Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    29/06/2024, 22:01

General

  • Target

    03fd36b986963230bedef6c535b28f30ee8c07223f3f4244e056d6a8c5710fd8_NeikiAnalytics.exe

  • Size

    135KB

  • MD5

    e8a633b0588624f3d0155adedc3003f0

  • SHA1

    ddd6390390a6123876057176072dd8338d2777fb

  • SHA256

    03fd36b986963230bedef6c535b28f30ee8c07223f3f4244e056d6a8c5710fd8

  • SHA512

    4e2f9881d375196fcea304c768a7158acfada24d6bec0125f71ec87653c8aea7269efe89e5fff170310580cf6ff4739963cda50838efdbb99565b7ee109e8cf6

  • SSDEEP

    1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zx5858lTWn1++PJHJXA/OsIZfzc3/Q8Z:fnyiQSoo858RQSoo858d

Score
9/10

Malware Config

Signatures

  • Renames multiple (3444) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\03fd36b986963230bedef6c535b28f30ee8c07223f3f4244e056d6a8c5710fd8_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\03fd36b986963230bedef6c535b28f30ee8c07223f3f4244e056d6a8c5710fd8_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini.tmp

    Filesize

    135KB

    MD5

    c6fa5d0554a4bbdc1c632e15804e1a3f

    SHA1

    08a5ee2a00302d11694078311c50668499f7fe33

    SHA256

    5b2985d4946657d0c61ae9ac8d473042aa9de38028507a277568d1a09ee6dd3b

    SHA512

    9759b51a1d94a4cc8c691ef6ce71550b207db6ae92f7927f74004531c76a11fe275f0e9e5d028e42a49376c449738150e90117f184d4447e4385684489099c85

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    144KB

    MD5

    4a55402d84547b571c957d6d8c3f1d27

    SHA1

    aeb6dee364ec34ed4821c0cccbe8e11b38230b77

    SHA256

    08d9836c6b976eb6164b6193b174ed505b57e22351282f4cf0fede2e833079fb

    SHA512

    078b16b05619d6e0f3c8064048df4dc84232d41c5387210a286c3ae5f29395327d7bd170a42fd04cfa123bdb3f141749dfbdd2bab818fda6cbcaba867ad097cc

  • memory/2208-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2208-648-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB