Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/12/2022, 11:26 UTC

General

  • Target

    0ed1a66074e28d387c28db877a2e4590834a63a16463700576b7284af68c1b4f.exe

  • Size

    134KB

  • MD5

    2670c979e76bb2939849035940eea0f3

  • SHA1

    3788215960cdcfcb5093a0b5b067d8eed8f065dd

  • SHA256

    0ed1a66074e28d387c28db877a2e4590834a63a16463700576b7284af68c1b4f

  • SHA512

    d80d94511f9a3a50a7e4ccf79638cf981ab07e58c45a14199372dd765cea58ff03054c34aab3976d4772383240634250f56ba3b52fba38bc24947d0e84d7638a

  • SSDEEP

    3072:E+y/rSv285Nl7UzLNIaaR90ymkNPmkVMCZh+UDk/T:E+k8L7sLuD9/mkNP6w9DY

Score
8/10
upx

Malware Config

Signatures

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0ed1a66074e28d387c28db877a2e4590834a63a16463700576b7284af68c1b4f.exe
    "C:\Users\Admin\AppData\Local\Temp\0ed1a66074e28d387c28db877a2e4590834a63a16463700576b7284af68c1b4f.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3156
    • C:\Users\Admin\AppData\Local\Temp\0ed1a66074e28d387c28db877a2e4590834a63a16463700576b7284af68c1b4f.exe
      ?
      2⤵
        PID:4408

    Network

    • flag-unknown
      DNS
      mysumsung.ru
      0ed1a66074e28d387c28db877a2e4590834a63a16463700576b7284af68c1b4f.exe
      Remote address:
      8.8.8.8:53
      Request
      mysumsung.ru
      IN A
      Response
    • flag-unknown
      DNS
      226.101.242.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      226.101.242.52.in-addr.arpa
      IN PTR
      Response
    • 93.184.221.240:80
      46 B
      40 B
      1
      1
    • 93.184.221.240:80
      46 B
      40 B
      1
      1
    • 72.21.91.29:80
      306 B
      40 B
      6
      1
    • 52.168.117.170:443
      322 B
      7
    • 8.252.51.254:80
      322 B
      7
    • 8.253.183.120:80
      322 B
      7
    • 104.80.225.205:443
      322 B
      7
    • 209.197.3.8:80
      322 B
      7
    • 8.8.8.8:53
      mysumsung.ru
      dns
      0ed1a66074e28d387c28db877a2e4590834a63a16463700576b7284af68c1b4f.exe
      58 B
      119 B
      1
      1

      DNS Request

      mysumsung.ru

    • 8.8.8.8:53
      226.101.242.52.in-addr.arpa
      dns
      73 B
      147 B
      1
      1

      DNS Request

      226.101.242.52.in-addr.arpa

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3156-133-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/4408-134-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/4408-135-0x0000000010000000-0x000000001000F000-memory.dmp

      Filesize

      60KB

    • memory/4408-138-0x0000000010000000-0x000000001000F000-memory.dmp

      Filesize

      60KB

    • memory/4408-139-0x0000000010000000-0x000000001000F000-memory.dmp

      Filesize

      60KB

    • memory/4408-140-0x0000000010000000-0x000000001000F000-memory.dmp

      Filesize

      60KB

    • memory/4408-141-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.