Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/06/2024, 20:56

General

  • Target

    07ceb7a0ed338dd4803e362ef73b740552c69c0f6390b93062f39169d11acea2_NeikiAnalytics.exe

  • Size

    82KB

  • MD5

    d33adae4e3a840139c09c8839ab09430

  • SHA1

    cbb63fb5bcfb7382cf8c4eae6756d3b8ccb0698e

  • SHA256

    07ceb7a0ed338dd4803e362ef73b740552c69c0f6390b93062f39169d11acea2

  • SHA512

    60aba1e0d07f275accf762063fb9b9c1def613dca3bc66d90f169e04e579231ba93cc56f2456ec2c5540af7a57d055ccf4094be5ee66e3b87aebe1df20a6f37a

  • SSDEEP

    1536:/7ZQpApze+eO888888888888888888888888888888888888888888888888888r:9QWpze+eO8888888888888888888888U

Score
9/10

Malware Config

Signatures

  • Renames multiple (5121) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\07ceb7a0ed338dd4803e362ef73b740552c69c0f6390b93062f39169d11acea2_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\07ceb7a0ed338dd4803e362ef73b740552c69c0f6390b93062f39169d11acea2_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:4188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2080292272-204036150-2159171770-1000\desktop.ini.tmp

    Filesize

    82KB

    MD5

    a9bc01a99b26a6ecdcbc527ddca8ff17

    SHA1

    8ad2e1db818dca0c0ddee6dedda2674d89d72151

    SHA256

    c5c83d7cfa1630f1bf37503537cccf39b863c55a6ab42824b47d6794e3c4b192

    SHA512

    add12f010aa50e25f3d74048848d1050f22e31dcba1478e2e9c8161103be7e065b03a9839947f8f181165158d4d027b60b368e00f0410d8c8e8a757f25b10f99

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    181KB

    MD5

    626403f934f82fb84c92dd61a2149e4c

    SHA1

    fe5db90e02d640b68ac5a7ec31cea49aeaec48c7

    SHA256

    cb5dd1a66225fe1d7a0755f111ef1b4047aa2f53e31ab60687ce1c1d8311af56

    SHA512

    f847be8dcc81250cc73c3d1345a6df6e48bb969eca3770876d5a8d0560a27d95ed2ca4f83f4ef00e772533ab0556a70d834e6c2d8633955cc8a60180548b05b3

  • memory/4188-0-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/4188-1868-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB