Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    15/06/2024, 23:59

General

  • Target

    c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe

  • Size

    316KB

  • MD5

    c44dc0c185aa9aadffdea5ed13cefd10

  • SHA1

    6c55b67748b0bc03eadc8c23031add8c887c58cf

  • SHA256

    2f6b8fbd862eb5bf3053561520b3368ac305c2d4005ea9062ee8f21622296e0c

  • SHA512

    97c6f3dee117657eb27f062379142409e3cb481f529b10b0c2bd6d1a68b8f347f981c70ee9c9f3a8f4b49c855e92d424426c6defb5ee863d4bc71185312a714a

  • SSDEEP

    6144:tFPxPke+eIr9RUxfKIuqBcKxNWdp+bkrdHs1lpaSL4vtI:3PxPir9RyiIuGcKbpaSL4vtI

Score
9/10

Malware Config

Signatures

  • Renames multiple (2841) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\c44dc0c185aa9aadffdea5ed13cefd10_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:1964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2737914667-933161113-3798636211-1000\desktop.ini.tmp

    Filesize

    317KB

    MD5

    46158e3a5252dc06598ef92069dc23c1

    SHA1

    797fe5d9671bae24bfe0a248f0ae2d5b75809437

    SHA256

    5ef3d9bced3462098024da71f9618bca2a894d32b3c3f9242e85d76c1e83136b

    SHA512

    04cda8f5f99b738d290a08c6af32fc37e330ac0fefd5ab1a060b1a82ba2faf65af4431229f447a770c2d2a8b35eaf7a132d1e5c53bb80cd81bc2ccd67cb395b0

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    326KB

    MD5

    6c257684313f5da4785a0d4596c73264

    SHA1

    6af107d4b7843d1cf3de68151178264c0388ff11

    SHA256

    d8d4881adc775fc9e7067fb26a8c239a3c63c54167dd2e1c8dc3a5f043b5c28a

    SHA512

    3ce0bd5413569d8948a0ed5a8fb611e5d8065008b40b80eb74b16c9894616865c1f78e6f96093786b5e230880979a69211d12967b43a7389b2831f13d704c9cc