Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

6

Static

static

4a8de4a38e...f7.exe

windows7-x64

6

4a8de4a38e...f7.exe

windows10-2004-x64

4

Analysis

  • max time kernel
    151s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/10/2022, 20:20 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4a8de4a38e12674b22e0b3d8bf94252cbfa9ddaee44073a2e6a7c4ff90df85f7.exe

  • Size

    221KB

  • MD5

    7249da0534baee9d0a498f37551c6b00

  • SHA1

    6a89ec121688fee0a59256ad06283c4c94154be1

  • SHA256

    4a8de4a38e12674b22e0b3d8bf94252cbfa9ddaee44073a2e6a7c4ff90df85f7

  • SHA512

    5391aabd9282650ca108a68c8ed26d931c995e739766848f9d5f35e34fc51065124f4da05a52bdf04ac3286528e3a35ff328e737e9872afc780af20a09a98413

  • SSDEEP

    3072:e5M3lniCYh/TZUZF+Jj6TmYvhoN4cm4GluCcPAquYgLXL01FGBgr3jNxKy1Ro42:Col7sNoSYvyCfQCY4YgjoAgrT/V2

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4a8de4a38e12674b22e0b3d8bf94252cbfa9ddaee44073a2e6a7c4ff90df85f7.exe
    "C:\Users\Admin\AppData\Local\Temp\4a8de4a38e12674b22e0b3d8bf94252cbfa9ddaee44073a2e6a7c4ff90df85f7.exe"
    1⤵
    • Drops file in Windows directory
    PID:4924

Network

  • flag-us
    DNS
    get-multiple.link
    4a8de4a38e12674b22e0b3d8bf94252cbfa9ddaee44073a2e6a7c4ff90df85f7.exe
    Remote address:
    8.8.8.8:53
    Request
    get-multiple.link
    IN A
    Response
    get-multiple.link
    IN A
    58.158.177.102
  • flag-us
    DNS
    allmodel-pro.com
    4a8de4a38e12674b22e0b3d8bf94252cbfa9ddaee44073a2e6a7c4ff90df85f7.exe
    Remote address:
    8.8.8.8:53
    Request
    allmodel-pro.com
    IN A
    Response
    allmodel-pro.com
    IN A
    193.166.255.171
  • flag-jp
    GET
    http://get-multiple.link/?q=1br3Fikbm%2BMIIFu2LFaDfKQev3uTW1%2Bygx05vRdbqEcXPqTYN3eCFn0hBewb5rsnNrgg1GT%2Bu2KC%2FBvJ2LmgdwUpZJqEmr2O7kgG4ioBuS%2Fn7ypXRIfINswsKMpU9AYRzLH4yJ0jHdf9U%2B0gsxQh%2B7Dq%2Fl3b1BpwpUVuf3PhpzZsem68IaYK2QB3hh2bC2bhF3khkPluD3KrjvMNf2NsScvZVOVdH6DDReNpGWhhIn8RTT3CzMYVrj9tUx7AdUgmMsPEnYut0z%2Fijouh8fUO0L464xMA6gOBDfulljB5dvmaw%2FVkgysM64faFAPP%2BcDCm4uacDJiBCtZuI3xA24lyGFXgheFnrO4jiNj0D6%2F%2BCy7SGlXGD07qxPOYeQCN3%2BXv
    4a8de4a38e12674b22e0b3d8bf94252cbfa9ddaee44073a2e6a7c4ff90df85f7.exe
    Remote address:
    58.158.177.102:80
    Request
    GET /?q=1br3Fikbm%2BMIIFu2LFaDfKQev3uTW1%2Bygx05vRdbqEcXPqTYN3eCFn0hBewb5rsnNrgg1GT%2Bu2KC%2FBvJ2LmgdwUpZJqEmr2O7kgG4ioBuS%2Fn7ypXRIfINswsKMpU9AYRzLH4yJ0jHdf9U%2B0gsxQh%2B7Dq%2Fl3b1BpwpUVuf3PhpzZsem68IaYK2QB3hh2bC2bhF3khkPluD3KrjvMNf2NsScvZVOVdH6DDReNpGWhhIn8RTT3CzMYVrj9tUx7AdUgmMsPEnYut0z%2Fijouh8fUO0L464xMA6gOBDfulljB5dvmaw%2FVkgysM64faFAPP%2BcDCm4uacDJiBCtZuI3xA24lyGFXgheFnrO4jiNj0D6%2F%2BCy7SGlXGD07qxPOYeQCN3%2BXv HTTP/1.1
    Accept: */*
    User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.143 Safari/537.36
    Host: get-multiple.link
    Response
    HTTP/1.1 200 OK
    Date: Thu, 20 Oct 2022 23:16:52 GMT
    Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips
    Last-Modified: Mon, 30 Nov 2015 13:48:40 GMT
    ETag: "9-525c24c725e00"
    Accept-Ranges: bytes
    Content-Length: 9
    Content-Type: text/html; charset=UTF-8
  • flag-us
    DNS
    226.101.242.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    226.101.242.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    9.9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.2.0.0.0.0.2.0.1.3.0.6.2.ip6.arpa
    Remote address:
    8.8.8.8:53
    Request
    9.9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.2.0.0.0.0.2.0.1.3.0.6.2.ip6.arpa
    IN PTR
    Response
  • 193.166.255.171:80
    allmodel-pro.com
    4a8de4a38e12674b22e0b3d8bf94252cbfa9ddaee44073a2e6a7c4ff90df85f7.exe
    260 B
     5
  • 58.158.177.102:80
    http://get-multiple.link/?q=1br3Fikbm%2BMIIFu2LFaDfKQev3uTW1%2Bygx05vRdbqEcXPqTYN3eCFn0hBewb5rsnNrgg1GT%2Bu2KC%2FBvJ2LmgdwUpZJqEmr2O7kgG4ioBuS%2Fn7ypXRIfINswsKMpU9AYRzLH4yJ0jHdf9U%2B0gsxQh%2B7Dq%2Fl3b1BpwpUVuf3PhpzZsem68IaYK2QB3hh2bC2bhF3khkPluD3KrjvMNf2NsScvZVOVdH6DDReNpGWhhIn8RTT3CzMYVrj9tUx7AdUgmMsPEnYut0z%2Fijouh8fUO0L464xMA6gOBDfulljB5dvmaw%2FVkgysM64faFAPP%2BcDCm4uacDJiBCtZuI3xA24lyGFXgheFnrO4jiNj0D6%2F%2BCy7SGlXGD07qxPOYeQCN3%2BXv
    http
    4a8de4a38e12674b22e0b3d8bf94252cbfa9ddaee44073a2e6a7c4ff90df85f7.exe
    1.5kB
     440 B
     7
    4

    HTTP Request

    GET http://get-multiple.link/?q=1br3Fikbm%2BMIIFu2LFaDfKQev3uTW1%2Bygx05vRdbqEcXPqTYN3eCFn0hBewb5rsnNrgg1GT%2Bu2KC%2FBvJ2LmgdwUpZJqEmr2O7kgG4ioBuS%2Fn7ypXRIfINswsKMpU9AYRzLH4yJ0jHdf9U%2B0gsxQh%2B7Dq%2Fl3b1BpwpUVuf3PhpzZsem68IaYK2QB3hh2bC2bhF3khkPluD3KrjvMNf2NsScvZVOVdH6DDReNpGWhhIn8RTT3CzMYVrj9tUx7AdUgmMsPEnYut0z%2Fijouh8fUO0L464xMA6gOBDfulljB5dvmaw%2FVkgysM64faFAPP%2BcDCm4uacDJiBCtZuI3xA24lyGFXgheFnrO4jiNj0D6%2F%2BCy7SGlXGD07qxPOYeQCN3%2BXv

    HTTP Response

    200
  • 93.184.220.29:80
    322 B
     7
  • 95.101.78.82:80
    322 B
     7
  • 95.101.78.82:80
    322 B
     7
  • 104.80.225.205:443
    322 B
     7
  • 93.184.220.29:80
    46 B
     40 B
     1
    1
  • 51.11.192.48:443
    322 B
     7
  • 93.184.220.29:80
    260 B
     5
  • 209.197.3.8:80
    322 B
     7
  • 209.197.3.8:80
    322 B
     7
  • 209.197.3.8:80
    322 B
     7
  • 209.197.3.8:80
    260 B
     5
  • 209.197.3.8:80
    260 B
     5
  • 8.248.5.254:80
  • 8.8.8.8:53
    get-multiple.link
    dns
    4a8de4a38e12674b22e0b3d8bf94252cbfa9ddaee44073a2e6a7c4ff90df85f7.exe
    63 B
     79 B
     1
    1

    DNS Request

    get-multiple.link

    DNS Response

    58.158.177.102

  • 8.8.8.8:53
    allmodel-pro.com
    dns
    4a8de4a38e12674b22e0b3d8bf94252cbfa9ddaee44073a2e6a7c4ff90df85f7.exe
    62 B
     78 B
     1
    1

    DNS Request

    allmodel-pro.com

    DNS Response

    193.166.255.171

  • 8.8.8.8:53
    226.101.242.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    226.101.242.52.in-addr.arpa

  • 8.8.8.8:53
    9.9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.2.0.0.0.0.2.0.1.3.0.6.2.ip6.arpa
    dns
    118 B
     204 B
     1
    1

    DNS Request

    9.9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.2.0.0.0.0.2.0.1.3.0.6.2.ip6.arpa

  • 8.8.8.8:53

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4924-132-0x0000000000CD0000-0x0000000000CFF000-memory.dmp

    Filesize

    188KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.