Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    92s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/11/2022, 09:32 UTC

General

  • Target

    ee9e20aa76d0e9a0df1fc02b805c7c3dfdcf3b3f55206463cf47ef6894bb6ed3.exe

  • Size

    1.3MB

  • MD5

    066d4e3d2257c54d22ee40e742da40e8

  • SHA1

    ca252f0760e7ca0967681c493bc90779c104869f

  • SHA256

    ee9e20aa76d0e9a0df1fc02b805c7c3dfdcf3b3f55206463cf47ef6894bb6ed3

  • SHA512

    7c4a5f33c973f6fdef0210cb451dccb0f08faacd24a43eef92fde53e86d5a5cfbe5f9a0cebd95009abdd005b93fc3c036ca6619eb45ddab3209149204a26233a

  • SSDEEP

    24576:rrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakz:rrKo4ZwCOnYjVmJPa8

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ee9e20aa76d0e9a0df1fc02b805c7c3dfdcf3b3f55206463cf47ef6894bb6ed3.exe
    "C:\Users\Admin\AppData\Local\Temp\ee9e20aa76d0e9a0df1fc02b805c7c3dfdcf3b3f55206463cf47ef6894bb6ed3.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2372
    • C:\Users\Admin\AppData\Local\Temp\ee9e20aa76d0e9a0df1fc02b805c7c3dfdcf3b3f55206463cf47ef6894bb6ed3.exe
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:3884

Network

  • flag-unknown
    DNS
    wtq6bs.qk5gu8aya5.com
    ee9e20aa76d0e9a0df1fc02b805c7c3dfdcf3b3f55206463cf47ef6894bb6ed3.exe
    Remote address:
    8.8.8.8:53
    Request
    wtq6bs.qk5gu8aya5.com
    IN A
    Response
  • flag-unknown
    DNS
    wtq6bs.qk5gu8aya5.com
    ee9e20aa76d0e9a0df1fc02b805c7c3dfdcf3b3f55206463cf47ef6894bb6ed3.exe
    Remote address:
    8.8.8.8:53
    Request
    wtq6bs.qk5gu8aya5.com
    IN A
    Response
  • 20.42.73.24:443
    322 B
    7
  • 93.184.221.240:80
    322 B
    7
  • 93.184.221.240:80
    322 B
    7
  • 93.184.221.240:80
    322 B
    7
  • 8.8.8.8:53
    wtq6bs.qk5gu8aya5.com
    dns
    ee9e20aa76d0e9a0df1fc02b805c7c3dfdcf3b3f55206463cf47ef6894bb6ed3.exe
    67 B
    140 B
    1
    1

    DNS Request

    wtq6bs.qk5gu8aya5.com

  • 8.8.8.8:53
    wtq6bs.qk5gu8aya5.com
    dns
    ee9e20aa76d0e9a0df1fc02b805c7c3dfdcf3b3f55206463cf47ef6894bb6ed3.exe
    67 B
    140 B
    1
    1

    DNS Request

    wtq6bs.qk5gu8aya5.com

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3884-133-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/3884-134-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/3884-135-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/3884-136-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/3884-137-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/3884-138-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.