Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/06/2024, 23:38

General

  • Target

    c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe

  • Size

    44KB

  • MD5

    c31e33ad3209df3336cc48f326d0d5c0

  • SHA1

    70638beed14f7e08f12f41aac5259b840c831c5d

  • SHA256

    47871149450625526eaec39bf6a72e72cde531d96ef75c6e104fefcdb2409e34

  • SHA512

    cbc6ec55b6d476ab8a81f7ebdcf219ae5d140104475393031181c053e1402f5ca46e89275cd8ae82a22b832284200c2a1d85c77ea85f14d78688ae17fc5a69b6

  • SSDEEP

    384:GBt7Br5xjLMuLAgA71FbhvDl3DG71ul3DG71XUmUIYFt1zecDT1zecDY:W7BlpNLpARFbhblkYlkuvIYFWcDYcDY

Score
9/10

Malware Config

Signatures

  • Renames multiple (5325) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:1664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp

    Filesize

    45KB

    MD5

    e4b723543cf9be885d5addae74d7478e

    SHA1

    4c1b80478c8a8f51114092120255a794992e61fd

    SHA256

    8a425daaeca5a06277888063944210bbc5f355af422692f2d16d74948affb158

    SHA512

    6e9074cb90aec05b21ff6e121293c9e14aa8ddc5eee0b28b70c128f7d6e1022fd41a5e81b479eed9651c67333f0d69a4eb04dc391d07837af2365f77ad7d7a14

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    143KB

    MD5

    0a635c0a65444f4a69acd39e8340c6cf

    SHA1

    3e90682887918bbc6fb87a1ad58c7b1ce1f63075

    SHA256

    3b5228327559671f60846e827e1541fd57c4e3da8e4be04b201fa0b44ccdc195

    SHA512

    355da2ffb80502f845233484797a73a88c09d705d6d35fe72355e2bb7832dd80edde05ebe619a73f474822f129dbd322233d5c74f5777fbbd4992f1e07af14a0