Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
11/06/2024, 12:26 UTC
Behavioral task
behavioral1
Sample
34bd4e93f81f30695600dc1187a6fd00_NeikiAnalytics.pdf
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
34bd4e93f81f30695600dc1187a6fd00_NeikiAnalytics.pdf
Resource
win10v2004-20240508-en
General
-
Target
34bd4e93f81f30695600dc1187a6fd00_NeikiAnalytics.pdf
-
Size
387KB
-
MD5
34bd4e93f81f30695600dc1187a6fd00
-
SHA1
9fe13117f11e5749d99ca1a53043939206c03a70
-
SHA256
d8ceabaa1b9a8af53f9090538814d8c20f676dd6d2c1b2cfa02ea3f8752f34aa
-
SHA512
5bf44d6069a5e070553a1e9170ea020efa236b6f157d44f4aed56907a36c2fe5d5b21edc7c8ae80f5eb74dd23a1aae113baf3327a3f79de09a076dff58e7b6da
-
SSDEEP
12288:77UrTG++5Q4p4S/a3mPe/607bq3FPDyRW:3UrTGRQ4p4ga3mPe63FPGW
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2884 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2884 AcroRd32.exe 2884 AcroRd32.exe 2884 AcroRd32.exe 2884 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\34bd4e93f81f30695600dc1187a6fd00_NeikiAnalytics.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2884
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD587aac5cec40ea7ae8b370d94821a4ebc
SHA14b4dc81349419d260e2dc390d9f8389bb0205e59
SHA2566254ff9048958d8f52d010cae605d795cb60b45c23a4e1af50376933e96d8600
SHA512f8066936a568dfb43d0dc702a1d5ae48188a292c0db0ce77f908e4ece0ea66319c715207aab4f3ba2770098498bc195e1d6bc5f25a4c478370628d234b2e4c1a