Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    154s
  • max time network
    157s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    22/11/2022, 04:34 UTC

General

  • Target

    df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe

  • Size

    1.3MB

  • MD5

    804d168fc0e2f628d9a489aa0db9e07c

  • SHA1

    b1c217138b5c8db5bca4d5c66110cc686b85835e

  • SHA256

    df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec

  • SHA512

    a32935be3d69cb73e45d47ae7813b0fe93f9e22b80ff581ee3846d6760dc0cb626dc4c6214fd4fa0cf1b82dec5fa8c8dadcd9aa50d44d137a72051dfb56f7335

  • SSDEEP

    24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakY:zrKo4ZwCOnYjVmJPaH

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe
    "C:\Users\Admin\AppData\Local\Temp\df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:840
    • C:\Users\Admin\AppData\Local\Temp\df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2024

Network

  • flag-unknown
    DNS
    cbumi6htzf.0roptbgg23.com
    df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe
    Remote address:
    8.8.8.8:53
    Request
    cbumi6htzf.0roptbgg23.com
    IN A
    Response
    cbumi6htzf.0roptbgg23.com
    IN A
    5.79.71.205
    cbumi6htzf.0roptbgg23.com
    IN A
    5.79.71.225
    cbumi6htzf.0roptbgg23.com
    IN A
    85.17.31.82
    cbumi6htzf.0roptbgg23.com
    IN A
    85.17.31.122
    cbumi6htzf.0roptbgg23.com
    IN A
    178.162.203.202
    cbumi6htzf.0roptbgg23.com
    IN A
    178.162.203.211
    cbumi6htzf.0roptbgg23.com
    IN A
    178.162.203.226
    cbumi6htzf.0roptbgg23.com
    IN A
    178.162.217.107
  • flag-unknown
    GET
    http://cbumi6htzf.0roptbgg23.com/cc38e03b24860986c8bb99805c7d2c859462c589260c101b8f95ae2e4ef43dd24a3b4ead2e5c6ffb49df2854c50f8c2da9c888c03faf78cdb23dcd099368d86e1aa7853ef13b55d6
    df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe
    Remote address:
    5.79.71.205:80
    Request
    GET /cc38e03b24860986c8bb99805c7d2c859462c589260c101b8f95ae2e4ef43dd24a3b4ead2e5c6ffb49df2854c50f8c2da9c888c03faf78cdb23dcd099368d86e1aa7853ef13b55d6 HTTP/1.1
    Accept: */*
    Proxy-Authorization: Basic
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36
    Host: cbumi6htzf.0roptbgg23.com
    Connection: Keep-Alive
  • flag-unknown
    GET
    http://cbumi6htzf.0roptbgg23.com/cc38e03b24860986c8bb99805c7d2c859462c589260c101b8f95ae2e4ef43dd24a3b4ead2e5c6ffb49df2854c50f8c2da9c888c03faf78cdb23dcd099368d86e1aa7853ef13b55d6
    df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe
    Remote address:
    5.79.71.205:80
    Request
    GET /cc38e03b24860986c8bb99805c7d2c859462c589260c101b8f95ae2e4ef43dd24a3b4ead2e5c6ffb49df2854c50f8c2da9c888c03faf78cdb23dcd099368d86e1aa7853ef13b55d6 HTTP/1.1
    Accept: */*
    Proxy-Authorization: Basic
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36
    Host: cbumi6htzf.0roptbgg23.com
    Connection: Keep-Alive
  • flag-unknown
    GET
    http://cbumi6htzf.0roptbgg23.com/cc38e03b24860986c8bb99805c7d2c859462c589260c101b8f95ae2e4ef43dd24a3b4ead2e5c6ffb49df2854c50f8c2da9c888c03faf78cdb23dcd099368d86e1aa7853ef13b55d6
    df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe
    Remote address:
    5.79.71.225:80
    Request
    GET /cc38e03b24860986c8bb99805c7d2c859462c589260c101b8f95ae2e4ef43dd24a3b4ead2e5c6ffb49df2854c50f8c2da9c888c03faf78cdb23dcd099368d86e1aa7853ef13b55d6 HTTP/1.1
    Accept: */*
    Proxy-Authorization: Basic
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36
    Host: cbumi6htzf.0roptbgg23.com
    Connection: Keep-Alive
  • flag-unknown
    GET
    http://cbumi6htzf.0roptbgg23.com/cc38e03b24860986c8bb99805c7d2c859462c589260c101b8f95ae2e4ef43dd24a3b4ead2e5c6ffb49df2854c50f8c2da9c888c03faf78cdb23dcd099368d86e1aa7853ef13b55d6
    df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe
    Remote address:
    85.17.31.122:80
    Request
    GET /cc38e03b24860986c8bb99805c7d2c859462c589260c101b8f95ae2e4ef43dd24a3b4ead2e5c6ffb49df2854c50f8c2da9c888c03faf78cdb23dcd099368d86e1aa7853ef13b55d6 HTTP/1.1
    Accept: */*
    Proxy-Authorization: Basic
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36
    Host: cbumi6htzf.0roptbgg23.com
    Connection: Keep-Alive
  • flag-unknown
    POST
    http://cbumi6htzf.0roptbgg23.com/__dmp__/
    df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe
    Remote address:
    85.17.31.122:80
    Request
    POST /__dmp__/ HTTP/1.1
    User-Agent: dBrowser 1 CallGetResponse:1
    Host: cbumi6htzf.0roptbgg23.com
    Content-Length: 1307
    Cache-Control: no-cache
  • flag-unknown
    POST
    http://cbumi6htzf.0roptbgg23.com/__dmp__/
    df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe
    Remote address:
    85.17.31.122:80
    Request
    POST /__dmp__/ HTTP/1.1
    User-Agent: session
    Host: cbumi6htzf.0roptbgg23.com
    Content-Length: 3859
    Cache-Control: no-cache
  • 5.79.71.205:80
    http://cbumi6htzf.0roptbgg23.com/cc38e03b24860986c8bb99805c7d2c859462c589260c101b8f95ae2e4ef43dd24a3b4ead2e5c6ffb49df2854c50f8c2da9c888c03faf78cdb23dcd099368d86e1aa7853ef13b55d6
    http
    df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe
    614 B
    225 B
    5
    5

    HTTP Request

    GET http://cbumi6htzf.0roptbgg23.com/cc38e03b24860986c8bb99805c7d2c859462c589260c101b8f95ae2e4ef43dd24a3b4ead2e5c6ffb49df2854c50f8c2da9c888c03faf78cdb23dcd099368d86e1aa7853ef13b55d6
  • 5.79.71.205:80
    http://cbumi6htzf.0roptbgg23.com/cc38e03b24860986c8bb99805c7d2c859462c589260c101b8f95ae2e4ef43dd24a3b4ead2e5c6ffb49df2854c50f8c2da9c888c03faf78cdb23dcd099368d86e1aa7853ef13b55d6
    http
    df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe
    614 B
    225 B
    5
    5

    HTTP Request

    GET http://cbumi6htzf.0roptbgg23.com/cc38e03b24860986c8bb99805c7d2c859462c589260c101b8f95ae2e4ef43dd24a3b4ead2e5c6ffb49df2854c50f8c2da9c888c03faf78cdb23dcd099368d86e1aa7853ef13b55d6
  • 5.79.71.205:80
    cbumi6htzf.0roptbgg23.com
    df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe
    152 B
    3
  • 5.79.71.225:80
    http://cbumi6htzf.0roptbgg23.com/cc38e03b24860986c8bb99805c7d2c859462c589260c101b8f95ae2e4ef43dd24a3b4ead2e5c6ffb49df2854c50f8c2da9c888c03faf78cdb23dcd099368d86e1aa7853ef13b55d6
    http
    df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe
    614 B
    225 B
    5
    5

    HTTP Request

    GET http://cbumi6htzf.0roptbgg23.com/cc38e03b24860986c8bb99805c7d2c859462c589260c101b8f95ae2e4ef43dd24a3b4ead2e5c6ffb49df2854c50f8c2da9c888c03faf78cdb23dcd099368d86e1aa7853ef13b55d6
  • 5.79.71.225:80
    cbumi6htzf.0roptbgg23.com
    df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe
    152 B
    3
  • 85.17.31.82:80
    cbumi6htzf.0roptbgg23.com
    df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe
    152 B
    3
  • 85.17.31.122:80
    http://cbumi6htzf.0roptbgg23.com/cc38e03b24860986c8bb99805c7d2c859462c589260c101b8f95ae2e4ef43dd24a3b4ead2e5c6ffb49df2854c50f8c2da9c888c03faf78cdb23dcd099368d86e1aa7853ef13b55d6
    http
    df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe
    614 B
    225 B
    5
    5

    HTTP Request

    GET http://cbumi6htzf.0roptbgg23.com/cc38e03b24860986c8bb99805c7d2c859462c589260c101b8f95ae2e4ef43dd24a3b4ead2e5c6ffb49df2854c50f8c2da9c888c03faf78cdb23dcd099368d86e1aa7853ef13b55d6
  • 85.17.31.122:80
    http://cbumi6htzf.0roptbgg23.com/__dmp__/
    http
    df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe
    1.7kB
    265 B
    6
    6

    HTTP Request

    POST http://cbumi6htzf.0roptbgg23.com/__dmp__/
  • 85.17.31.122:80
    http://cbumi6htzf.0roptbgg23.com/__dmp__/
    http
    df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe
    5.8kB
    305 B
    9
    7

    HTTP Request

    POST http://cbumi6htzf.0roptbgg23.com/__dmp__/
  • 8.8.8.8:53
    cbumi6htzf.0roptbgg23.com
    dns
    df070b8f83e6de3f8628cfd7da8bb6fcf79601bc46a78c834e29d8ce0528e9ec.exe
    71 B
    199 B
    1
    1

    DNS Request

    cbumi6htzf.0roptbgg23.com

    DNS Response

    5.79.71.205
    5.79.71.225
    85.17.31.82
    85.17.31.122
    178.162.203.202
    178.162.203.211
    178.162.203.226
    178.162.217.107

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2024-54-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/2024-55-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/2024-57-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/2024-59-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/2024-61-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/2024-63-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/2024-65-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/2024-68-0x00000000754C1000-0x00000000754C3000-memory.dmp

    Filesize

    8KB

  • memory/2024-69-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/2024-70-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/2024-71-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/2024-73-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.