Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/06/2024, 23:28

General

  • Target

    172daef9c610cf66a0a9c47329c51d30_NeikiAnalytics.exe

  • Size

    100KB

  • MD5

    172daef9c610cf66a0a9c47329c51d30

  • SHA1

    84ef4b4a6e8510f571d96fe2f23e78798eabae02

  • SHA256

    e3c5e204610a5c7df19ba00a7cd56102d124b99ef77686fb4418f2d38b8665a7

  • SHA512

    c61a9d55d564077243064655382a4cb27347cd74c29a997bb1615825f99eec5888c7c055dc2d059020460b5b89e6121e8f898864f629afa8e3248ba0a9551502

  • SSDEEP

    1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKPN5Blpw:6rWpcOPxPke+e3fFpsJOfFpsJbgEy

Score
9/10

Malware Config

Signatures

  • Renames multiple (4825) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\172daef9c610cf66a0a9c47329c51d30_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\172daef9c610cf66a0a9c47329c51d30_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:1028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp

    Filesize

    100KB

    MD5

    5cdd6aff1cc92b0fab03b563ac38c450

    SHA1

    a9d7f1332e117cdb8b87727acf7524a3b13a797c

    SHA256

    2b77c897fddb933d32f0e72b699a3e80dfbd1cd6654e962208674b95d08a40c1

    SHA512

    a22c581da560333edc4aca54baa973e16578a07c8f310741cf04d61f9437aaed3e2efcbb6652988b05a740e1eab00ad2ca5bdc9310455302a5c424f6bdc46817

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    199KB

    MD5

    47761a325378a368d50d6bf6b95ac06b

    SHA1

    5407aead2ca5cbdb4cffd93cc488dffb6a98f06d

    SHA256

    abaf4be504cc7587e65b87bf5845bf8618b07a0475cd4bd45c111c5a21a80651

    SHA512

    cdb10b14d0e673e4f268e054d559b794e94d09f3646bb4c8084a2815d090e3477db46975474a34ad1a00acaae6656ba2e08ebbb1664294fdaf2be6b4c756222b