Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
71f160df75b...cs.exe
windows7-x64
71f160df75b...cs.exe
windows10-2004-x64
10$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3BTAPI.dll
windows7-x64
1BTAPI.dll
windows10-2004-x64
1Epileptolo...ls.pdf
windows7-x64
1Epileptolo...ls.pdf
windows10-2004-x64
1Limean80/M...th.dll
windows7-x64
1Limean80/M...th.dll
windows10-2004-x64
1Opdyrkende...LL.dll
windows7-x64
1Opdyrkende...LL.dll
windows10-2004-x64
1Analysis
-
max time kernel
125s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 23:29
Behavioral task
behavioral1
Sample
1f160df75b05e29bc10e44345b4f6e80_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
1f160df75b05e29bc10e44345b4f6e80_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
BTAPI.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
BTAPI.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
Epileptology103/Bullpout/Stillelsningsprvers125/Signatures Technical Details.pdf
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Epileptology103/Bullpout/Stillelsningsprvers125/Signatures Technical Details.pdf
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
Limean80/Milieuforbrydelse/System.Xml.XPath.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
Limean80/Milieuforbrydelse/System.Xml.XPath.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
Opdyrkende/Rodge/Ationsdatoernes/Controller/LutComprDLL.dll
Resource
win7-20240419-en
Behavioral task
behavioral14
Sample
Opdyrkende/Rodge/Ationsdatoernes/Controller/LutComprDLL.dll
Resource
win10v2004-20240426-en
General
-
Target
$PLUGINSDIR/nsExec.dll
-
Size
7KB
-
MD5
f27689c513e7d12c7c974d5f8ef710d6
-
SHA1
e305f2a2898d765a64c82c449dfb528665b4a892
-
SHA256
1f18f4126124b0551f3dbcd0fec7f34026f930ca509f04435657cedc32ae8c47
-
SHA512
734e9f3989ee47a86bee16838df7a09353c7fe085a09d77e70d281b21c5477b0b061616e72e8ac8fcb3dda1df0d5152f54dcc4c5a77f90fbf0f857557bf02fbc
-
SSDEEP
96:JpmkmwmHDPVhklfSoRPB+YSvWvZckH69MSz00vQFHhAVvSGYuHnUNy2DCP:J+PVhYfSokvW2CsQFBAVaGdHnUNR
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 404 2440 WerFault.exe 89 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1380 wrote to memory of 2440 1380 rundll32.exe 89 PID 1380 wrote to memory of 2440 1380 rundll32.exe 89 PID 1380 wrote to memory of 2440 1380 rundll32.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#12⤵PID:2440
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 6123⤵
- Program crash
PID:404
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2440 -ip 24401⤵PID:2692
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4376,i,15140928051103392835,1612840580898364401,262144 --variations-seed-version --mojo-platform-channel-handle=4032 /prefetch:81⤵PID:3372