Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

8

93b7ae765c...12.exe

windows7-x64

10

93b7ae765c...12.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    205s
  • max time network
    208s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/12/2022, 00:36 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    93b7ae765cc5089b7e807fcd773ce948721096e3e24e86198064157846e3e712.exe

  • Size

    101KB

  • MD5

    72eeccd6de75f018b53a1be72055c5d0

  • SHA1

    1e64b79fc0432f7953f05c2b600a60287339db5b

  • SHA256

    93b7ae765cc5089b7e807fcd773ce948721096e3e24e86198064157846e3e712

  • SHA512

    b854dc9a6e6e98c120ab46bdc56d351b4a06a7bec703006bf7b435e290201f64fe80209d4c79ce170574d4f54828b0c2930517c5b82c9b1671469406f357f54d

  • SSDEEP

    1536:jmI0pGA9QFZOwv61HW1LItmK/+WLPPyKN7MWpqX4a7prh2ZVJUELyoERrKKlr:KIs9QBv2HWBImgyKN/4FAVJlz0rpl

Score
8/10
upx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\93b7ae765cc5089b7e807fcd773ce948721096e3e24e86198064157846e3e712.exe
    "C:\Users\Admin\AppData\Local\Temp\93b7ae765cc5089b7e807fcd773ce948721096e3e24e86198064157846e3e712.exe"
    1⤵
      PID:792
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 792 -s 260
        2⤵
        • Program crash
        PID:3312
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 792 -ip 792
      1⤵
        PID:1412

      Network

      • flag-unknown
        DNS
        15.89.54.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        15.89.54.20.in-addr.arpa
        IN PTR
        Response
      • flag-unknown
        DNS
        f.7.6.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.0.3.0.1.3.0.6.2.ip6.arpa
        Remote address:
        8.8.8.8:53
        Request
        f.7.6.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.0.3.0.1.3.0.6.2.ip6.arpa
        IN PTR
        Response
      • 93.184.221.240:80
        322 B
         7
      • 20.42.72.131:443
        322 B
         7
      • 93.184.221.240:80
        260 B
         5
      • 93.184.221.240:80
        322 B
         7
      • 93.184.221.240:80
        322 B
         7
      • 93.184.221.240:80
        322 B
         7
      • 93.184.221.240:80
        260 B
         5
      • 93.184.221.240:80
        260 B
         5
      • 104.80.225.205:443
        322 B
         7
      • 93.184.221.240:80
        260 B
         5
      • 93.184.221.240:80
        260 B
         5
      • 8.8.8.8:53
        15.89.54.20.in-addr.arpa
        dns
        70 B
         156 B
         1
        1

        DNS Request

        15.89.54.20.in-addr.arpa

      • 8.8.8.8:53
        f.7.6.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.0.3.0.1.3.0.6.2.ip6.arpa
        dns
        118 B
         204 B
         1
        1

        DNS Request

        f.7.6.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.0.3.0.1.3.0.6.2.ip6.arpa

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/792-132-0x0000000000400000-0x000000000046F000-memory.dmp

        Filesize

        444KB

        Download

      • memory/792-133-0x0000000000400000-0x000000000046F000-memory.dmp

        Filesize

        444KB

        Download

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.