Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    292s
  • max time network
    212s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/07/2024, 10:17

General

  • Target

    Neo/LuminarNeoSetup.exe

  • Size

    1.9MB

  • MD5

    16803ffeb374f528e51ea55adbf9af7a

  • SHA1

    ec65f1c4c3337caae83e654982398d9161441ae2

  • SHA256

    044d976df8c968c8c88d58035ec8dcde723c556e0c30753e62b10f278319e063

  • SHA512

    1d0fa9c8d9af7f6ec0e1eccf47d24b9118a27d28c47918a581ac3d12b3b587be4155fd6eda1ed5fb27c9fca8b4302b1598639a8a190fd578ab66d67f0bddb448

  • SSDEEP

    24576:E4nXu/QSDTV+Bnvu8t7blM0ThB23vJtJjRFYlVKIqAzdGBoXKkmaGA8KoH:EqeNVijh83R1Ferzdh+Z7KoH

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Neo\LuminarNeoSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\Neo\LuminarNeoSetup.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:736
    • C:\Users\Admin\AppData\Local\Temp\is-73JDD.tmp\LuminarNeoSetup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-73JDD.tmp\LuminarNeoSetup.tmp" /SL5="$80054,920064,0,C:\Users\Admin\AppData\Local\Temp\Neo\LuminarNeoSetup.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      PID:1196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-73JDD.tmp\LuminarNeoSetup.tmp

    Filesize

    2.6MB

    MD5

    771671db95bedca4a7767e0fe053ddba

    SHA1

    a843acfbbe8399608f531b490cddcc57019b9a3a

    SHA256

    b3ae8aeacf2bbd4ba09cc4b1c3c7cbec99550e2082aeb8848765b65c04d61b1f

    SHA512

    c0b8fad993ce158bcc5a0f0b8f923d889162e087d296b679d5a5e07e8d7e2897de302c7cf3080368eff48e825dfc1c01b8490d52a5c7ef4626134bc90a9b612f

  • memory/736-0-0x0000000000400000-0x00000000004EE000-memory.dmp

    Filesize

    952KB

  • memory/736-2-0x0000000000401000-0x00000000004B7000-memory.dmp

    Filesize

    728KB

  • memory/736-8-0x0000000000400000-0x00000000004EE000-memory.dmp

    Filesize

    952KB

  • memory/1196-6-0x0000000000400000-0x00000000006A4000-memory.dmp

    Filesize

    2.6MB

  • memory/1196-9-0x0000000000400000-0x00000000006A4000-memory.dmp

    Filesize

    2.6MB

  • memory/1196-36-0x0000000000400000-0x00000000006A4000-memory.dmp

    Filesize

    2.6MB

  • memory/1196-38-0x0000000000400000-0x00000000006A4000-memory.dmp

    Filesize

    2.6MB