Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    28/06/2024, 03:40

General

  • Target

    773d7da09b610d836b3244d02c783d5b28d179a13c8e10f561210584343f4e6e_NeikiAnalytics.exe

  • Size

    52KB

  • MD5

    353caab0c0745a349912e1c1fd952750

  • SHA1

    a1c5ef9723e80dd7fc50dd44751d4cb33aa0351d

  • SHA256

    773d7da09b610d836b3244d02c783d5b28d179a13c8e10f561210584343f4e6e

  • SHA512

    20ddf0226a7bbc88b526eb11e583b2a6afcf1ec2e87bb0a3235df134d1736f669bbbbf1e4635d24aaa68a240b21b41539cd426e0f3d7d721f581d92bdda1e05a

  • SSDEEP

    768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFzm:CTWn1++PJHJXA/OsIZfzc3/Q8zx72/

Score
9/10

Malware Config

Signatures

  • Renames multiple (3749) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\773d7da09b610d836b3244d02c783d5b28d179a13c8e10f561210584343f4e6e_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\773d7da09b610d836b3244d02c783d5b28d179a13c8e10f561210584343f4e6e_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini.tmp

    Filesize

    52KB

    MD5

    01c8ac18979d0a5300db0b6485c9ee5b

    SHA1

    c25d8246f4ab2b8870a0ba14506c57ccfc1abf10

    SHA256

    92091dd4a4cb5f00b6685a933871832a71ea25f9883ad491b492de1123971659

    SHA512

    55e0224a6c29f7bf79fb429a8570fff281e710281421759833699989eca0939bf667e7245ac5ca4fe6ff6dcb5d41ccfaf3e962a07bd8c26139d6d074bf7730b9

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    61KB

    MD5

    c1837cc60b231fd073ef4e5c2031c195

    SHA1

    fe426f35793937db27b7e02e711f9396cd66822a

    SHA256

    83bba409d2de504f492d4cd3e6d9efe0f33650136767034e7168ec6cd5de395d

    SHA512

    11c422068d4e8b7a49ef65bb86deee198095dce9a2bf77e6fd9140cf96b852accc1059dcd1016eba61eccf6f3e2fa5c4e55573ad24d860f1cc5d12d0fffe660f

  • memory/2940-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2940-74-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB