Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
07/11/2022, 09:42 UTC
General
-
Target
ab6fe618e09399709a8337cce0fcd8fa233144283681a10d7c7eac475d79c07f.exe
-
Size
476KB
-
MD5
89c4bf7297f085059f17b0ba1aa9c28d
-
SHA1
f745c646fdf028af68934ed508ea59196690c6d6
-
SHA256
ab6fe618e09399709a8337cce0fcd8fa233144283681a10d7c7eac475d79c07f
-
SHA512
3b4e5f9fb6440d8ca00d6c186cf8d8a541705d27b2e2e293c8742a54c531f73d23a6e1bd4a99d9a327b8f71aa95b8887df336c48844d8427946517ca6f3241e9
-
SSDEEP
12288:st5AZ4CH2jUyobbWxLxKveZt/nNrV7LS8W:5Z4CWonixKverN9ZW
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab6fe618e09399709a8337cce0fcd8fa233144283681a10d7c7eac475d79c07f.exe"C:\Users\Admin\AppData\Local\Temp\ab6fe618e09399709a8337cce0fcd8fa233144283681a10d7c7eac475d79c07f.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\izsilaivzltjlbd.exe"C:\Users\Admin\AppData\Local\Temp\\izsilaivzltjlbd.exe"2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
-
DNSdtrack.secdls.comRemote address:8.8.8.8:53Requestdtrack.secdls.comIN AResponse -
DNSdtrack.secdls.comRemote address:8.8.8.8:53Requestdtrack.secdls.comIN AResponsedtrack.secdls.comIN A127.0.0.1
-
DNSapi.v2.secdls.comRemote address:8.8.8.8:53Requestapi.v2.secdls.comIN AResponseapi.v2.secdls.comIN A127.0.0.1
-
DNSstaticrr.paleokits.netRemote address:8.8.8.8:53Requeststaticrr.paleokits.netIN AResponse
-
DNSstaticrr.sslsecure1.comRemote address:8.8.8.8:53Requeststaticrr.sslsecure1.comIN AResponsestaticrr.sslsecure1.comIN A193.166.255.171
-
DNSstaticrr.sslsecure2.comRemote address:8.8.8.8:53Requeststaticrr.sslsecure2.comIN AResponse
-
DNSstaticrr.sslsecure3.comRemote address:8.8.8.8:53Requeststaticrr.sslsecure3.comIN AResponse
-
DNSstaticrr.sslsecure4.comRemote address:8.8.8.8:53Requeststaticrr.sslsecure4.comIN AResponse
-
DNSstaticrr.sslsecure5.comRemote address:8.8.8.8:53Requeststaticrr.sslsecure5.comIN AResponse
-
DNSstaticrr.sslsecure6.comRemote address:8.8.8.8:53Requeststaticrr.sslsecure6.comIN AResponse
-
DNSstaticrr.sslsecure7.comRemote address:8.8.8.8:53Requeststaticrr.sslsecure7.comIN AResponse
-
DNSstaticrr.sslsecure8.comRemote address:8.8.8.8:53Requeststaticrr.sslsecure8.comIN AResponse
-
DNSstaticrr.sslsecure9.comRemote address:8.8.8.8:53Requeststaticrr.sslsecure9.comIN AResponse
-
DNSstaticrr.sslsecure10.comRemote address:8.8.8.8:53Requeststaticrr.sslsecure10.comIN AResponse
-
DNStrack.v2.secdls.comRemote address:8.8.8.8:53Requesttrack.v2.secdls.comIN AResponsetrack.v2.secdls.comIN A127.0.0.1
-
DNStrack.v2.sslsecure1.comRemote address:8.8.8.8:53Requesttrack.v2.sslsecure1.comIN AResponsetrack.v2.sslsecure1.comIN A193.166.255.171
-
DNStrack.v2.sslsecure2.comRemote address:8.8.8.8:53Requesttrack.v2.sslsecure2.comIN AResponse
-
DNStrack.v2.sslsecure3.comRemote address:8.8.8.8:53Requesttrack.v2.sslsecure3.comIN AResponse
-
DNStrack.v2.sslsecure4.comRemote address:8.8.8.8:53Requesttrack.v2.sslsecure4.comIN AResponse
-
DNStrack.v2.sslsecure5.comRemote address:8.8.8.8:53Requesttrack.v2.sslsecure5.comIN AResponse
-
DNStrack.v2.sslsecure6.comRemote address:8.8.8.8:53Requesttrack.v2.sslsecure6.comIN AResponse
-
DNStrack.v2.sslsecure7.comRemote address:8.8.8.8:53Requesttrack.v2.sslsecure7.comIN AResponse
-
DNStrack.v2.sslsecure8.comRemote address:8.8.8.8:53Requesttrack.v2.sslsecure8.comIN AResponse
-
DNStrack.v2.sslsecure9.comRemote address:8.8.8.8:53Requesttrack.v2.sslsecure9.comIN AResponse
-
DNStrack.v2.sslsecure10.comRemote address:8.8.8.8:53Requesttrack.v2.sslsecure10.comIN AResponse
-
DNSapi.v2.sslsecure1.comRemote address:8.8.8.8:53Requestapi.v2.sslsecure1.comIN AResponseapi.v2.sslsecure1.comIN A193.166.255.171
-
DNSapi.v2.sslsecure2.comRemote address:8.8.8.8:53Requestapi.v2.sslsecure2.comIN AResponse
-
DNSapi.v2.sslsecure3.comRemote address:8.8.8.8:53Requestapi.v2.sslsecure3.comIN AResponse
-
DNSapi.v2.sslsecure4.comRemote address:8.8.8.8:53Requestapi.v2.sslsecure4.comIN AResponse
-
DNSapi.v2.sslsecure5.comRemote address:8.8.8.8:53Requestapi.v2.sslsecure5.comIN AResponse
-
DNSapi.v2.sslsecure6.comRemote address:8.8.8.8:53Requestapi.v2.sslsecure6.comIN AResponse
-
DNSapi.v2.sslsecure7.comRemote address:8.8.8.8:53Requestapi.v2.sslsecure7.comIN AResponse
-
DNSapi.v2.sslsecure8.comRemote address:8.8.8.8:53Requestapi.v2.sslsecure8.comIN AResponse
-
DNSapi.v2.sslsecure9.comRemote address:8.8.8.8:53Requestapi.v2.sslsecure9.comIN AResponse
-
DNSapi.v2.sslsecure10.comRemote address:8.8.8.8:53Requestapi.v2.sslsecure10.comIN AResponse
-
127.0.0.1:80 -
127.0.0.1:80
-
127.0.0.1:80
-
127.0.0.1:80
-
193.166.255.171:80staticrr.sslsecure1.com -
127.0.0.1:80
-
193.166.255.171:80track.v2.sslsecure1.com
-
127.0.0.1:80
-
193.166.255.171:80api.v2.sslsecure1.com
-
127.0.0.1:80
-
127.0.0.1:80
-
127.0.0.1:80
-
193.166.255.171:80api.v2.sslsecure1.com
-
127.0.0.1:80
-
127.0.0.1:80
-
193.166.255.171:80api.v2.sslsecure1.com
-
8.8.8.8:53dtrack.secdls.comdns
DNS Request
dtrack.secdls.com
DNS Request
dtrack.secdls.com
DNS Response
127.0.0.1
-
8.8.8.8:53api.v2.secdls.comdns
DNS Request
api.v2.secdls.com
DNS Response
127.0.0.1
-
8.8.8.8:53staticrr.paleokits.netdns
DNS Request
staticrr.paleokits.net
-
8.8.8.8:53staticrr.sslsecure1.comdns
DNS Request
staticrr.sslsecure1.com
DNS Response
193.166.255.171
-
8.8.8.8:53staticrr.sslsecure2.comdns
DNS Request
staticrr.sslsecure2.com
-
8.8.8.8:53staticrr.sslsecure3.comdns
DNS Request
staticrr.sslsecure3.com
-
8.8.8.8:53staticrr.sslsecure4.comdns
DNS Request
staticrr.sslsecure4.com
-
8.8.8.8:53staticrr.sslsecure5.comdns
DNS Request
staticrr.sslsecure5.com
-
8.8.8.8:53staticrr.sslsecure6.comdns
DNS Request
staticrr.sslsecure6.com
-
8.8.8.8:53staticrr.sslsecure7.comdns
DNS Request
staticrr.sslsecure7.com
-
8.8.8.8:53staticrr.sslsecure8.comdns
DNS Request
staticrr.sslsecure8.com
-
8.8.8.8:53staticrr.sslsecure9.comdns
DNS Request
staticrr.sslsecure9.com
-
8.8.8.8:53staticrr.sslsecure10.comdns
DNS Request
staticrr.sslsecure10.com
-
8.8.8.8:53track.v2.secdls.comdns
DNS Request
track.v2.secdls.com
DNS Response
127.0.0.1
-
8.8.8.8:53track.v2.sslsecure1.comdns
DNS Request
track.v2.sslsecure1.com
DNS Response
193.166.255.171
-
8.8.8.8:53track.v2.sslsecure2.comdns
DNS Request
track.v2.sslsecure2.com
-
8.8.8.8:53track.v2.sslsecure3.comdns
DNS Request
track.v2.sslsecure3.com
-
8.8.8.8:53track.v2.sslsecure4.comdns
DNS Request
track.v2.sslsecure4.com
-
8.8.8.8:53track.v2.sslsecure5.comdns
DNS Request
track.v2.sslsecure5.com
-
8.8.8.8:53track.v2.sslsecure6.comdns
DNS Request
track.v2.sslsecure6.com
-
8.8.8.8:53track.v2.sslsecure7.comdns
DNS Request
track.v2.sslsecure7.com
-
8.8.8.8:53track.v2.sslsecure8.comdns
DNS Request
track.v2.sslsecure8.com
-
8.8.8.8:53track.v2.sslsecure9.comdns
DNS Request
track.v2.sslsecure9.com
-
8.8.8.8:53track.v2.sslsecure10.comdns
DNS Request
track.v2.sslsecure10.com
-
8.8.8.8:53api.v2.sslsecure1.comdns
DNS Request
api.v2.sslsecure1.com
DNS Response
193.166.255.171
-
8.8.8.8:53api.v2.sslsecure2.comdns
DNS Request
api.v2.sslsecure2.com
-
8.8.8.8:53api.v2.sslsecure3.comdns
DNS Request
api.v2.sslsecure3.com
-
8.8.8.8:53api.v2.sslsecure4.comdns
DNS Request
api.v2.sslsecure4.com
-
8.8.8.8:53api.v2.sslsecure5.comdns
DNS Request
api.v2.sslsecure5.com
-
8.8.8.8:53api.v2.sslsecure6.comdns
DNS Request
api.v2.sslsecure6.com
-
8.8.8.8:53api.v2.sslsecure7.comdns
DNS Request
api.v2.sslsecure7.com
-
8.8.8.8:53api.v2.sslsecure8.comdns
DNS Request
api.v2.sslsecure8.com
-
8.8.8.8:53api.v2.sslsecure9.comdns
DNS Request
api.v2.sslsecure9.com
-
8.8.8.8:53api.v2.sslsecure10.comdns
DNS Request
api.v2.sslsecure10.com
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5bded699ccef883840badce58f804d7f8
SHA124af43a1d9718fe780b5d9ae6827217c0e642adf
SHA256882a8bc0d59d5a6b25dd92d301ab47427db727cce84d37b299bc18be14b1ba34
SHA5122a86aca1ae37bc2c90549112be52f962723d3a0d09257867efe47d3fc5afca418075d38ce30b2185afe2451eac774d2485fd4bd6563d28de11fed41a8f276bd8
-
Filesize
24KB
MD5bded699ccef883840badce58f804d7f8
SHA124af43a1d9718fe780b5d9ae6827217c0e642adf
SHA256882a8bc0d59d5a6b25dd92d301ab47427db727cce84d37b299bc18be14b1ba34
SHA5122a86aca1ae37bc2c90549112be52f962723d3a0d09257867efe47d3fc5afca418075d38ce30b2185afe2451eac774d2485fd4bd6563d28de11fed41a8f276bd8
-
Filesize
476KB
MD589c4bf7297f085059f17b0ba1aa9c28d
SHA1f745c646fdf028af68934ed508ea59196690c6d6
SHA256ab6fe618e09399709a8337cce0fcd8fa233144283681a10d7c7eac475d79c07f
SHA5123b4e5f9fb6440d8ca00d6c186cf8d8a541705d27b2e2e293c8742a54c531f73d23a6e1bd4a99d9a327b8f71aa95b8887df336c48844d8427946517ca6f3241e9
-
Filesize
24KB
MD5bded699ccef883840badce58f804d7f8
SHA124af43a1d9718fe780b5d9ae6827217c0e642adf
SHA256882a8bc0d59d5a6b25dd92d301ab47427db727cce84d37b299bc18be14b1ba34
SHA5122a86aca1ae37bc2c90549112be52f962723d3a0d09257867efe47d3fc5afca418075d38ce30b2185afe2451eac774d2485fd4bd6563d28de11fed41a8f276bd8
-
Filesize
24KB
MD5bded699ccef883840badce58f804d7f8
SHA124af43a1d9718fe780b5d9ae6827217c0e642adf
SHA256882a8bc0d59d5a6b25dd92d301ab47427db727cce84d37b299bc18be14b1ba34
SHA5122a86aca1ae37bc2c90549112be52f962723d3a0d09257867efe47d3fc5afca418075d38ce30b2185afe2451eac774d2485fd4bd6563d28de11fed41a8f276bd8
-
Filesize
10.1MB
-
Filesize
16.6MB
-
Filesize
8KB