Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/05/2024, 02:46

General

  • Target

    73e9736675673bd03d031e1ab0f432b0_NeikiAnalytics.exe

  • Size

    47KB

  • MD5

    73e9736675673bd03d031e1ab0f432b0

  • SHA1

    6f853bf049dec4ae02500cbabd49f2a3878a67bf

  • SHA256

    073298d584e950071b4c828748f6e710b7a4f58f56e22a6ca9fe69a2ff0320b7

  • SHA512

    85aee2842ddb61e432103ae09d2e0445c29b9406b88cc256fca1f2f4e276b1a1f2de1079aa43522e795938fcd7c50b00157a0dd3f9fa877d62d0d658b94f2a8f

  • SSDEEP

    768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFz7:CTWn1++PJHJXA/OsIZfzc3/Q8zOU

Score
9/10

Malware Config

Signatures

  • Renames multiple (5181) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\73e9736675673bd03d031e1ab0f432b0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\73e9736675673bd03d031e1ab0f432b0_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp

    Filesize

    47KB

    MD5

    9027d719bf00b6ecc28a9f2e4384a8b9

    SHA1

    b6227b6931dfc17d757f65ce33131c68b9dd0ed1

    SHA256

    ebd3fbf326c617afc4902d3164e159c6c482a93e161b6d3dfbfcbd7810ac2098

    SHA512

    712fbee26ff49f1546120f75f34c5472f7423e79e7e8c0bb2b3196c9902033a110ac9ec074b9a36d7f83060b846f57fe32528500cd475d049155e99c90ef9d82

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    146KB

    MD5

    20161951ecf6405237a00de2b04d8fb2

    SHA1

    92131ab6f14e98b27292e70bcd8f479a96435a43

    SHA256

    cf3d1c48b66dd0689c1b0eabb2bec74231032f2a0969096b341adec577498bfc

    SHA512

    895e9e352f1a5672d3222791a8672f25f6e5d61f585349cff138978398d8060999fc35aaa701e2873c4c8b3d923ce81749c7253f66160db0974ef5c6378866d3

  • memory/968-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/968-1090-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB