Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

62106da826...e4.exe

windows7-x64

8

62106da826...e4.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/10/2022, 15:33 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    62106da8268c837614fe3639464fdfc1d55018819e4daeecd4507523cebd58e4.exe

  • Size

    447KB

  • MD5

    6e49cfba6ecb17375cfbe18ec29c4440

  • SHA1

    d7e4610cc880d42d0ffe978b72d9d032df3dbdda

  • SHA256

    62106da8268c837614fe3639464fdfc1d55018819e4daeecd4507523cebd58e4

  • SHA512

    eb82a3ead9067bac7d57e3ffaeab5eef1872ed86e9a206d58efb4e3a2b164f28a8e23a15bf9ea9718e928eed760f8f08f0e952f7d9705f1d7440dc4f7e42d663

  • SSDEEP

    12288:zK7a7KUexh62phxB7wyxGV6Z/4N49cCrd:LBe9tfGV6N4N4SQd

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\62106da8268c837614fe3639464fdfc1d55018819e4daeecd4507523cebd58e4.exe
    "C:\Users\Admin\AppData\Local\Temp\62106da8268c837614fe3639464fdfc1d55018819e4daeecd4507523cebd58e4.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4064
    • C:\Users\Admin\AppData\Local\Temp\DM\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\DM\installer.exe" /path="C:\Users\Admin\AppData\Local\Temp\62106da8268c837614fe3639464fdfc1d55018819e4daeecd4507523cebd58e4.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:4772

Network

  • flag-us
    DNS
    dtrack.secdls.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    dtrack.secdls.com
    IN A
    Response
    dtrack.secdls.com
    IN A
    127.0.0.1
  • flag-us
    DNS
    api.v2.secdls.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    api.v2.secdls.com
    IN A
    Response
    api.v2.secdls.com
    IN A
    127.0.0.1
  • flag-us
    DNS
    staticrr.paleokits.net
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    staticrr.paleokits.net
    IN A
    Response
  • flag-us
    DNS
    staticrr.sslsecure1.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    staticrr.sslsecure1.com
    IN A
    Response
    staticrr.sslsecure1.com
    IN A
    193.166.255.171
  • flag-us
    DNS
    staticrr.sslsecure2.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    staticrr.sslsecure2.com
    IN A
    Response
  • flag-us
    DNS
    staticrr.sslsecure3.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    staticrr.sslsecure3.com
    IN A
    Response
  • flag-us
    DNS
    staticrr.sslsecure4.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    staticrr.sslsecure4.com
    IN A
    Response
  • flag-us
    DNS
    staticrr.sslsecure5.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    staticrr.sslsecure5.com
    IN A
    Response
  • flag-us
    DNS
    staticrr.sslsecure6.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    staticrr.sslsecure6.com
    IN A
    Response
  • flag-us
    DNS
    staticrr.sslsecure7.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    staticrr.sslsecure7.com
    IN A
    Response
  • flag-us
    DNS
    staticrr.sslsecure8.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    staticrr.sslsecure8.com
    IN A
    Response
  • flag-us
    DNS
    staticrr.sslsecure9.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    staticrr.sslsecure9.com
    IN A
    Response
  • flag-us
    DNS
    staticrr.sslsecure10.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    staticrr.sslsecure10.com
    IN A
    Response
  • flag-us
    DNS
    track.v2.secdls.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    track.v2.secdls.com
    IN A
    Response
    track.v2.secdls.com
    IN A
    127.0.0.1
  • flag-us
    DNS
    track.v2.sslsecure1.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    track.v2.sslsecure1.com
    IN A
    Response
    track.v2.sslsecure1.com
    IN A
    193.166.255.171
  • flag-us
    DNS
    track.v2.sslsecure2.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    track.v2.sslsecure2.com
    IN A
  • flag-us
    DNS
    track.v2.sslsecure2.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    track.v2.sslsecure2.com
    IN A
  • flag-us
    DNS
    track.v2.sslsecure2.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    track.v2.sslsecure2.com
    IN A
  • flag-us
    DNS
    track.v2.sslsecure2.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    track.v2.sslsecure2.com
    IN A
  • flag-us
    DNS
    track.v2.sslsecure2.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    track.v2.sslsecure2.com
    IN A
  • flag-us
    DNS
    track.v2.sslsecure3.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    track.v2.sslsecure3.com
    IN A
  • flag-us
    DNS
    track.v2.sslsecure3.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    track.v2.sslsecure3.com
    IN A
  • flag-us
    DNS
    track.v2.sslsecure3.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    track.v2.sslsecure3.com
    IN A
  • flag-us
    DNS
    track.v2.sslsecure3.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    track.v2.sslsecure3.com
    IN A
  • flag-us
    DNS
    track.v2.sslsecure3.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    track.v2.sslsecure3.com
    IN A
  • flag-us
    DNS
    track.v2.sslsecure4.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    track.v2.sslsecure4.com
    IN A
    Response
  • flag-us
    DNS
    track.v2.sslsecure5.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    track.v2.sslsecure5.com
    IN A
    Response
  • flag-us
    DNS
    track.v2.sslsecure6.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    track.v2.sslsecure6.com
    IN A
    Response
  • flag-us
    DNS
    track.v2.sslsecure7.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    track.v2.sslsecure7.com
    IN A
    Response
  • flag-us
    DNS
    track.v2.sslsecure8.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    track.v2.sslsecure8.com
    IN A
    Response
  • flag-us
    DNS
    track.v2.sslsecure9.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    track.v2.sslsecure9.com
    IN A
    Response
  • flag-us
    DNS
    track.v2.sslsecure10.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    track.v2.sslsecure10.com
    IN A
    Response
  • flag-us
    DNS
    track.v2.sslsecure10.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    track.v2.sslsecure10.com
    IN A
    Response
  • flag-us
    DNS
    api.v2.sslsecure1.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    api.v2.sslsecure1.com
    IN A
    Response
    api.v2.sslsecure1.com
    IN A
    193.166.255.171
  • flag-us
    DNS
    api.v2.sslsecure1.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    api.v2.sslsecure1.com
    IN A
    Response
    api.v2.sslsecure1.com
    IN A
    193.166.255.171
  • flag-us
    DNS
    api.v2.sslsecure2.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    api.v2.sslsecure2.com
    IN A
    Response
  • flag-us
    DNS
    api.v2.sslsecure2.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    api.v2.sslsecure2.com
    IN A
    Response
  • flag-us
    DNS
    api.v2.sslsecure3.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    api.v2.sslsecure3.com
    IN A
    Response
  • flag-us
    DNS
    api.v2.sslsecure3.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    api.v2.sslsecure3.com
    IN A
    Response
  • flag-us
    DNS
    api.v2.sslsecure4.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    api.v2.sslsecure4.com
    IN A
    Response
  • flag-us
    DNS
    api.v2.sslsecure4.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    api.v2.sslsecure4.com
    IN A
    Response
  • flag-us
    DNS
    api.v2.sslsecure5.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    api.v2.sslsecure5.com
    IN A
    Response
  • flag-us
    DNS
    api.v2.sslsecure5.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    api.v2.sslsecure5.com
    IN A
    Response
  • flag-us
    DNS
    api.v2.sslsecure6.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    api.v2.sslsecure6.com
    IN A
    Response
  • flag-us
    DNS
    api.v2.sslsecure6.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    api.v2.sslsecure6.com
    IN A
    Response
  • flag-us
    DNS
    api.v2.sslsecure7.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    api.v2.sslsecure7.com
    IN A
    Response
  • flag-us
    DNS
    api.v2.sslsecure7.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    api.v2.sslsecure7.com
    IN A
    Response
  • flag-us
    DNS
    api.v2.sslsecure8.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    api.v2.sslsecure8.com
    IN A
    Response
  • flag-us
    DNS
    api.v2.sslsecure8.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    api.v2.sslsecure8.com
    IN A
    Response
  • flag-us
    DNS
    api.v2.sslsecure9.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    api.v2.sslsecure9.com
    IN A
    Response
  • flag-us
    DNS
    api.v2.sslsecure9.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    api.v2.sslsecure9.com
    IN A
    Response
  • flag-us
    DNS
    api.v2.sslsecure10.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    api.v2.sslsecure10.com
    IN A
    Response
  • flag-us
    DNS
    api.v2.sslsecure10.com
    installer.exe
    Remote address:
    8.8.8.8:53
    Request
    api.v2.sslsecure10.com
    IN A
    Response
  • 209.197.3.8:80
    260 B
     5
  • 209.197.3.8:80
    322 B
     7
  • 209.197.3.8:80
    322 B
     7
  • 127.0.0.1:80
    installer.exe
  • 127.0.0.1:80
    installer.exe
  • 127.0.0.1:80
    installer.exe
  • 209.197.3.8:80
    322 B
     7
  • 209.197.3.8:80
    322 B
     7
  • 193.166.255.171:80
    staticrr.sslsecure1.com
    installer.exe
    260 B
     5
  • 127.0.0.1:80
    installer.exe
  • 193.166.255.171:80
    track.v2.sslsecure1.com
    installer.exe
    260 B
     5
  • 104.80.225.205:443
    322 B
     7
  • 127.0.0.1:80
    installer.exe
  • 193.166.255.171:80
    api.v2.sslsecure1.com
    installer.exe
    260 B
     5
  • 127.0.0.1:80
    installer.exe
  • 127.0.0.1:80
    installer.exe
  • 127.0.0.1:80
    installer.exe
  • 193.166.255.171:80
    api.v2.sslsecure1.com
    installer.exe
    104 B
     2
  • 8.8.8.8:53
    dtrack.secdls.com
    dns
    installer.exe
    63 B
     79 B
     1
    1

    DNS Request

    dtrack.secdls.com

    DNS Response

    127.0.0.1

  • 8.8.8.8:53
    api.v2.secdls.com
    dns
    installer.exe
    63 B
     79 B
     1
    1

    DNS Request

    api.v2.secdls.com

    DNS Response

    127.0.0.1

  • 8.8.8.8:53
    staticrr.paleokits.net
    dns
    installer.exe
    68 B
     141 B
     1
    1

    DNS Request

    staticrr.paleokits.net

  • 8.8.8.8:53
    staticrr.sslsecure1.com
    dns
    installer.exe
    69 B
     85 B
     1
    1

    DNS Request

    staticrr.sslsecure1.com

    DNS Response

    193.166.255.171

  • 8.8.8.8:53
    staticrr.sslsecure2.com
    dns
    installer.exe
    69 B
     142 B
     1
    1

    DNS Request

    staticrr.sslsecure2.com

  • 8.8.8.8:53
    staticrr.sslsecure3.com
    dns
    installer.exe
    69 B
     142 B
     1
    1

    DNS Request

    staticrr.sslsecure3.com

  • 8.8.8.8:53
    staticrr.sslsecure4.com
    dns
    installer.exe
    69 B
     142 B
     1
    1

    DNS Request

    staticrr.sslsecure4.com

  • 8.8.8.8:53
    staticrr.sslsecure5.com
    dns
    installer.exe
    69 B
     142 B
     1
    1

    DNS Request

    staticrr.sslsecure5.com

  • 8.8.8.8:53
    staticrr.sslsecure6.com
    dns
    installer.exe
    69 B
     142 B
     1
    1

    DNS Request

    staticrr.sslsecure6.com

  • 8.8.8.8:53
    staticrr.sslsecure7.com
    dns
    installer.exe
    69 B
     142 B
     1
    1

    DNS Request

    staticrr.sslsecure7.com

  • 8.8.8.8:53
    staticrr.sslsecure8.com
    dns
    installer.exe
    69 B
     142 B
     1
    1

    DNS Request

    staticrr.sslsecure8.com

  • 8.8.8.8:53
    staticrr.sslsecure9.com
    dns
    installer.exe
    69 B
     142 B
     1
    1

    DNS Request

    staticrr.sslsecure9.com

  • 8.8.8.8:53
    staticrr.sslsecure10.com
    dns
    installer.exe
    70 B
     143 B
     1
    1

    DNS Request

    staticrr.sslsecure10.com

  • 8.8.8.8:53
    track.v2.secdls.com
    dns
    installer.exe
    65 B
     81 B
     1
    1

    DNS Request

    track.v2.secdls.com

    DNS Response

    127.0.0.1

  • 8.8.8.8:53
    track.v2.sslsecure1.com
    dns
    installer.exe
    69 B
     85 B
     1
    1

    DNS Request

    track.v2.sslsecure1.com

    DNS Response

    193.166.255.171

  • 8.8.8.8:53
    track.v2.sslsecure2.com
    dns
    installer.exe
    345 B
     5

    DNS Request

    track.v2.sslsecure2.com

    DNS Request

    track.v2.sslsecure2.com

    DNS Request

    track.v2.sslsecure2.com

    DNS Request

    track.v2.sslsecure2.com

    DNS Request

    track.v2.sslsecure2.com

  • 8.8.8.8:53
    track.v2.sslsecure3.com
    dns
    installer.exe
    345 B
     5

    DNS Request

    track.v2.sslsecure3.com

    DNS Request

    track.v2.sslsecure3.com

    DNS Request

    track.v2.sslsecure3.com

    DNS Request

    track.v2.sslsecure3.com

    DNS Request

    track.v2.sslsecure3.com

  • 8.8.8.8:53
    track.v2.sslsecure4.com
    dns
    installer.exe
    69 B
     142 B
     1
    1

    DNS Request

    track.v2.sslsecure4.com

  • 8.8.8.8:53
    track.v2.sslsecure5.com
    dns
    installer.exe
    69 B
     142 B
     1
    1

    DNS Request

    track.v2.sslsecure5.com

  • 8.8.8.8:53
    track.v2.sslsecure6.com
    dns
    installer.exe
    69 B
     142 B
     1
    1

    DNS Request

    track.v2.sslsecure6.com

  • 8.8.8.8:53
    track.v2.sslsecure7.com
    dns
    installer.exe
    69 B
     142 B
     1
    1

    DNS Request

    track.v2.sslsecure7.com

  • 8.8.8.8:53
    track.v2.sslsecure8.com
    dns
    installer.exe
    69 B
     142 B
     1
    1

    DNS Request

    track.v2.sslsecure8.com

  • 8.8.8.8:53
    track.v2.sslsecure9.com
    dns
    installer.exe
    69 B
     142 B
     1
    1

    DNS Request

    track.v2.sslsecure9.com

  • 8.8.8.8:53
    track.v2.sslsecure10.com
    dns
    installer.exe
    140 B
     286 B
     2
    2

    DNS Request

    track.v2.sslsecure10.com

    DNS Request

    track.v2.sslsecure10.com

  • 8.8.8.8:53
    api.v2.sslsecure1.com
    dns
    installer.exe
    134 B
     166 B
     2
    2

    DNS Request

    api.v2.sslsecure1.com

    DNS Request

    api.v2.sslsecure1.com

    DNS Response

    193.166.255.171

    DNS Response

    193.166.255.171

  • 8.8.8.8:53
    api.v2.sslsecure2.com
    dns
    installer.exe
    134 B
     280 B
     2
    2

    DNS Request

    api.v2.sslsecure2.com

    DNS Request

    api.v2.sslsecure2.com

  • 8.8.8.8:53
    api.v2.sslsecure3.com
    dns
    installer.exe
    134 B
     280 B
     2
    2

    DNS Request

    api.v2.sslsecure3.com

    DNS Request

    api.v2.sslsecure3.com

  • 8.8.8.8:53
    api.v2.sslsecure4.com
    dns
    installer.exe
    134 B
     280 B
     2
    2

    DNS Request

    api.v2.sslsecure4.com

    DNS Request

    api.v2.sslsecure4.com

  • 8.8.8.8:53
    api.v2.sslsecure5.com
    dns
    installer.exe
    134 B
     280 B
     2
    2

    DNS Request

    api.v2.sslsecure5.com

    DNS Request

    api.v2.sslsecure5.com

  • 8.8.8.8:53
    api.v2.sslsecure6.com
    dns
    installer.exe
    134 B
     280 B
     2
    2

    DNS Request

    api.v2.sslsecure6.com

    DNS Request

    api.v2.sslsecure6.com

  • 8.8.8.8:53
    api.v2.sslsecure7.com
    dns
    installer.exe
    134 B
     280 B
     2
    2

    DNS Request

    api.v2.sslsecure7.com

    DNS Request

    api.v2.sslsecure7.com

  • 8.8.8.8:53
    api.v2.sslsecure8.com
    dns
    installer.exe
    134 B
     280 B
     2
    2

    DNS Request

    api.v2.sslsecure8.com

    DNS Request

    api.v2.sslsecure8.com

  • 8.8.8.8:53
    api.v2.sslsecure9.com
    dns
    installer.exe
    134 B
     280 B
     2
    2

    DNS Request

    api.v2.sslsecure9.com

    DNS Request

    api.v2.sslsecure9.com

  • 8.8.8.8:53
    api.v2.sslsecure10.com
    dns
    installer.exe
    136 B
     282 B
     2
    2

    DNS Request

    api.v2.sslsecure10.com

    DNS Request

    api.v2.sslsecure10.com

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\DM\installer.exe
    Filesize

    5KB

    MD5

    a49a1a4d35ab32336d663198d886ac9e

    SHA1

    c066c32ef47f7f5c2ccdec882a1b3990cf5f19b8

    SHA256

    54bf47e5f09c0cc5ddbe0f2068952bf7931aed000dc4a48b588d8c538a9bea78

    SHA512

    224a35389bcfcce76809adcce71e45eb6f3d33d20a7ce02daad08a48345e74d06d4b116e5117ac4038bfbd1f0ee638c7331ab0a81b7b217f6eb0f43b1497d07d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\DM\parent.txt
    Filesize

    447KB

    MD5

    6e49cfba6ecb17375cfbe18ec29c4440

    SHA1

    d7e4610cc880d42d0ffe978b72d9d032df3dbdda

    SHA256

    62106da8268c837614fe3639464fdfc1d55018819e4daeecd4507523cebd58e4

    SHA512

    eb82a3ead9067bac7d57e3ffaeab5eef1872ed86e9a206d58efb4e3a2b164f28a8e23a15bf9ea9718e928eed760f8f08f0e952f7d9705f1d7440dc4f7e42d663

    Download Submit

  • memory/4772-134-0x00007FFC64250000-0x00007FFC64C86000-memory.dmp

    Filesize

    10.2MB

    Download

  • memory/4772-135-0x0000000000C3A000-0x0000000000C3F000-memory.dmp

    Filesize

    20KB

    Download

  • memory/4772-137-0x0000000000C3A000-0x0000000000C3F000-memory.dmp

    Filesize

    20KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.