Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/05/2024, 03:25

General

  • Target

    625e5977f5f51b3bfbe3addfa5b74b70_NeikiAnalytics.exe

  • Size

    83KB

  • MD5

    625e5977f5f51b3bfbe3addfa5b74b70

  • SHA1

    4dadd357937b14943b65e6a6f2c4657fe1fcc159

  • SHA256

    78caa6c63f49e2a4de3ef02d6bab7462b072824647d1b4de2c843a0ee5b9cbe1

  • SHA512

    9102a095cb5f2e94830d80b6d2e125ed3e9b277774f76e3d22693a0f565c9013594a0ef2b1302c556ccae2742eb68df5f5e79f4583427bd3c861bd419db7656a

  • SSDEEP

    1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/0VXac:6e7WpMaxeb0CYJ97lEYNR73e+eKZ0VX9

Score
9/10

Malware Config

Signatures

  • Renames multiple (5057) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\625e5977f5f51b3bfbe3addfa5b74b70_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\625e5977f5f51b3bfbe3addfa5b74b70_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:3036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp

    Filesize

    83KB

    MD5

    7ad4123a7193dc922f799f0769d8cecb

    SHA1

    7393ea0a10911d0cc7c0fa307706f196c0d759c8

    SHA256

    8ca1a1556dbe0502e4b78d0b07341ba403560a615a9d16886ad2c5cea6163999

    SHA512

    3201dae01f21ccd87e7187e47bb6feb01c3372e512b11044c91d07b0b69d6c44cfcd94504cd6218c3a3b65da0329f492f02b1e7535f6ccec35c03d33702d3ad6

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    182KB

    MD5

    1349f7d6c44f216209ba685bd8ba9c1f

    SHA1

    9977e1d108a75e1ab2b884d5b57c7df9331283f9

    SHA256

    1b188553d49b58b3b91dc4b880e7a3a54f226c6ccda73e0961d5bb2fa41dcb9c

    SHA512

    21d251c80a65b27b962276b5d7d0bdda6fa7294777c48b25ca303dcfceca5465be80e28c58b6154b0f68f44eb838c15182236d85a74b3216041f7814cd5b115e