Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    43s
  • max time network
    65s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    03/12/2022, 07:27 UTC

General

  • Target

    baf44f629b4b6af0a2e32fa038d365d0e4c5d53aa2b0f731b69485ce39ef5415.exe

  • Size

    99KB

  • MD5

    9105d5795adefff4b2fb7a9b53372fa1

  • SHA1

    f4de2be44cefd02443a5e96e5469924010ed4d80

  • SHA256

    baf44f629b4b6af0a2e32fa038d365d0e4c5d53aa2b0f731b69485ce39ef5415

  • SHA512

    5421380514f991c5f374b8e3b1a9fa88d749997437d6c97ff2330ac30aaea1951e5eccdd9894e4c71479b18f3b7ddc8da7b4149893ee0bd4a54a25c55acfdabe

  • SSDEEP

    3072:gwi089AvUB1LZPE1AAQvCTjE/j15AY41C:s0wB1LlyVb+15AYF

Score
8/10
upx

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\baf44f629b4b6af0a2e32fa038d365d0e4c5d53aa2b0f731b69485ce39ef5415.exe
    "C:\Users\Admin\AppData\Local\Temp\baf44f629b4b6af0a2e32fa038d365d0e4c5d53aa2b0f731b69485ce39ef5415.exe"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of UnmapMainImage
    PID:932

Network

  • flag-unknown
    DNS
    photobucket.com
    baf44f629b4b6af0a2e32fa038d365d0e4c5d53aa2b0f731b69485ce39ef5415.exe
    Remote address:
    8.8.8.8:53
    Request
    photobucket.com
    IN A
    Response
    photobucket.com
    IN A
    108.156.60.116
    photobucket.com
    IN A
    108.156.60.49
    photobucket.com
    IN A
    108.156.60.53
    photobucket.com
    IN A
    108.156.60.24
  • flag-unknown
    DNS
    renren.com
    baf44f629b4b6af0a2e32fa038d365d0e4c5d53aa2b0f731b69485ce39ef5415.exe
    Remote address:
    8.8.8.8:53
    Request
    renren.com
    IN A
    Response
    renren.com
    IN A
    120.133.12.124
    renren.com
    IN A
    120.133.12.123
No results found
  • 8.8.8.8:53
    photobucket.com
    dns
    baf44f629b4b6af0a2e32fa038d365d0e4c5d53aa2b0f731b69485ce39ef5415.exe
    61 B
    125 B
    1
    1

    DNS Request

    photobucket.com

    DNS Response

    108.156.60.116
    108.156.60.49
    108.156.60.53
    108.156.60.24

  • 8.8.8.8:53
    renren.com
    dns
    baf44f629b4b6af0a2e32fa038d365d0e4c5d53aa2b0f731b69485ce39ef5415.exe
    56 B
    88 B
    1
    1

    DNS Request

    renren.com

    DNS Response

    120.133.12.124
    120.133.12.123

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/932-54-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/932-56-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/932-59-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

    Filesize

    8KB

  • memory/932-60-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.