Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    139s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/11/2022, 06:34 UTC

General

  • Target

    8502ea6392919d697b81673da99c1da901b834d4c84379524207754d4b55932e.exe

  • Size

    2.6MB

  • MD5

    702478db41bc0e7b416cd7ed6448f79f

  • SHA1

    c3b1cecbed2bf573c9619b05e6296d469883ef83

  • SHA256

    8502ea6392919d697b81673da99c1da901b834d4c84379524207754d4b55932e

  • SHA512

    0ea5049e73bd06cc72642db9104c18fb2f4180c4d4ed4ac6553869307d598ce452cb8d095b10a80c395cd8d95faf88df87ca97c467821023499a6cf6c6edf751

  • SSDEEP

    49152:PvpvqWOS0B7uN2UeqzSqujdRhzAIxve4DVdyDIe4nw3Vx3PPGEg7zS2LO:PhvqWOS0B7uNeqzSqujDhzAIxW4jyDIa

Score
8/10
upx

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8502ea6392919d697b81673da99c1da901b834d4c84379524207754d4b55932e.exe
    "C:\Users\Admin\AppData\Local\Temp\8502ea6392919d697b81673da99c1da901b834d4c84379524207754d4b55932e.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4332

Network

  • flag-unknown
    DNS
    97.97.242.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    97.97.242.52.in-addr.arpa
    IN PTR
    Response
  • flag-unknown
    DNS
    f.7.6.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.0.3.0.1.3.0.6.2.ip6.arpa
    Remote address:
    8.8.8.8:53
    Request
    f.7.6.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.0.3.0.1.3.0.6.2.ip6.arpa
    IN PTR
    Response
  • 93.184.221.240:80
    46 B
    40 B
    1
    1
  • 8.238.21.126:80
    322 B
    7
  • 93.184.221.240:80
    260 B
    5
  • 20.42.65.90:443
    322 B
    7
  • 93.184.221.240:80
    322 B
    7
  • 93.184.221.240:80
    322 B
    7
  • 93.184.221.240:80
    322 B
    7
  • 93.184.221.240:80
    260 B
    5
  • 93.184.221.240:80
    260 B
    5
  • 8.8.8.8:53
    97.97.242.52.in-addr.arpa
    dns
    71 B
    145 B
    1
    1

    DNS Request

    97.97.242.52.in-addr.arpa

  • 8.8.8.8:53
    f.7.6.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.0.3.0.1.3.0.6.2.ip6.arpa
    dns
    118 B
    204 B
    1
    1

    DNS Request

    f.7.6.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.0.3.0.1.3.0.6.2.ip6.arpa

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4332-132-0x0000000000400000-0x0000000000583000-memory.dmp

    Filesize

    1.5MB

  • memory/4332-133-0x0000000000590000-0x0000000000597000-memory.dmp

    Filesize

    28KB

  • memory/4332-134-0x0000000000400000-0x0000000000583000-memory.dmp

    Filesize

    1.5MB

  • memory/4332-135-0x0000000000400000-0x0000000000583000-memory.dmp

    Filesize

    1.5MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.