Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
71f160df75b...cs.exe
windows7-x64
71f160df75b...cs.exe
windows10-2004-x64
10$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3BTAPI.dll
windows7-x64
1BTAPI.dll
windows10-2004-x64
1Epileptolo...ls.pdf
windows7-x64
1Epileptolo...ls.pdf
windows10-2004-x64
1Limean80/M...th.dll
windows7-x64
1Limean80/M...th.dll
windows10-2004-x64
1Opdyrkende...LL.dll
windows7-x64
1Opdyrkende...LL.dll
windows10-2004-x64
1Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 23:29
Behavioral task
behavioral1
Sample
1f160df75b05e29bc10e44345b4f6e80_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
1f160df75b05e29bc10e44345b4f6e80_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
BTAPI.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
BTAPI.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
Epileptology103/Bullpout/Stillelsningsprvers125/Signatures Technical Details.pdf
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Epileptology103/Bullpout/Stillelsningsprvers125/Signatures Technical Details.pdf
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
Limean80/Milieuforbrydelse/System.Xml.XPath.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
Limean80/Milieuforbrydelse/System.Xml.XPath.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
Opdyrkende/Rodge/Ationsdatoernes/Controller/LutComprDLL.dll
Resource
win7-20240419-en
Behavioral task
behavioral14
Sample
Opdyrkende/Rodge/Ationsdatoernes/Controller/LutComprDLL.dll
Resource
win10v2004-20240426-en
General
-
Target
$PLUGINSDIR/nsExec.dll
-
Size
7KB
-
MD5
f27689c513e7d12c7c974d5f8ef710d6
-
SHA1
e305f2a2898d765a64c82c449dfb528665b4a892
-
SHA256
1f18f4126124b0551f3dbcd0fec7f34026f930ca509f04435657cedc32ae8c47
-
SHA512
734e9f3989ee47a86bee16838df7a09353c7fe085a09d77e70d281b21c5477b0b061616e72e8ac8fcb3dda1df0d5152f54dcc4c5a77f90fbf0f857557bf02fbc
-
SSDEEP
96:JpmkmwmHDPVhklfSoRPB+YSvWvZckH69MSz00vQFHhAVvSGYuHnUNy2DCP:J+PVhYfSokvW2CsQFBAVaGdHnUNR
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2252 2212 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2076 wrote to memory of 2212 2076 rundll32.exe 28 PID 2076 wrote to memory of 2212 2076 rundll32.exe 28 PID 2076 wrote to memory of 2212 2076 rundll32.exe 28 PID 2076 wrote to memory of 2212 2076 rundll32.exe 28 PID 2076 wrote to memory of 2212 2076 rundll32.exe 28 PID 2076 wrote to memory of 2212 2076 rundll32.exe 28 PID 2076 wrote to memory of 2212 2076 rundll32.exe 28 PID 2212 wrote to memory of 2252 2212 rundll32.exe 29 PID 2212 wrote to memory of 2252 2212 rundll32.exe 29 PID 2212 wrote to memory of 2252 2212 rundll32.exe 29 PID 2212 wrote to memory of 2252 2212 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 2203⤵
- Program crash
PID:2252
-
-