Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    30/06/2024, 22:43

General

  • Target

    2003adaf0ed9a4f55fa23d452e88c81ffc5ff27e504b1329b106830028cd4704_NeikiAnalytics.exe

  • Size

    46KB

  • MD5

    b723eb0fd6a232b4fbe47dcc5b4703d0

  • SHA1

    2d5806e3a46721c45ca807f882be3c929ff45daf

  • SHA256

    2003adaf0ed9a4f55fa23d452e88c81ffc5ff27e504b1329b106830028cd4704

  • SHA512

    f39582ec249a7538199ddcd5e778b9c9678c64f4ca77dc19431f8ccb8ff0ce71e37b403daa50fb37d7ec4924ff2850858328d174f16c9a5277c0374ed60c184f

  • SSDEEP

    768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFzw:CTWn1++PJHJXA/OsIZfzc3/Q8zxO

Score
9/10

Malware Config

Signatures

  • Renames multiple (3443) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2003adaf0ed9a4f55fa23d452e88c81ffc5ff27e504b1329b106830028cd4704_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\2003adaf0ed9a4f55fa23d452e88c81ffc5ff27e504b1329b106830028cd4704_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-268080393-3149932598-1824759070-1000\desktop.ini.tmp

    Filesize

    47KB

    MD5

    ece6cd4ee45cb00873c492c205406980

    SHA1

    fb151a2fc02e042fbc720319fa7f07439e8528a9

    SHA256

    4039f73ffae0ceb08bc1e0ba269d6c9c27c3248cd80a22ee2348894b27e28229

    SHA512

    217cc3f09ab57ea3a26b75934430f74d8105d46f1c26ff54fb887f9b011152b564e3e624eb2b78bf2ecfa00fb6459f789b90820a91e16029af1a1ced82dbfbd3

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    55KB

    MD5

    7de1df17be341bf41cdd3c888863fbff

    SHA1

    2e200e3616a089730d1c98e73802d81cd88c692e

    SHA256

    21fd3357e8cebdab1df0e920b2d2ac0dd019f3a7a640990a4edbe49e40d2c3b9

    SHA512

    e8fa2377c65829f1afceba4e528e8298d78896f47ae6b2bbdeeadad9e7af0dc1a286e30b18f462902556320d34151e74de0c9e1129c634796cfcd69804783b09

  • memory/2980-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/2980-74-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB