Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    204s
  • max time network
    211s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/12/2022, 00:48 UTC

General

  • Target

    737956c59435f3880f70ad0bdabd2cbcedb6cb70e70ed8dc7773cd6678953c50.exe

  • Size

    296KB

  • MD5

    5ba8cdf6367a173f5ef5fec8f5cd3430

  • SHA1

    b3b1c5066c5c01fa5ac70a62fc8182d8a17150ad

  • SHA256

    737956c59435f3880f70ad0bdabd2cbcedb6cb70e70ed8dc7773cd6678953c50

  • SHA512

    7f838eb27509429a6e90583d541713ae5119df4ee0450e191bf56f0a47562378b8eaa35f6e3a1fbd46f4d2a675d4c4fd8a73084a0357ec9734188ca9f59fae6d

  • SSDEEP

    6144:zTqPRndIKCC0ef//uXltKc+LVsz9b8AO0fF/H9K:UdFeCXuLKcCVsz6O

Score
8/10

Malware Config

Signatures

  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\737956c59435f3880f70ad0bdabd2cbcedb6cb70e70ed8dc7773cd6678953c50.exe
    "C:\Users\Admin\AppData\Local\Temp\737956c59435f3880f70ad0bdabd2cbcedb6cb70e70ed8dc7773cd6678953c50.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3208
    • C:\Users\Admin\AppData\Local\Temp\737956c59435f3880f70ad0bdabd2cbcedb6cb70e70ed8dc7773cd6678953c50.exe
      /scomma "C:\Users\Admin\AppData\Local\Temp\tmp.ini"
      2⤵
        PID:3740

    Network

    • flag-unknown
      DNS
      226.101.242.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      226.101.242.52.in-addr.arpa
      IN PTR
      Response
    • flag-unknown
      DNS
      a.2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.5.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa
      Remote address:
      8.8.8.8:53
      Request
      a.2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.5.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa
      IN PTR
      Response
    • 93.184.221.240:80
      260 B
      5
    • 93.184.221.240:80
      260 B
      5
    • 93.184.221.240:80
      260 B
      5
    • 72.21.91.29:80
      322 B
      7
    • 104.80.225.205:443
      322 B
      7
    • 72.21.91.29:80
      260 B
      5
    • 40.79.189.59:443
      322 B
      7
    • 93.184.221.240:80
      322 B
      7
    • 93.184.221.240:80
      322 B
      7
    • 93.184.221.240:80
      322 B
      7
    • 8.8.8.8:53
      226.101.242.52.in-addr.arpa
      dns
      73 B
      147 B
      1
      1

      DNS Request

      226.101.242.52.in-addr.arpa

    • 8.8.8.8:53
      a.2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.5.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa
      dns
      118 B
      204 B
      1
      1

      DNS Request

      a.2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.5.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3740-135-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/3740-137-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/3740-138-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/3740-139-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/3740-140-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/3740-141-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.