Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

a293ed86a0...36.exe

windows7-x64

8

a293ed86a0...36.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    155s
  • max time network
    187s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/12/2022, 10:35 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a293ed86a0d378819fdc2319a157a5103f176c7edc0d7c12b2138b117bb29b36.exe

  • Size

    98KB

  • MD5

    0610baab5481811f0c8b1ad66d0a84a5

  • SHA1

    61358455926e33a737a1d187424de93be348faa7

  • SHA256

    a293ed86a0d378819fdc2319a157a5103f176c7edc0d7c12b2138b117bb29b36

  • SHA512

    9924a514e5d4887751074a76b57bd43f7783316e6661229b5024da03a49e7a138ef36557958d9d1f33697d267ed8612afe6a02e53d01cfff49654e902e7ecbd4

  • SSDEEP

    3072:46V87r/x8BZ/rWLfSo15FteivzoAkQpyTphpne:46er/c6eo1HteMoS4fpne

Score
7/10

Malware Config

Signatures

  • Unexpected DNS network traffic destination 5 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a293ed86a0d378819fdc2319a157a5103f176c7edc0d7c12b2138b117bb29b36.exe
    "C:\Users\Admin\AppData\Local\Temp\a293ed86a0d378819fdc2319a157a5103f176c7edc0d7c12b2138b117bb29b36.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3316
    • C:\Users\Admin\AppData\Local\Temp\a293ed86a0d378819fdc2319a157a5103f176c7edc0d7c12b2138b117bb29b36.exe
      "C:\Users\Admin\AppData\Local\Temp\a293ed86a0d378819fdc2319a157a5103f176c7edc0d7c12b2138b117bb29b36.exe"
      2⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      PID:972
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:3480

    Network

    • flag-unknown
      DNS
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      a293ed86a0d378819fdc2319a157a5103f176c7edc0d7c12b2138b117bb29b36.exe
      Remote address:
      83.133.119.139:53
      Request
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      IN Unknown
    • flag-unknown
      DNS
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      a293ed86a0d378819fdc2319a157a5103f176c7edc0d7c12b2138b117bb29b36.exe
      Remote address:
      83.133.119.139:53
      Request
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      IN Unknown
    • flag-unknown
      DNS
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      a293ed86a0d378819fdc2319a157a5103f176c7edc0d7c12b2138b117bb29b36.exe
      Remote address:
      83.133.119.139:53
      Request
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      IN Unknown
    • flag-unknown
      DNS
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      a293ed86a0d378819fdc2319a157a5103f176c7edc0d7c12b2138b117bb29b36.exe
      Remote address:
      83.133.119.139:53
      Request
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      IN Unknown
    • flag-unknown
      DNS
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      a293ed86a0d378819fdc2319a157a5103f176c7edc0d7c12b2138b117bb29b36.exe
      Remote address:
      83.133.119.139:53
      Request
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      IN Unknown
    • flag-unknown
      DNS
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      a293ed86a0d378819fdc2319a157a5103f176c7edc0d7c12b2138b117bb29b36.exe
      Remote address:
      83.133.119.139:53
      Request
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      IN Unknown
    • flag-unknown
      DNS
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      a293ed86a0d378819fdc2319a157a5103f176c7edc0d7c12b2138b117bb29b36.exe
      Remote address:
      83.133.119.139:53
      Request
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      IN Unknown
    • flag-unknown
      DNS
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      a293ed86a0d378819fdc2319a157a5103f176c7edc0d7c12b2138b117bb29b36.exe
      Remote address:
      83.133.119.139:53
      Request
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      IN Unknown
    • flag-unknown
      DNS
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      a293ed86a0d378819fdc2319a157a5103f176c7edc0d7c12b2138b117bb29b36.exe
      Remote address:
      83.133.119.139:53
      Request
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      IN Unknown
    • flag-unknown
      DNS
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      a293ed86a0d378819fdc2319a157a5103f176c7edc0d7c12b2138b117bb29b36.exe
      Remote address:
      83.133.119.139:53
      Request
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      IN Unknown
    • flag-unknown
      DNS
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      a293ed86a0d378819fdc2319a157a5103f176c7edc0d7c12b2138b117bb29b36.exe
      Remote address:
      83.133.119.139:53
      Request
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      IN Unknown
    • flag-unknown
      DNS
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      a293ed86a0d378819fdc2319a157a5103f176c7edc0d7c12b2138b117bb29b36.exe
      Remote address:
      83.133.119.139:53
      Request
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      IN Unknown
    • flag-unknown
      DNS
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      a293ed86a0d378819fdc2319a157a5103f176c7edc0d7c12b2138b117bb29b36.exe
      Remote address:
      83.133.119.139:53
      Request
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      IN Unknown
    • flag-unknown
      DNS
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      a293ed86a0d378819fdc2319a157a5103f176c7edc0d7c12b2138b117bb29b36.exe
      Remote address:
      83.133.119.139:53
      Request
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      IN Unknown
    • flag-unknown
      DNS
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      a293ed86a0d378819fdc2319a157a5103f176c7edc0d7c12b2138b117bb29b36.exe
      Remote address:
      83.133.119.139:53
      Request
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      IN Unknown
    • flag-unknown
      DNS
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      a293ed86a0d378819fdc2319a157a5103f176c7edc0d7c12b2138b117bb29b36.exe
      Remote address:
      83.133.119.139:53
      Request
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      IN Unknown
    • flag-unknown
      DNS
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      a293ed86a0d378819fdc2319a157a5103f176c7edc0d7c12b2138b117bb29b36.exe
      Remote address:
      83.133.119.139:53
      Request
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      IN Unknown
    • flag-unknown
      DNS
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      a293ed86a0d378819fdc2319a157a5103f176c7edc0d7c12b2138b117bb29b36.exe
      Remote address:
      83.133.119.139:53
      Request
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      IN Unknown
    • flag-unknown
      DNS
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      a293ed86a0d378819fdc2319a157a5103f176c7edc0d7c12b2138b117bb29b36.exe
      Remote address:
      83.133.119.139:53
      Request
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      IN Unknown
    • flag-unknown
      DNS
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      a293ed86a0d378819fdc2319a157a5103f176c7edc0d7c12b2138b117bb29b36.exe
      Remote address:
      83.133.119.139:53
      Request
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      IN Unknown
    • flag-unknown
      DNS
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      a293ed86a0d378819fdc2319a157a5103f176c7edc0d7c12b2138b117bb29b36.exe
      Remote address:
      83.133.119.139:53
      Request
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      IN Unknown
    • flag-unknown
      DNS
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      a293ed86a0d378819fdc2319a157a5103f176c7edc0d7c12b2138b117bb29b36.exe
      Remote address:
      83.133.119.139:53
      Request
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      IN Unknown
    • flag-unknown
      DNS
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      a293ed86a0d378819fdc2319a157a5103f176c7edc0d7c12b2138b117bb29b36.exe
      Remote address:
      83.133.119.139:53
      Request
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      IN Unknown
    • flag-unknown
      DNS
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      a293ed86a0d378819fdc2319a157a5103f176c7edc0d7c12b2138b117bb29b36.exe
      Remote address:
      83.133.119.139:53
      Request
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      IN Unknown
    • flag-unknown
      DNS
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      a293ed86a0d378819fdc2319a157a5103f176c7edc0d7c12b2138b117bb29b36.exe
      Remote address:
      83.133.119.139:53
      Request
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      IN Unknown
    • 8.238.20.254:80
      52 B
       1
    • 8.238.20.126:80
      322 B
       7
    • 8.238.20.126:80
      322 B
       7
    • 8.253.208.120:80
      260 B
       5
    • 8.253.208.120:80
      322 B
       7
    • 83.133.119.139:53
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      dns
      a293ed86a0d378819fdc2319a157a5103f176c7edc0d7c12b2138b117bb29b36.exe
      750 B
       5

      DNS Request

      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm

      DNS Request

      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm

      DNS Request

      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm

      DNS Request

      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm

      DNS Request

      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm

    • 83.133.119.139:53
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      dns
      a293ed86a0d378819fdc2319a157a5103f176c7edc0d7c12b2138b117bb29b36.exe
      750 B
       5

      DNS Request

      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm

      DNS Request

      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm

      DNS Request

      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm

      DNS Request

      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm

      DNS Request

      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm

    • 83.133.119.139:53
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      dns
      a293ed86a0d378819fdc2319a157a5103f176c7edc0d7c12b2138b117bb29b36.exe
      750 B
       5

      DNS Request

      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm

      DNS Request

      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm

      DNS Request

      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm

      DNS Request

      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm

      DNS Request

      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm

    • 83.133.119.139:53
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      dns
      a293ed86a0d378819fdc2319a157a5103f176c7edc0d7c12b2138b117bb29b36.exe
      750 B
       5

      DNS Request

      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm

      DNS Request

      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm

      DNS Request

      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm

      DNS Request

      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm

      DNS Request

      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm

    • 83.133.119.139:53
      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm
      dns
      a293ed86a0d378819fdc2319a157a5103f176c7edc0d7c12b2138b117bb29b36.exe
      750 B
       5

      DNS Request

      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm

      DNS Request

      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm

      DNS Request

      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm

      DNS Request

      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm

      DNS Request

      6.0.0.358.1304705567.1076841954.128.0.389b8e67cc44850d9e1b3f8fd5f8162d8e582427b1047d3058.twothousands.cm

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/972-133-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

      Download

    • memory/972-135-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

      Download

    • memory/972-136-0x0000000010000000-0x000000001000A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/972-140-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.