Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

8

b75335a042...93.exe

windows7-x64

8

b75335a042...93.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    189s
  • max time network
    198s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/12/2022, 09:03 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b75335a0428b001329a716bfffc07a314af2135b3fc46293d01c7a4eadee8293.exe

  • Size

    45KB

  • MD5

    649be0a526be87d05c53586e221af7e6

  • SHA1

    c403dd70bbcf66eeb2309fb5cbdc7b97da73ba30

  • SHA256

    b75335a0428b001329a716bfffc07a314af2135b3fc46293d01c7a4eadee8293

  • SHA512

    8d478d1a2ae8d4ef0c0554989eaa3745580e0cc4334930f27637a9cd41eff3768916be8ce50a20d971626feb4e939e9b55108ddb4770f25c98b3ef103768d399

  • SSDEEP

    768:nspXvLXH+0QzfJzno+u9EuyzXuPuNL/I+Z5/irdGTffTaAxtVTMM2abe23rso:ns1DXejzzuySWd/iYTDdVwmbe27so

Score
8/10
persistenceupx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b75335a0428b001329a716bfffc07a314af2135b3fc46293d01c7a4eadee8293.exe
    "C:\Users\Admin\AppData\Local\Temp\b75335a0428b001329a716bfffc07a314af2135b3fc46293d01c7a4eadee8293.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3124
    • C:\Users\Admin\AppData\Roaming\WinSys.exe
      C:\Users\Admin\AppData\Roaming\WinSys.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of SetWindowsHookEx
      PID:3180

Network

  • flag-unknown
    DNS
    az3.no-ip.info
    WinSys.exe
    Remote address:
    8.8.8.8:53
    Request
    az3.no-ip.info
    IN A
    Response
  • flag-unknown
    DNS
    az3.no-ip.info
    WinSys.exe
    Remote address:
    8.8.8.8:53
    Request
    az3.no-ip.info
    IN A
    Response
  • flag-unknown
    DNS
    az3.no-ip.info
    WinSys.exe
    Remote address:
    8.8.8.8:53
    Request
    az3.no-ip.info
    IN A
    Response
  • flag-unknown
    DNS
    az3.no-ip.info
    WinSys.exe
    Remote address:
    8.8.8.8:53
    Request
    az3.no-ip.info
    IN A
    Response
  • flag-unknown
    DNS
    az3.no-ip.info
    WinSys.exe
    Remote address:
    8.8.8.8:53
    Request
    az3.no-ip.info
    IN A
    Response
  • flag-unknown
    DNS
    az3.no-ip.info
    WinSys.exe
    Remote address:
    8.8.8.8:53
    Request
    az3.no-ip.info
    IN A
    Response
  • flag-unknown
    DNS
    az3.no-ip.info
    WinSys.exe
    Remote address:
    8.8.8.8:53
    Request
    az3.no-ip.info
    IN A
    Response
  • flag-unknown
    DNS
    az3.no-ip.info
    WinSys.exe
    Remote address:
    8.8.8.8:53
    Request
    az3.no-ip.info
    IN A
    Response
  • flag-unknown
    DNS
    az3.no-ip.info
    WinSys.exe
    Remote address:
    8.8.8.8:53
    Request
    az3.no-ip.info
    IN A
    Response
  • flag-unknown
    DNS
    az3.no-ip.info
    WinSys.exe
    Remote address:
    8.8.8.8:53
    Request
    az3.no-ip.info
    IN A
    Response
  • flag-unknown
    DNS
    az3.no-ip.info
    WinSys.exe
    Remote address:
    8.8.8.8:53
    Request
    az3.no-ip.info
    IN A
    Response
  • flag-unknown
    DNS
    az3.no-ip.info
    WinSys.exe
    Remote address:
    8.8.8.8:53
    Request
    az3.no-ip.info
    IN A
    Response
  • flag-unknown
    DNS
    az3.no-ip.info
    WinSys.exe
    Remote address:
    8.8.8.8:53
    Request
    az3.no-ip.info
    IN A
    Response
  • flag-unknown
    DNS
    az3.no-ip.info
    WinSys.exe
    Remote address:
    8.8.8.8:53
    Request
    az3.no-ip.info
    IN A
    Response
  • flag-unknown
    DNS
    az3.no-ip.info
    WinSys.exe
    Remote address:
    8.8.8.8:53
    Request
    az3.no-ip.info
    IN A
    Response
  • flag-unknown
    DNS
    az3.no-ip.info
    WinSys.exe
    Remote address:
    8.8.8.8:53
    Request
    az3.no-ip.info
    IN A
    Response
  • flag-unknown
    DNS
    az3.no-ip.info
    WinSys.exe
    Remote address:
    8.8.8.8:53
    Request
    az3.no-ip.info
    IN A
    Response
  • flag-unknown
    DNS
    az3.no-ip.info
    WinSys.exe
    Remote address:
    8.8.8.8:53
    Request
    az3.no-ip.info
    IN A
    Response
  • flag-unknown
    DNS
    az3.no-ip.info
    WinSys.exe
    Remote address:
    8.8.8.8:53
    Request
    az3.no-ip.info
    IN A
    Response
  • flag-unknown
    DNS
    az3.no-ip.info
    WinSys.exe
    Remote address:
    8.8.8.8:53
    Request
    az3.no-ip.info
    IN A
    Response
  • flag-unknown
    DNS
    az3.no-ip.info
    WinSys.exe
    Remote address:
    8.8.8.8:53
    Request
    az3.no-ip.info
    IN A
    Response
  • flag-unknown
    DNS
    az3.no-ip.info
    WinSys.exe
    Remote address:
    8.8.8.8:53
    Request
    az3.no-ip.info
    IN A
    Response
  • 95.101.78.82:80
    322 B
     7
  • 20.42.65.85:443
    322 B
     7
  • 209.197.3.8:80
    260 B
     5
  • 209.197.3.8:80
    322 B
     7
  • 209.197.3.8:80
    322 B
     7
  • 209.197.3.8:80
    322 B
     7
  • 8.8.8.8:53
    az3.no-ip.info
    dns
    WinSys.exe
    60 B
     120 B
     1
    1

    DNS Request

    az3.no-ip.info

  • 8.8.8.8:53
    az3.no-ip.info
    dns
    WinSys.exe
    60 B
     120 B
     1
    1

    DNS Request

    az3.no-ip.info

  • 8.8.8.8:53
    az3.no-ip.info
    dns
    WinSys.exe
    60 B
     120 B
     1
    1

    DNS Request

    az3.no-ip.info

  • 8.8.8.8:53
    az3.no-ip.info
    dns
    WinSys.exe
    60 B
     120 B
     1
    1

    DNS Request

    az3.no-ip.info

  • 8.8.8.8:53
    az3.no-ip.info
    dns
    WinSys.exe
    60 B
     120 B
     1
    1

    DNS Request

    az3.no-ip.info

  • 8.8.8.8:53
    az3.no-ip.info
    dns
    WinSys.exe
    60 B
     120 B
     1
    1

    DNS Request

    az3.no-ip.info

  • 8.8.8.8:53
    az3.no-ip.info
    dns
    WinSys.exe
    60 B
     120 B
     1
    1

    DNS Request

    az3.no-ip.info

  • 8.8.8.8:53
    az3.no-ip.info
    dns
    WinSys.exe
    60 B
     120 B
     1
    1

    DNS Request

    az3.no-ip.info

  • 8.8.8.8:53
    az3.no-ip.info
    dns
    WinSys.exe
    60 B
     120 B
     1
    1

    DNS Request

    az3.no-ip.info

  • 8.8.8.8:53
    az3.no-ip.info
    dns
    WinSys.exe
    60 B
     120 B
     1
    1

    DNS Request

    az3.no-ip.info

  • 8.8.8.8:53
    az3.no-ip.info
    dns
    WinSys.exe
    60 B
     120 B
     1
    1

    DNS Request

    az3.no-ip.info

  • 8.8.8.8:53
    az3.no-ip.info
    dns
    WinSys.exe
    60 B
     120 B
     1
    1

    DNS Request

    az3.no-ip.info

  • 8.8.8.8:53
    az3.no-ip.info
    dns
    WinSys.exe
    60 B
     120 B
     1
    1

    DNS Request

    az3.no-ip.info

  • 8.8.8.8:53
    az3.no-ip.info
    dns
    WinSys.exe
    60 B
     120 B
     1
    1

    DNS Request

    az3.no-ip.info

  • 8.8.8.8:53
    az3.no-ip.info
    dns
    WinSys.exe
    60 B
     120 B
     1
    1

    DNS Request

    az3.no-ip.info

  • 8.8.8.8:53
    az3.no-ip.info
    dns
    WinSys.exe
    60 B
     120 B
     1
    1

    DNS Request

    az3.no-ip.info

  • 8.8.8.8:53
    az3.no-ip.info
    dns
    WinSys.exe
    60 B
     120 B
     1
    1

    DNS Request

    az3.no-ip.info

  • 8.8.8.8:53
    az3.no-ip.info
    dns
    WinSys.exe
    60 B
     120 B
     1
    1

    DNS Request

    az3.no-ip.info

  • 8.8.8.8:53
    az3.no-ip.info
    dns
    WinSys.exe
    60 B
     120 B
     1
    1

    DNS Request

    az3.no-ip.info

  • 8.8.8.8:53
    az3.no-ip.info
    dns
    WinSys.exe
    60 B
     120 B
     1
    1

    DNS Request

    az3.no-ip.info

  • 8.8.8.8:53
    az3.no-ip.info
    dns
    WinSys.exe
    60 B
     120 B
     1
    1

    DNS Request

    az3.no-ip.info

  • 8.8.8.8:53
    az3.no-ip.info
    dns
    WinSys.exe
    60 B
     120 B
     1
    1

    DNS Request

    az3.no-ip.info

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\WinSys.exe
    Filesize

    45KB

    MD5

    649be0a526be87d05c53586e221af7e6

    SHA1

    c403dd70bbcf66eeb2309fb5cbdc7b97da73ba30

    SHA256

    b75335a0428b001329a716bfffc07a314af2135b3fc46293d01c7a4eadee8293

    SHA512

    8d478d1a2ae8d4ef0c0554989eaa3745580e0cc4334930f27637a9cd41eff3768916be8ce50a20d971626feb4e939e9b55108ddb4770f25c98b3ef103768d399

    Download Submit

  • C:\Users\Admin\AppData\Roaming\WinSys.exe
    Filesize

    45KB

    MD5

    649be0a526be87d05c53586e221af7e6

    SHA1

    c403dd70bbcf66eeb2309fb5cbdc7b97da73ba30

    SHA256

    b75335a0428b001329a716bfffc07a314af2135b3fc46293d01c7a4eadee8293

    SHA512

    8d478d1a2ae8d4ef0c0554989eaa3745580e0cc4334930f27637a9cd41eff3768916be8ce50a20d971626feb4e939e9b55108ddb4770f25c98b3ef103768d399

    Download Submit

  • memory/3124-132-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

    Download

  • memory/3124-142-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

    Download

  • memory/3180-143-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.