Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
133ebe8fc9c1f5edeb75167211d23ffbbbb8489a1afd97ba757304b17c0a2078_NeikiAnalytics.exe
-
Size
433KB
-
Sample
240627-y992ys1gnk
-
MD5
50b93aa568ebd97ca02b9449932ed1a0
-
SHA1
48b6062ef504c908a6f9d8c088ae63c77408580d
-
SHA256
133ebe8fc9c1f5edeb75167211d23ffbbbb8489a1afd97ba757304b17c0a2078
-
SHA512
346346b76cfeb94efe6e64f34f7966428442e70da1e4875c6aa38eafbd51321b7f5299091b93e829988337ad32e00cb4585b903ab2e72e3276cf73b0a3e58e80
-
SSDEEP
12288:KQtcNUhiHOR4LucvSFSrux88ndNtJXzLFzig:KIGUhiHOeE8rin3thLL
Behavioral task
behavioral1
Sample
133ebe8fc9c1f5edeb75167211d23ffbbbb8489a1afd97ba757304b17c0a2078_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
133ebe8fc9c1f5edeb75167211d23ffbbbb8489a1afd97ba757304b17c0a2078_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
Malware Config
Targets
-
-
Target
133ebe8fc9c1f5edeb75167211d23ffbbbb8489a1afd97ba757304b17c0a2078_NeikiAnalytics.exe
-
Size
433KB
-
MD5
50b93aa568ebd97ca02b9449932ed1a0
-
SHA1
48b6062ef504c908a6f9d8c088ae63c77408580d
-
SHA256
133ebe8fc9c1f5edeb75167211d23ffbbbb8489a1afd97ba757304b17c0a2078
-
SHA512
346346b76cfeb94efe6e64f34f7966428442e70da1e4875c6aa38eafbd51321b7f5299091b93e829988337ad32e00cb4585b903ab2e72e3276cf73b0a3e58e80
-
SSDEEP
12288:KQtcNUhiHOR4LucvSFSrux88ndNtJXzLFzig:KIGUhiHOeE8rin3thLL
Score9/10-
Renames multiple (3309) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops file in System32 directory
-