Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
70s -
max time network
21s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/10/2024, 06:51
Behavioral task
behavioral1
Sample
NeggyOnTop.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
NeggyOnTop.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
� �雹f.pyc
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
� �雹f.pyc
Resource
win10v2004-20241007-en
General
-
Target
NeggyOnTop.exe
-
Size
7.4MB
-
MD5
188c9f83383d23497f1a601b697a6344
-
SHA1
bfa3b440e130523ae41154c399830eb3e0e8f353
-
SHA256
0a74464ae44325751b528704e9ac6ff6b423085c5a509f9739a336325c9b9812
-
SHA512
b3ed1f33ac543f1b22fad5d1aeb402a0822f2d3c83be80d1d6f25eb7f14ddf424ea0abfc65c0595eaed4998b6782cee4fe37e2b737e59f0b35f334db131076f8
-
SSDEEP
196608:Vrcd0cDecLjv+bhqNVoBKUh8mz4Iv9Plu1D7AP:TieML+9qz8/b4IzuRAP
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2180 NeggyOnTop.exe -
resource yara_rule behavioral1/files/0x000500000001a42d-21.dat upx behavioral1/memory/2180-23-0x000007FEF5D30000-0x000007FEF6319000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2708 wrote to memory of 2180 2708 NeggyOnTop.exe 30 PID 2708 wrote to memory of 2180 2708 NeggyOnTop.exe 30 PID 2708 wrote to memory of 2180 2708 NeggyOnTop.exe 30
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD50b66c50e563d74188a1e96d6617261e8
SHA1cfd778b3794b4938e584078cbfac0747a8916d9e
SHA25602c665f77db6b255fc62f978aedbe2092b7ef1926836290da68fd838dbf2a9f2
SHA51237d710cb5c0ceb5957d11b61684cfbc65951c1d40ab560f3f3cb8feca42f9d43bd981a0ff44c3cb7562779264f18116723457e79e0e23852d7638b1a954a258f