Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3Neo/Lumina...-2.bin
windows7-x64
3Neo/Lumina...-2.bin
windows10-2004-x64
3Neo/Lumina...up.exe
windows7-x64
7Neo/Lumina...up.exe
windows10-2004-x64
7Neo/Reg.reg
windows7-x64
1Neo/Reg.reg
windows10-2004-x64
1Neo/rapidg...et.url
windows7-x64
6Neo/rapidg...et.url
windows10-2004-x64
3Analysis
-
max time kernel
241s -
max time network
308s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
11/07/2024, 10:17
Static task
static1
Behavioral task
behavioral1
Sample
Neo/LuminarNeoSetup-2.bin
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
Neo/LuminarNeoSetup-2.bin
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
Neo/LuminarNeoSetup.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
Neo/LuminarNeoSetup.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
Neo/Reg.reg
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
Neo/Reg.reg
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
Neo/rapidgator.net.url
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
Neo/rapidgator.net.url
Resource
win10v2004-20240709-en
General
-
Target
Neo/rapidgator.net.url
-
Size
244B
-
MD5
ebdfe7586f6934a83c1e013152afbff2
-
SHA1
6b6e01b9ecfc72478ec8c11b54f374aefdea2e81
-
SHA256
124a3fcc92c88f31683f8008b95eb372b9b645b1cf985785027404a2b5aeba47
-
SHA512
67c4e85c587d20ac42364c7085d5513ecd7ff3810c082a3f3ec3da81be2c85f3f27a85c8c261853c7276848fcd046f10c0ad71ee853065e9527a6316583e2e3e
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 5068 msedge.exe 5068 msedge.exe 1784 msedge.exe 1784 msedge.exe 212 identity_helper.exe 212 identity_helper.exe 376 msedge.exe 376 msedge.exe 376 msedge.exe 376 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2520 wrote to memory of 1784 2520 rundll32.exe 84 PID 2520 wrote to memory of 1784 2520 rundll32.exe 84 PID 1784 wrote to memory of 2396 1784 msedge.exe 86 PID 1784 wrote to memory of 2396 1784 msedge.exe 86 PID 1784 wrote to memory of 4632 1784 msedge.exe 87 PID 1784 wrote to memory of 4632 1784 msedge.exe 87 PID 1784 wrote to memory of 4632 1784 msedge.exe 87 PID 1784 wrote to memory of 4632 1784 msedge.exe 87 PID 1784 wrote to memory of 4632 1784 msedge.exe 87 PID 1784 wrote to memory of 4632 1784 msedge.exe 87 PID 1784 wrote to memory of 4632 1784 msedge.exe 87 PID 1784 wrote to memory of 4632 1784 msedge.exe 87 PID 1784 wrote to memory of 4632 1784 msedge.exe 87 PID 1784 wrote to memory of 4632 1784 msedge.exe 87 PID 1784 wrote to memory of 4632 1784 msedge.exe 87 PID 1784 wrote to memory of 4632 1784 msedge.exe 87 PID 1784 wrote to memory of 4632 1784 msedge.exe 87 PID 1784 wrote to memory of 4632 1784 msedge.exe 87 PID 1784 wrote to memory of 4632 1784 msedge.exe 87 PID 1784 wrote to memory of 4632 1784 msedge.exe 87 PID 1784 wrote to memory of 4632 1784 msedge.exe 87 PID 1784 wrote to memory of 4632 1784 msedge.exe 87 PID 1784 wrote to memory of 4632 1784 msedge.exe 87 PID 1784 wrote to memory of 4632 1784 msedge.exe 87 PID 1784 wrote to memory of 4632 1784 msedge.exe 87 PID 1784 wrote to memory of 4632 1784 msedge.exe 87 PID 1784 wrote to memory of 4632 1784 msedge.exe 87 PID 1784 wrote to memory of 4632 1784 msedge.exe 87 PID 1784 wrote to memory of 4632 1784 msedge.exe 87 PID 1784 wrote to memory of 4632 1784 msedge.exe 87 PID 1784 wrote to memory of 4632 1784 msedge.exe 87 PID 1784 wrote to memory of 4632 1784 msedge.exe 87 PID 1784 wrote to memory of 4632 1784 msedge.exe 87 PID 1784 wrote to memory of 4632 1784 msedge.exe 87 PID 1784 wrote to memory of 4632 1784 msedge.exe 87 PID 1784 wrote to memory of 4632 1784 msedge.exe 87 PID 1784 wrote to memory of 4632 1784 msedge.exe 87 PID 1784 wrote to memory of 4632 1784 msedge.exe 87 PID 1784 wrote to memory of 4632 1784 msedge.exe 87 PID 1784 wrote to memory of 4632 1784 msedge.exe 87 PID 1784 wrote to memory of 4632 1784 msedge.exe 87 PID 1784 wrote to memory of 4632 1784 msedge.exe 87 PID 1784 wrote to memory of 4632 1784 msedge.exe 87 PID 1784 wrote to memory of 4632 1784 msedge.exe 87 PID 1784 wrote to memory of 5068 1784 msedge.exe 88 PID 1784 wrote to memory of 5068 1784 msedge.exe 88 PID 1784 wrote to memory of 4016 1784 msedge.exe 89 PID 1784 wrote to memory of 4016 1784 msedge.exe 89 PID 1784 wrote to memory of 4016 1784 msedge.exe 89 PID 1784 wrote to memory of 4016 1784 msedge.exe 89 PID 1784 wrote to memory of 4016 1784 msedge.exe 89 PID 1784 wrote to memory of 4016 1784 msedge.exe 89 PID 1784 wrote to memory of 4016 1784 msedge.exe 89 PID 1784 wrote to memory of 4016 1784 msedge.exe 89 PID 1784 wrote to memory of 4016 1784 msedge.exe 89 PID 1784 wrote to memory of 4016 1784 msedge.exe 89 PID 1784 wrote to memory of 4016 1784 msedge.exe 89 PID 1784 wrote to memory of 4016 1784 msedge.exe 89 PID 1784 wrote to memory of 4016 1784 msedge.exe 89 PID 1784 wrote to memory of 4016 1784 msedge.exe 89 PID 1784 wrote to memory of 4016 1784 msedge.exe 89 PID 1784 wrote to memory of 4016 1784 msedge.exe 89 PID 1784 wrote to memory of 4016 1784 msedge.exe 89 PID 1784 wrote to memory of 4016 1784 msedge.exe 89
Processes
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\Neo\rapidgator.net.url1⤵
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://rapidgator.net/account/registration/ref/43085862⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffed74f46f8,0x7ffed74f4708,0x7ffed74f47183⤵PID:2396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,6554175313356656758,16628601927274701759,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:23⤵PID:4632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,6554175313356656758,16628601927274701759,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:5068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,6554175313356656758,16628601927274701759,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:83⤵PID:4016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6554175313356656758,16628601927274701759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:13⤵PID:4664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6554175313356656758,16628601927274701759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:13⤵PID:384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6554175313356656758,16628601927274701759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:13⤵PID:3444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,6554175313356656758,16628601927274701759,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:83⤵PID:1604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,6554175313356656758,16628601927274701759,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6554175313356656758,16628601927274701759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:13⤵PID:2564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6554175313356656758,16628601927274701759,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:13⤵PID:4828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6554175313356656758,16628601927274701759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:13⤵PID:3180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6554175313356656758,16628601927274701759,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:13⤵PID:1800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,6554175313356656758,16628601927274701759,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4900 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:376
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3396
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3756
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD58dc45b70cbe29a357e2c376a0c2b751b
SHA125d623cea817f86b8427db53b82340410c1489b2
SHA256511cfb6bedbad2530b5cc5538b6ec2184fc4f85947ba4c8166d0bb9f5fe2703a
SHA5123ce0f52675feb16d6e62aae1c50767da178b93bdae28bacf6df3a2f72b8cc75b09c5092d9065e0872e5d09fd9ffe0c6931d6ae1943ddb1927b85d60659ef866e
-
Filesize
152B
MD51790c766c15938258a4f9b984cf68312
SHA115c9827d278d28b23a8ea0389d42fa87e404359f
SHA2562e3978bb58c701f3c6b05de9349b7334a194591bec7bcf73f53527dc0991dc63
SHA5122682d9c60c9d67608cf140b6ca4958d890bcbc3c8a8e95fcc639d2a11bb0ec348ca55ae99a5840e1f50e5c5bcf3e27c97fc877582d869d98cc4ea3448315aafb
-
Filesize
211KB
MD5151fb811968eaf8efb840908b89dc9d4
SHA17ec811009fd9b0e6d92d12d78b002275f2f1bee1
SHA256043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed
SHA51283aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize312B
MD56f681803f3b440f17eae635c79b621a4
SHA170f8d4449001e098634bac0b7653fd4bdd72277f
SHA256fd49f3deb49983c9cca3923439cd1d6711d9a8baaac74e21692b787dc19c0eb2
SHA5122afd86f0d322148b4835da3f0218a6fdbe005e84afb30cd165f3d5a7dd74c36b9822c32cea811402e0b75a82151bc1d8cc536455771634894ac4ef84c7b19edd
-
Filesize
1KB
MD55db470b6c1b8f78cf6d52cd97e0b5321
SHA1d5e4118478d77846b57c9bc6173c2ed24b1f886e
SHA256fe5475d5c14f4e9017e138f6f0f815a83d9765c50a64816ba2fdc0e1690eed56
SHA5128f52d7bb12811407b55413a5861de5eba15449ee06993c52216a9ccac30c60bcbc5c1e4995e19379e62f14933209e4a3d8048def54ccf0766829569d6f9900f3
-
Filesize
6KB
MD5703fc555ddc7e5ef939531e5cbe2ee8d
SHA1d11c1bec804c49a2af443d14f88a56206304aa83
SHA25632c14155aa3a2bfdd511f504157dc3a6a47f39afd4ce3de24ca58a3ad4575920
SHA5126a949872c5a52c534664e8ecad8f50b2d7d3d792ab708dc1048f22a8184ff7ffdafd22348e286bea7b158f41c782904ec4207d5ad09c30a10705448c143819f1
-
Filesize
7KB
MD5a4e95f79cde37b90d78a45822b91e8ef
SHA1faa1301a812aca078f884e7f027e4e1934011e42
SHA25629f6fbb276e635fb38525efc5254593480a413c9b99c1cd77593f74413ef06bb
SHA512a1ea5ffd9019589423af2bd1a169e0c80ccc54f7bd04cef5616ffbff2f6e3552f825bab6e623f6d8a76646eea46bccc5e9738afb661437f9e992cccfa992de5c
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD52180eaf3146cc4fdbeca85985126f707
SHA133cf6d0e59c2f4dcef86e4d86b85a76bdb89c385
SHA256af8fac699e9b35e89658120167a617d302ddcfc87606aa825c9657ed87e7334c
SHA512e391d7861926c1c9bd290b06b0e8b49e5d24d6e9d0abd07842d4b969da78269c42300450ea388228b93313461176bd4f340be363efc58e6fcce018c82c5da5ce