Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    01/07/2024, 07:04

General

  • Target

    3e57b94a652f855dd2f930adecd3693d80dc4d517f892c831252611c886ca0ba_NeikiAnalytics.exe

  • Size

    76KB

  • MD5

    56d0f9329bfa8214bcb39e3fa06431e0

  • SHA1

    f8c6f070eb1571e393f04b9280ab6a73e02eeec8

  • SHA256

    3e57b94a652f855dd2f930adecd3693d80dc4d517f892c831252611c886ca0ba

  • SHA512

    9c994ccbacade3eb7428447aa12e944775e5b518c45b1bfa35dc94e0362670f390bb5653510fc928d77872ec31198259f13beb9a51753a97cf6338196ff6a7c4

  • SSDEEP

    1536:/7ZQpApze+eJfFpsJOfFpsJeFrxFrd4NK/Kk:9QWpze+eJfFpsJOfFpsJ0rDrJ

Score
9/10

Malware Config

Signatures

  • Renames multiple (3436) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3e57b94a652f855dd2f930adecd3693d80dc4d517f892c831252611c886ca0ba_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\3e57b94a652f855dd2f930adecd3693d80dc4d517f892c831252611c886ca0ba_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini.tmp

    Filesize

    77KB

    MD5

    f21473d0a83ef86fb15d608a5a0e26b8

    SHA1

    9b0b9f5415268130e56948355b5b6dee21722952

    SHA256

    50295b9fdf2b933c9a7bfddf933e3a165db7342de289938e3bfbf62209c04aac

    SHA512

    374ef61497ec967245c8d78552d971832d4211a65de078f9dbd5a67d697881890347fba2a305f16719cfbbcf71ffe2ba586e55204535b12318c2e5ff0807a188

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    85KB

    MD5

    15f2586418eec8eecf60a2cd4d61452e

    SHA1

    d2a1d73e2d1b6b7ef82caaf43b6248646de25dc9

    SHA256

    e30d228fc6fea7b512222632329148c5086fa30456c91c094533a2879f121e7d

    SHA512

    b002711c6ffdaeb780a14b6bba978a8301614841da3ae02a4e2310450993d9291b8bccccc6ba67bbbf9be4f77588625967d486200800a32f136188161d88fbe7

  • memory/2220-0-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2220-646-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB