Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
16/06/2024, 08:34
Behavioral task
behavioral1
Sample
e491930dcd669c56f3b29fa0eff7dac0_NeikiAnalytics.pdf
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
e491930dcd669c56f3b29fa0eff7dac0_NeikiAnalytics.pdf
Resource
win10v2004-20240508-en
General
-
Target
e491930dcd669c56f3b29fa0eff7dac0_NeikiAnalytics.pdf
-
Size
6KB
-
MD5
e491930dcd669c56f3b29fa0eff7dac0
-
SHA1
a40202db933d87be353544c3b45ebf363e9e3789
-
SHA256
13f6a7eed5e2d6c63c4135687f6a5bc3c4d514ab3864569754b90fb6a5cbc2ab
-
SHA512
ba0fc86ce75b27b60bee11c7def645f5f59085b56c4484be479838e19086e0a59928eac24269f540322a3c4e46de4b42f559ba7d2d198673bd7b060f39c4bafd
-
SSDEEP
192:HT8+DtL2CdBkaCY9O+X5npLw5rUqxjL6qs4XH2d2CT1eax:A+lFTRCYd5npL2gQL6422i1eax
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1724 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1724 AcroRd32.exe 1724 AcroRd32.exe 1724 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\e491930dcd669c56f3b29fa0eff7dac0_NeikiAnalytics.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1724
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5634bd6c17ebbd3cf56df21f95f3a06c7
SHA107a3b8ef94e1501edecc87adb032239cd7a5c487
SHA25636d3fe370c7d9f5087fbbbf3ea394ac9e7c294bc59ed23fd872f9e5dfd97038a
SHA512482cd7a8f1e28e482059b679800c65ce8609aa15844b5ca465a8bb771a13168c0b740e79513c3015298b0ab9d5ac82f93a0bd22d216984c735e56b4f33b716b5