Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

3

Static

static

f4023b1ad1...fb.exe

windows7-x64

3

f4023b1ad1...fb.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    283s
  • max time network
    318s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/11/2022, 11:36 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f4023b1ad1ef42ea79dd0e7e8b7babd072b96783a25272fcc74790b7f97fa0fb.exe

  • Size

    3KB

  • MD5

    172e6fbb407c2ec8f9a68d4b0dcae160

  • SHA1

    50a7de1f19e6f4eacf977de68efdbac89e9a60e4

  • SHA256

    f4023b1ad1ef42ea79dd0e7e8b7babd072b96783a25272fcc74790b7f97fa0fb

  • SHA512

    19c70d2ff3962acae37d7e1cd7636fc6d61bfed086960ad6cc4f2ae2a8236ef93b68756ca64c8b0c23e238388819f69170172ffb6f27e6c15cd2f905540217af

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f4023b1ad1ef42ea79dd0e7e8b7babd072b96783a25272fcc74790b7f97fa0fb.exe
    "C:\Users\Admin\AppData\Local\Temp\f4023b1ad1ef42ea79dd0e7e8b7babd072b96783a25272fcc74790b7f97fa0fb.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3512

Network

  • flag-unknown
    DNS
    164.2.77.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    164.2.77.40.in-addr.arpa
    IN PTR
    Response
  • 93.184.220.29:80
    322 B
     7
  • 104.80.225.205:443
    322 B
     7
  • 20.189.173.10:443
    322 B
     7
  • 88.221.25.154:80
    322 B
     7
  • 88.221.25.154:80
    322 B
     7
  • 87.248.202.1:80
    322 B
     7
  • 8.8.8.8:53
    164.2.77.40.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    164.2.77.40.in-addr.arpa

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3512-132-0x00007FF809720000-0x00007FF80A156000-memory.dmp

    Filesize

    10.2MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.