Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    29/05/2024, 23:53

General

  • Target

    5b528e46ec751a4212cebe862ee77f10_NeikiAnalytics.exe

  • Size

    47KB

  • MD5

    5b528e46ec751a4212cebe862ee77f10

  • SHA1

    aa8a9a74a533a0eff0491ea47c1ae5512cc8d007

  • SHA256

    d39c179c215c72fbf0afab02461a35f85294a9101e5d686b7a84b99e16ea0414

  • SHA512

    f854578ccac0db00a089bb60206c438e192d40808a4980a3d2b7440744883f50603121fcc53154cb080287cd9c416ebc62faffc6e37c1365e64f67c54ab11918

  • SSDEEP

    768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFx7:CTWn1++PJHJXA/OsIZfzc3/Q8xJJMJJQ

Score
9/10

Malware Config

Signatures

  • Renames multiple (3506) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5b528e46ec751a4212cebe862ee77f10_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\5b528e46ec751a4212cebe862ee77f10_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:1660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2248906074-2862704502-246302768-1000\desktop.ini.tmp

    Filesize

    47KB

    MD5

    ca2a3bac0ef31dbbcd2c3a0e5e242e15

    SHA1

    8f6782674219ee352a5d1ab3fb2e287b6084edb4

    SHA256

    97caad4bb34590f5b5e6f89d79c27d48462a1644b230bea307aaf1742f5e0382

    SHA512

    f698fb4ab4ca8967465f40bf5d82b0a397f9d03a5d9cec954be252b496aeb6fd4c3cb1db3b3cf451ef3c7a47201ca5acaf7722eb8ce3f53e71a34aa88a4c0711

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    56KB

    MD5

    5e4f9ad3795d424e326cd100259838d6

    SHA1

    16fce318d3d9ee92c29bb81d6deb8abc8ba3496d

    SHA256

    b8038cb99e3d657f9dc49a37ac7e2b8e83101a75692683a1ce409307caa1736e

    SHA512

    261f0b9f2c480f48e405b51dfa0362c18e2459e77b4f6059d7d3a16e76775e42847fe183a1113819a4e58f6aa99f2db0021f6858572b3de2c280352b4edc4442

  • memory/1660-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/1660-76-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB