Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

1

Static

static

SpyoSecure...rs.exe

windows7-x64

1

SpyoSecure...rs.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    84s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/09/2022, 19:34 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SpyoSecure Ransomware Decryptors.exe

  • Size

    235KB

  • MD5

    6037c626f5e71622d27eb4a9edfc8db7

  • SHA1

    0b9d328d9dbdff7c500a2bebde9f0489239b849b

  • SHA256

    caf139324bf28f864292f679eec441f2477dba9e132c0cfe9547c0394a40ee05

  • SHA512

    96c2460e6970fc73c81d75fdab38946af83ceffe202a528658feabf7cebb13c0ff5846024d83c8aa8c235fc3d88d8260fabf3f8184ce85f0b45d2bd8856792dd

  • SSDEEP

    1536:O73/1F9WZqH3Rh5GoNjtrhJlCCj4nQcPd8jWuxSKTMINWmZNif7eSdiN00:O79yqHBh5GoX9J5v+xEjIv0

Score
1/10

Malware Config

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\SpyoSecure Ransomware Decryptors.exe
    "C:\Users\Admin\AppData\Local\Temp\SpyoSecure Ransomware Decryptors.exe"
    1⤵
      PID:2168

    Network

    • flag-us
      DNS
      segments-s.msedge.net
      Remote address:
      8.8.8.8:53
      Request
      segments-s.msedge.net
      IN A
      Response
      segments-s.msedge.net
      IN CNAME
      segments.s-msedge.net
      segments.s-msedge.net
      IN CNAME
      Edge-Prod-AMS04r5b.env.segments.s-msedge.net
      Edge-Prod-AMS04r5b.env.segments.s-msedge.net
      IN CNAME
      global.segments.s-msedge.net
      global.segments.s-msedge.net
      IN CNAME
      segments.s-9999.s-msedge.net
      segments.s-9999.s-msedge.net
      IN CNAME
      s-9999.s-msedge.net
      s-9999.s-msedge.net
      IN A
      13.107.3.254
    • flag-us
      GET
      https://segments-s.msedge.net/apc/trans.gif?025fbdeeb3d3f2ce8abffd84fc3a380f
      Remote address:
      13.107.3.254:443
      Request
      GET /apc/trans.gif?025fbdeeb3d3f2ce8abffd84fc3a380f HTTP/2.0
      host: segments-s.msedge.net
      referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init
      accept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
      accept-language: en-US
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.2.19041; 10.0.0.0.19041.1288) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: no-cache, no-store, must-revalidate
      content-length: 43
      content-type: image/gif
      last-modified: Tue, 13 Sep 2022 14:17:33 GMT
      accept-ranges: bytes
      etag: 0x0DA2C2C0C44B11E89E6C66FF4F731D7D
      access-control-allow-origin: *
      access-control-expose-headers: X-EndPoint, X-FrontEnd, X-UserHostAddress, X-MSEdge-Ref, X-MachineName
      timing-allow-origin: *
      x-content-type-options: nosniff
      x-endpoint: AMS04r5d
      x-frontend: AFD
      x-machinename: AMS04EDGE2812
      x-userhostaddress: 154.61.71.0
      x-cache: CONFIG_NOCACHE
      x-msedge-ref: Ref A: 015EE0F178AC4CE8BD8DD7A2DA4103AE Ref B: AMS04EDGE2812 Ref C: 2022-09-24T19:36:44Z
      date: Sat, 24 Sep 2022 19:36:44 GMT
    • flag-us
      GET
      https://segments-s.msedge.net/apc/trans.gif?c37c401d928725560c4753f28a5d58e3
      Remote address:
      13.107.3.254:443
      Request
      GET /apc/trans.gif?c37c401d928725560c4753f28a5d58e3 HTTP/2.0
      host: segments-s.msedge.net
      referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init
      accept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
      accept-language: en-US
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.2.19041; 10.0.0.0.19041.1288) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: no-cache, no-store, must-revalidate
      content-length: 43
      content-type: image/gif
      last-modified: Tue, 13 Sep 2022 14:17:33 GMT
      accept-ranges: bytes
      etag: 0x0DA2C2C0C44B11E89E6C66FF4F731D7D
      access-control-allow-origin: *
      access-control-expose-headers: X-EndPoint, X-FrontEnd, X-UserHostAddress, X-MSEdge-Ref, X-MachineName
      timing-allow-origin: *
      x-content-type-options: nosniff
      x-endpoint: AMS04r5d
      x-frontend: AFD
      x-machinename: AMS04EDGE2812
      x-userhostaddress: 154.61.71.0
      x-cache: CONFIG_NOCACHE
      x-msedge-ref: Ref A: B6777528BECB4E20970A80B26B75027C Ref B: AMS04EDGE2812 Ref C: 2022-09-24T19:36:44Z
      date: Sat, 24 Sep 2022 19:36:44 GMT
    • flag-us
      DNS
      fp-vp-nocache.azureedge.net
      Remote address:
      8.8.8.8:53
      Request
      fp-vp-nocache.azureedge.net
      IN A
      Response
      fp-vp-nocache.azureedge.net
      IN CNAME
      fp-vp-nocache.ec.azureedge.net
      fp-vp-nocache.ec.azureedge.net
      IN CNAME
      cs9.wpc.v0cdn.net
      cs9.wpc.v0cdn.net
      IN A
      72.21.81.200
    • flag-us
      GET
      https://fp-vp-nocache.azureedge.net/apc/trans.gif?af999370017b958a7996726ee76c03af
      Remote address:
      72.21.81.200:443
      Request
      GET /apc/trans.gif?af999370017b958a7996726ee76c03af HTTP/2.0
      host: fp-vp-nocache.azureedge.net
      referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init
      accept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
      accept-language: en-US
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.2.19041; 10.0.0.0.19041.1288) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      access-control-allow-origin: *
      access-control-expose-headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-CbModifiedTime,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
      cache-control: s-maxage=86400
      content-md5: MlRyYBVx8x4b8AZ0w2jTNQ==
      content-type: image/gif
      date: Sat, 24 Sep 2022 19:36:44 GMT
      etag: 0x8D57E3C9594BD94
      last-modified: Tue, 27 Feb 2018 23:48:21 GMT
      server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
      x-azure-ref: 0TVwvYwAAAADP8KttXhmfQq2mTJ62s/gjRVdSMzExMDAwMTEwMDMxADg0NTc1NjhlLWFmNGItNGZhMC04ZTcwLWZiNTFkMzVlY2I0Yg==
      x-azure-ref-originshield: 0GsYuYwAAAABuCQxfNjiFTpvff9SR/cArRVdSMzBFREdFMDUxNQA4NDU3NTY4ZS1hZjRiLTRmYTAtOGU3MC1mYjUxZDM1ZWNiNGI=
      x-cache: TCP_HIT
      x-ms-blob-type: BlockBlob
      x-ms-lease-status: unlocked
      x-ms-meta-cbmodifiedtime: Mon, 08 Feb 2016 20:57:42 GMT
      x-ms-request-id: 04390059-801e-0032-30a5-cf1fdd000000
      x-ms-version: 2009-09-19
      content-length: 43
    • flag-us
      GET
      https://fp-vp-nocache.azureedge.net/apc/trans.gif?d2ee7a48d56cc75a853ffa63d4d52854
      Remote address:
      72.21.81.200:443
      Request
      GET /apc/trans.gif?d2ee7a48d56cc75a853ffa63d4d52854 HTTP/2.0
      host: fp-vp-nocache.azureedge.net
      referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init
      accept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
      accept-language: en-US
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.2.19041; 10.0.0.0.19041.1288) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      access-control-allow-origin: *
      access-control-expose-headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-CbModifiedTime,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
      cache-control: s-maxage=86400
      content-md5: MlRyYBVx8x4b8AZ0w2jTNQ==
      content-type: image/gif
      date: Sat, 24 Sep 2022 19:36:44 GMT
      etag: 0x8D57E3C9594BD94
      last-modified: Tue, 27 Feb 2018 23:48:21 GMT
      server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
      x-azure-ref: 0TVwvYwAAAABPtDqg7asuRJ1seRc+nNabRVdSMzExMDAwMTA5MDExADg0NTc1NjhlLWFmNGItNGZhMC04ZTcwLWZiNTFkMzVlY2I0Yg==
      x-azure-ref-originshield: 0M0MuYwAAAACfkq8vCDubTa3frHfbAc0rRVdSMzBFREdFMDYwOAA4NDU3NTY4ZS1hZjRiLTRmYTAtOGU3MC1mYjUxZDM1ZWNiNGI=
      x-cache: TCP_HIT
      x-ms-blob-type: BlockBlob
      x-ms-lease-status: unlocked
      x-ms-meta-cbmodifiedtime: Mon, 08 Feb 2016 20:57:42 GMT
      x-ms-request-id: 04390059-801e-0032-30a5-cf1fdd000000
      x-ms-version: 2009-09-19
      content-length: 43
    • 209.197.3.8:80
      322 B
       7
    • 2.18.109.224:443
      322 B
       7
    • 209.197.3.8:80
      322 B
       7
    • 209.197.3.8:80
      322 B
       7
    • 204.79.197.200:443
      www.bing.com
      tls, https
      4.5kB
       8.9kB
       24
      23
    • 13.107.3.254:443
      https://segments-s.msedge.net/apc/trans.gif?c37c401d928725560c4753f28a5d58e3
      tls, http2
      1.8kB
       8.2kB
       20
      19

      HTTP Request

      GET https://segments-s.msedge.net/apc/trans.gif?025fbdeeb3d3f2ce8abffd84fc3a380f

      HTTP Response

      200

      HTTP Request

      GET https://segments-s.msedge.net/apc/trans.gif?c37c401d928725560c4753f28a5d58e3

      HTTP Response

      200
    • 72.21.81.200:443
      https://fp-vp-nocache.azureedge.net/apc/trans.gif?d2ee7a48d56cc75a853ffa63d4d52854
      tls, http2
      1.8kB
       9.6kB
       21
      20

      HTTP Request

      GET https://fp-vp-nocache.azureedge.net/apc/trans.gif?af999370017b958a7996726ee76c03af

      HTTP Response

      200

      HTTP Request

      GET https://fp-vp-nocache.azureedge.net/apc/trans.gif?d2ee7a48d56cc75a853ffa63d4d52854

      HTTP Response

      200
    • 8.8.8.8:53
      segments-s.msedge.net
      dns
      67 B
       217 B
       1
      1

      DNS Request

      segments-s.msedge.net

      DNS Response

      13.107.3.254

    • 8.8.8.8:53
      fp-vp-nocache.azureedge.net
      dns
      73 B
       148 B
       1
      1

      DNS Request

      fp-vp-nocache.azureedge.net

      DNS Response

      72.21.81.200

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2168-132-0x0000000000850000-0x00000000008A1000-memory.dmp

      Filesize

      324KB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.