Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/06/2024, 18:51

General

  • Target

    eaf29828e30926e47fc35b590f804050_NeikiAnalytics.exe

  • Size

    29KB

  • MD5

    eaf29828e30926e47fc35b590f804050

  • SHA1

    e82f4cdfc80dd31125d50f4fc260c7e3e7160c53

  • SHA256

    21cee6ad9f6649746abb2a93507baf348dca80ab184f83e461e80c24d7ba328d

  • SHA512

    a81307b6531b937feabd0b24d5bdd55b50fc36ece54f7a71653c086347825d65249db3def2b266b487f94d0b903d168eb2db78ef87eb95ed16eb6834b7a25ceb

  • SSDEEP

    192:tACUADIY0Br5xjL/FAgAQmP1oynLb22vuN6GnN6G0JN:GBt7Br5xjL9AgA71FbhvuNBNqJN

Score
9/10

Malware Config

Signatures

  • Renames multiple (5194) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eaf29828e30926e47fc35b590f804050_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\eaf29828e30926e47fc35b590f804050_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:5072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini.tmp

    Filesize

    30KB

    MD5

    7599d4b733f3143ca783ec43781f1798

    SHA1

    e0e9c4f2101a79140198f2c362b218ebb047f640

    SHA256

    1228f3728c89062dd1fbcc3cbeb82dbe73fa12e38dface182199c40889d74612

    SHA512

    5f8e6ed81c3e7987f0484f4380fb1b58d71dd81bfe0234f3e005de5b9f39b21810f9babb2c23286cb65cc5d61babd15a805bc93cb78c368dd85186d944fc072e

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    128KB

    MD5

    f4afe78b8ab0f5ba9b60ca4369831f54

    SHA1

    54919b1c3e51bb57cc419b9159543c45c4cf4139

    SHA256

    597f09a04d6f2ee34172286b1c018734be9765c24bc68b25337a7408ad591411

    SHA512

    004daf6e57b15a8dbf01a2b4ff4b6fd92d81921951506dd6f9692a0e7724ed4a8e55c0b0f027b79727edf204cae82e7596f69d2c6b34b37ea6e2aed43bc35839