Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
13/06/2024, 20:26
Behavioral task
behavioral1
Sample
842c400c827e8ec2050aab8c6e822340_NeikiAnalytics.pdf
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
842c400c827e8ec2050aab8c6e822340_NeikiAnalytics.pdf
Resource
win10v2004-20240508-en
General
-
Target
842c400c827e8ec2050aab8c6e822340_NeikiAnalytics.pdf
-
Size
480KB
-
MD5
842c400c827e8ec2050aab8c6e822340
-
SHA1
caee5306332ce6145420bb21f9385f86d9141acc
-
SHA256
96f94e6b53f546f872096f6555223141ac96f1f4bb4af0f778c03e44d5489f39
-
SHA512
b2dcabf35321a4054b06aff0b57a14a25e58c7e54eb14dd2ed399e017b9041c75a40639ae7be9c34004ccb7b742ad2aeea63780befc4b11966725e34654a248e
-
SSDEEP
12288:u0Q00000000000JZqORbzzf1NOHjIb3Dhbp7OZQZERpA9lE:uYqSbzzf1vRp26ERpALE
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1932 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1932 AcroRd32.exe 1932 AcroRd32.exe 1932 AcroRd32.exe 1932 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\842c400c827e8ec2050aab8c6e822340_NeikiAnalytics.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1932
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD54d6a88dc0610f0373ef93f2a983cb0d8
SHA1a41d6f517d3d3c7206748a64dcc8bed785852e6e
SHA256f717caedcd3cb49e642907ce2d3c43e6431110749503290c0a3b42e30b963d56
SHA512cce25b431ecd0304ba7e8e80a367e7bd82415de884675000ad939a560977335965cbfd1af99e95c4d692c4edc692d33b1561495f88c8b9a84892d5e60705b91d