Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/06/2024, 03:40

General

  • Target

    773d7da09b610d836b3244d02c783d5b28d179a13c8e10f561210584343f4e6e_NeikiAnalytics.exe

  • Size

    52KB

  • MD5

    353caab0c0745a349912e1c1fd952750

  • SHA1

    a1c5ef9723e80dd7fc50dd44751d4cb33aa0351d

  • SHA256

    773d7da09b610d836b3244d02c783d5b28d179a13c8e10f561210584343f4e6e

  • SHA512

    20ddf0226a7bbc88b526eb11e583b2a6afcf1ec2e87bb0a3235df134d1736f669bbbbf1e4635d24aaa68a240b21b41539cd426e0f3d7d721f581d92bdda1e05a

  • SSDEEP

    768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFzm:CTWn1++PJHJXA/OsIZfzc3/Q8zx72/

Score
9/10

Malware Config

Signatures

  • Renames multiple (5343) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\773d7da09b610d836b3244d02c783d5b28d179a13c8e10f561210584343f4e6e_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\773d7da09b610d836b3244d02c783d5b28d179a13c8e10f561210584343f4e6e_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:1460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp

    Filesize

    52KB

    MD5

    5fbf90ef1fc3702c70ba7adcbf2b598f

    SHA1

    d5ab072a627816e04203a9ddf53912a5a0093da9

    SHA256

    625a4e74bd11d8d3243e104d79dac65d7e9aeec597f03b82c440869888bfcea2

    SHA512

    c55ff713e8539bb95dfdba8118bd5a9986c28803d65d28d5783bba060df1eef62f5c4fc49fd6bf482f548f8d0dfebaffdc047913cef7fab4e7330fc6004a98ff

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    151KB

    MD5

    847a7f0bce223f7ce556cb26219a7fa9

    SHA1

    380f53d244edfe8391b0f67d49ab7550e03ac561

    SHA256

    08a5bbea8b8639bfd7a8a1feedda114c28ab9610ab970ddf60e14f2666863bfd

    SHA512

    43a67c7ab276ea41f18998e1484a9aa115796bbebbbfad64782c72fbdb7dcb843dbb263425ffc3148efbd607fbc61bfb1f840b18281a62c53b87f719fabfc79c

  • memory/1460-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/1460-1216-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB