e10c1dddfebf370

    SHA1

    a07bea628c9d3b5480fce917fe6e71e7ac98b4fb

    SHA256

    d2b7a50c52da9c8ace84dde80ed0663aef3186a8f7bcf7ebddc262e4bb77fe59

    SHA512

    5877d8f1322d70647ab5af73c8dab0e1b5147b2c11ea780d32ae3f6acd1d546e36b17d64742b5edf894b3ce3a00ed11e8d94e6f427dd45618f7206d93ef80d60

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    61KB

    MD5

    6c81d612aee02c30d4413484035284b1

    SHA1

    3a865acc2655365429717c1393d99179d1b1778c

    SHA256

    06b8c0ba5886d7d6864e2c9617fafc3bd30d344caba826d667ac805d879cfb6a

    SHA512

    2f037a16588169d129b336092e50a04bff52bed049e871325a21289e5804c8b864f505e7bf97914f52d55535ebba3568dc5acb082170c26dba3e97e9729512b4

  • memory/1752-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/1752-76-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB