Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

6

Static

static

b1bf531c2c...b4.exe

windows7-x64

6

b1bf531c2c...b4.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    44s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    31/10/2022, 00:45 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b1bf531c2c7adaff039a0a7cdbe8829b8811d45047b2a6e854cc94bcf93cbcb4.exe

  • Size

    308KB

  • MD5

    a128d5c2e1863600046547c87486abee

  • SHA1

    de95b99994f744d426a45ef2672a129830e645c1

  • SHA256

    b1bf531c2c7adaff039a0a7cdbe8829b8811d45047b2a6e854cc94bcf93cbcb4

  • SHA512

    ad19df8bc02b0975e3e4e8a565e82abb9a3786d5d274b17c77ba014dc198ac0dc1e2e2d1bc8544b3afe3ce5ddd514270dacd2e0d0a3abf3c93fed0edf4b6aa84

  • SSDEEP

    6144:eQbpP+lR74jyQZdo5V/0G1sxYcy2zowLtema:eiJ+P7sXY0/xhLtema

Score
6/10
discovery

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in Windows directory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b1bf531c2c7adaff039a0a7cdbe8829b8811d45047b2a6e854cc94bcf93cbcb4.exe
    "C:\Users\Admin\AppData\Local\Temp\b1bf531c2c7adaff039a0a7cdbe8829b8811d45047b2a6e854cc94bcf93cbcb4.exe"
    1⤵
    • Maps connected drives based on registry
    • Drops file in Windows directory
    PID:1440

Network

  • flag-us
    DNS
    allmodel-pro.com
    b1bf531c2c7adaff039a0a7cdbe8829b8811d45047b2a6e854cc94bcf93cbcb4.exe
    Remote address:
    8.8.8.8:53
    Request
    allmodel-pro.com
    IN A
    Response
    allmodel-pro.com
    IN A
    193.166.255.171
  • flag-us
    DNS
    centerweb.link
    b1bf531c2c7adaff039a0a7cdbe8829b8811d45047b2a6e854cc94bcf93cbcb4.exe
    Remote address:
    8.8.8.8:53
    Request
    centerweb.link
    IN A
    Response
    centerweb.link
    IN A
    58.158.177.102
  • flag-us
    DNS
    allallstate.com
    b1bf531c2c7adaff039a0a7cdbe8829b8811d45047b2a6e854cc94bcf93cbcb4.exe
    Remote address:
    8.8.8.8:53
    Request
    allallstate.com
    IN A
    Response
  • flag-us
    DNS
    casefun.link
    b1bf531c2c7adaff039a0a7cdbe8829b8811d45047b2a6e854cc94bcf93cbcb4.exe
    Remote address:
    8.8.8.8:53
    Request
    casefun.link
    IN A
    Response
  • 58.158.177.102:80
    centerweb.link
    b1bf531c2c7adaff039a0a7cdbe8829b8811d45047b2a6e854cc94bcf93cbcb4.exe
    152 B
     3
  • 193.166.255.171:80
    allmodel-pro.com
    b1bf531c2c7adaff039a0a7cdbe8829b8811d45047b2a6e854cc94bcf93cbcb4.exe
    152 B
     3
  • 8.8.8.8:53
    allmodel-pro.com
    dns
    b1bf531c2c7adaff039a0a7cdbe8829b8811d45047b2a6e854cc94bcf93cbcb4.exe
    62 B
     78 B
     1
    1

    DNS Request

    allmodel-pro.com

    DNS Response

    193.166.255.171

  • 8.8.8.8:53
    centerweb.link
    dns
    b1bf531c2c7adaff039a0a7cdbe8829b8811d45047b2a6e854cc94bcf93cbcb4.exe
    60 B
     76 B
     1
    1

    DNS Request

    centerweb.link

    DNS Response

    58.158.177.102

  • 8.8.8.8:53
    allallstate.com
    dns
    b1bf531c2c7adaff039a0a7cdbe8829b8811d45047b2a6e854cc94bcf93cbcb4.exe
    61 B
     134 B
     1
    1

    DNS Request

    allallstate.com

  • 8.8.8.8:53
    casefun.link
    dns
    b1bf531c2c7adaff039a0a7cdbe8829b8811d45047b2a6e854cc94bcf93cbcb4.exe
    58 B
     131 B
     1
    1

    DNS Request

    casefun.link

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1440-54-0x0000000076181000-0x0000000076183000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1440-55-0x0000000000350000-0x000000000037F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/1440-59-0x0000000003520000-0x0000000003547000-memory.dmp

    Filesize

    156KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.