Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    19/06/2024, 20:56

General

  • Target

    07ceb7a0ed338dd4803e362ef73b740552c69c0f6390b93062f39169d11acea2_NeikiAnalytics.exe

  • Size

    82KB

  • MD5

    d33adae4e3a840139c09c8839ab09430

  • SHA1

    cbb63fb5bcfb7382cf8c4eae6756d3b8ccb0698e

  • SHA256

    07ceb7a0ed338dd4803e362ef73b740552c69c0f6390b93062f39169d11acea2

  • SHA512

    60aba1e0d07f275accf762063fb9b9c1def613dca3bc66d90f169e04e579231ba93cc56f2456ec2c5540af7a57d055ccf4094be5ee66e3b87aebe1df20a6f37a

  • SSDEEP

    1536:/7ZQpApze+eO888888888888888888888888888888888888888888888888888r:9QWpze+eO8888888888888888888888U

Score
9/10

Malware Config

Signatures

  • Renames multiple (3739) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\07ceb7a0ed338dd4803e362ef73b740552c69c0f6390b93062f39169d11acea2_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\07ceb7a0ed338dd4803e362ef73b740552c69c0f6390b93062f39169d11acea2_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2737914667-933161113-3798636211-1000\desktop.ini.tmp

    Filesize

    82KB

    MD5

    b15f914b7670134faff2850227fba6e2

    SHA1

    f73b2f1ea90319d55641d6b4e24abcb13662df42

    SHA256

    2dca03c5049aa5d3be389134ee2aed486745151195b88924c90bcd16340ef621

    SHA512

    cd8527c2ffc994f475f8b383112cc1b4ecf7787720f9e0949f4c68c1bfc845e97f7dfddfe764ea6175afe494fbcb2fcb8a0f58a34b973424bef820356cff884b

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    91KB

    MD5

    4f4b4a74bf3d22bedc2b49a4bd1b5b6a

    SHA1

    97d70e2c2b9619f63a679cb3a940400c8bcade8c

    SHA256

    f55f4fb49979328004efd1bea5b02ed94dd907d82092660bd6bdb911a1195559

    SHA512

    d8765ccca199f7fe7c13db37dacd01f929b8ee33c2a02015682a4de16216c5df0d0074fb9e434004d16c699d591a0b17edf04b6a21d783f0b7b99e3aec5b78ad

  • memory/2044-0-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2044-658-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB