Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    103s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/06/2024, 11:33

General

  • Target

    6ce105989cee9277afe398df73865180_NeikiAnalytics.exe

  • Size

    81KB

  • MD5

    6ce105989cee9277afe398df73865180

  • SHA1

    6a155ae3fa9226af7e28e4fc42857ad64cea70db

  • SHA256

    91c635b6a5f86daad9c8c34cb1d9ba2664b9af7859eb5ef96a58e39d1739665f

  • SHA512

    1ddb36a4e997b4e42dcb32558505a176453c5a107ecbfbed6868fd31ee0a68a3bb98fd192603f4b5c5785419ac45a9b0da49930a6729182a04d32c51cf08a8d9

  • SSDEEP

    1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/HfFpsJOfFpsJJ:6e7WpMaxeb0CYJ97lEYNR73e+eKZHfFc

Score
9/10

Malware Config

Signatures

  • Renames multiple (4828) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6ce105989cee9277afe398df73865180_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\6ce105989cee9277afe398df73865180_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:4052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp

    Filesize

    81KB

    MD5

    4f554f04c322b30c0e399d08059c0591

    SHA1

    6fab680c7000e5d3de658848d07285889c942d94

    SHA256

    ad2e69694f8a243100adfffb90ece678067a9a4c5c7a009660c9c2c574ece00d

    SHA512

    85871a8a21d6fcfd298a1392b34f8b2bb31b30645a4741697ce3912eb2724fd8c65f6f5d5009a7100206c71ff125de459db06d9436960989cf81125eac385426

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    180KB

    MD5

    0b6da0473feb336e6240366cac133557

    SHA1

    3483e9571ae76fcb388681dc900e706bf446eaf5

    SHA256

    d96f8b895ca90fabb6239b0632166b8cfec04069a232b60693a637b47e8e8832

    SHA512

    075d66a1230ed5251e1b62e61f400f09c1d204871e7c53d57f74c1f211c8a390213628073c559c67fc4177b083786fad04a925e88fb572f70d92971f1cabb5a7