Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    29/06/2024, 05:08

General

  • Target

    68b15a625dcde8a3777b66474ae4819d5f22d260f2afb62762053f1be2481103_NeikiAnalytics.exe

  • Size

    128KB

  • MD5

    cce8bba886259f03957f447bbc2046c0

  • SHA1

    81e8f474603353b3b75455e1e3bf94fd695197de

  • SHA256

    68b15a625dcde8a3777b66474ae4819d5f22d260f2afb62762053f1be2481103

  • SHA512

    10b06cbab51c8ec4eeaf840db8acbc2cb965aed393489898aa69e4e76c6518cd555470f675303e07066186a11c88e976067e9b8eb820b21b608ff6e0502ebd0d

  • SSDEEP

    1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8MTWn1++PJHJXA/OsIZfzc3/Q8J:fnyiQSoHQSo2

Score
9/10

Malware Config

Signatures

  • Renames multiple (3449) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\68b15a625dcde8a3777b66474ae4819d5f22d260f2afb62762053f1be2481103_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\68b15a625dcde8a3777b66474ae4819d5f22d260f2afb62762053f1be2481103_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini.tmp

    Filesize

    128KB

    MD5

    d1e09a9426c8123f1c1a879817fb62d8

    SHA1

    54a034a5456b3b90d7f1a469ee7af4ae32589b1f

    SHA256

    11d28c2e90b5358423c43a411f3afe8cf8603354ae061c6c3eeedaa367603c79

    SHA512

    4f47b488744fee37e34d97b13ff8e2bbb1a6c2eb175a6bd9c02d5dc2ac89c7644bbbd19c9a6e26c2a0611b753d6b154ce0dff68231e01ae5b8a764c81d60e7ae

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    137KB

    MD5

    d7d9e73e654d2b90fb9f1e8b44dcbfc8

    SHA1

    f21c52b544c142a279b85b565bd125466a337cb5

    SHA256

    9f7fc465c0df091eb5aa59698f93c3b6c0a50fb8860509aee5cd2a2a779be79e

    SHA512

    2f79d8c1f4863537936d6a5edfd4fd48769ec2a8bf14fbf8e8864bf5a5705c48ada8f3bd6a776a7c62a7dffe4c81f2e7144dbcc7f358668d9da72ccd12b1b82b

  • memory/2664-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2664-648-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB