Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
06/06/2024, 10:07
Behavioral task
behavioral1
Sample
05e16f1d61d9a6b1a327583078ecbc40_NeikiAnalytics.pdf
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
05e16f1d61d9a6b1a327583078ecbc40_NeikiAnalytics.pdf
Resource
win10v2004-20240508-en
General
-
Target
05e16f1d61d9a6b1a327583078ecbc40_NeikiAnalytics.pdf
-
Size
293KB
-
MD5
05e16f1d61d9a6b1a327583078ecbc40
-
SHA1
573235bae7a5141770bee6e3365fe36c5f1387e3
-
SHA256
5212bd7e3bbb12043d920c4cf926b079040960935fd23ea3767a11a8b301d047
-
SHA512
4b8ac92c47be69c147b058ba19b2a229523f86c2956cc57c0a1e38d9617d3b67db269f24269629100dc15ab8ee143cf4115d3459512d4aab8086e58339bc8faf
-
SSDEEP
6144:jqwQ+xe3pZP7k+yTRj0ZTLVNtK5HsTzmm0CZ0Mim:Rzx0pZDeTRji3VXKZ+imDyMP
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1576 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1576 AcroRd32.exe 1576 AcroRd32.exe 1576 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\05e16f1d61d9a6b1a327583078ecbc40_NeikiAnalytics.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1576
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5772cb0c1d18d1d6252a8948c574859e2
SHA1b26a7b0054bf1e8efdde1fcf344a1ecd47820899
SHA256c5174b2b2d2a128d636d8cdabb636de1aa8cb517591957088f8f5bc3d6f5627a
SHA512dc273b9ada51bf2df5e8677a123fe1603810c162d3318fb44593f8d170a43eba2204bd0d3a6c4a790c3e50383e9e2744e196170d8a70d446c1ebba4ea0a80b86