Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/11/2022, 03:35 UTC

General

  • Target

    ef48e1371e04f6e4ec015a7df2a67a053975143c99286d8c5502e38059e35458.exe

  • Size

    1.3MB

  • MD5

    c1cb427084b533db0617fcfbb952e8cb

  • SHA1

    b199837836b67bcb6a5002279f76287de928dde5

  • SHA256

    ef48e1371e04f6e4ec015a7df2a67a053975143c99286d8c5502e38059e35458

  • SHA512

    0c7b06de99e76c0a11157891ed0cdb7629a751cabad9ccb76c397403577a74f9c2730bed177c04438ab4da92b0486401858a37018ac24131e465a84780eff792

  • SSDEEP

    24576:TrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakb:TrKo4ZwCOnYjVmJPaM

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ef48e1371e04f6e4ec015a7df2a67a053975143c99286d8c5502e38059e35458.exe
    "C:\Users\Admin\AppData\Local\Temp\ef48e1371e04f6e4ec015a7df2a67a053975143c99286d8c5502e38059e35458.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4884
    • C:\Users\Admin\AppData\Local\Temp\ef48e1371e04f6e4ec015a7df2a67a053975143c99286d8c5502e38059e35458.exe
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:1712

Network

  • flag-unknown
    DNS
    uyu1bj1lhnrk.mxp2398.com
    ef48e1371e04f6e4ec015a7df2a67a053975143c99286d8c5502e38059e35458.exe
    Remote address:
    8.8.8.8:53
    Request
    uyu1bj1lhnrk.mxp2398.com
    IN A
    Response
  • flag-unknown
    DNS
    uyu1bj1lhnrk.mxp2398.com
    ef48e1371e04f6e4ec015a7df2a67a053975143c99286d8c5502e38059e35458.exe
    Remote address:
    8.8.8.8:53
    Request
    uyu1bj1lhnrk.mxp2398.com
    IN A
    Response
  • flag-unknown
    DNS
    15.89.54.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    15.89.54.20.in-addr.arpa
    IN PTR
    Response
  • 209.197.3.8:80
    92 B
    80 B
    2
    2
  • 209.197.3.8:80
    322 B
    7
  • 104.80.225.205:443
    322 B
    7
  • 20.189.173.12:443
    322 B
    7
  • 209.197.3.8:80
    322 B
    7
  • 209.197.3.8:80
    322 B
    7
  • 209.197.3.8:80
    322 B
    7
  • 8.8.8.8:53
    uyu1bj1lhnrk.mxp2398.com
    dns
    ef48e1371e04f6e4ec015a7df2a67a053975143c99286d8c5502e38059e35458.exe
    70 B
    143 B
    1
    1

    DNS Request

    uyu1bj1lhnrk.mxp2398.com

  • 8.8.8.8:53
    uyu1bj1lhnrk.mxp2398.com
    dns
    ef48e1371e04f6e4ec015a7df2a67a053975143c99286d8c5502e38059e35458.exe
    70 B
    143 B
    1
    1

    DNS Request

    uyu1bj1lhnrk.mxp2398.com

  • 8.8.8.8:53
    15.89.54.20.in-addr.arpa
    dns
    70 B
    156 B
    1
    1

    DNS Request

    15.89.54.20.in-addr.arpa

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1712-133-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/1712-134-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/1712-135-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/1712-136-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/1712-137-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.