Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

ed722c3906...25.exe

windows7-x64

10

ed722c3906...25.exe

windows10-2004-x64

5

Analysis

  • max time kernel
    183s
  • max time network
    199s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/12/2022, 03:54 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ed722c39067548d7c754f8a32eb30649020d509972bd8267d09c5764ea992925.exe

  • Size

    64KB

  • MD5

    18a2548ef2c7509db70bb9c6817da990

  • SHA1

    d247979375ea4fd47e11f5b1a4d0aef3ba82440a

  • SHA256

    ed722c39067548d7c754f8a32eb30649020d509972bd8267d09c5764ea992925

  • SHA512

    988dd812de7b19e4f9dc398d0627ab87a6893c2d4db86b1c13babfb52ba227204050431c1689438470871d644de2f0bd942ed51d89cfe45400ab323bcec9990a

  • SSDEEP

    768:Af33iSW+AYmNn8hnWDx87reBqfE9OlrcF0/0uCuyWPPW992haewy6Sgu9:03PvAV1gnWurwqs9Oq62xh6

Score
5/10

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ed722c39067548d7c754f8a32eb30649020d509972bd8267d09c5764ea992925.exe
    "C:\Users\Admin\AppData\Local\Temp\ed722c39067548d7c754f8a32eb30649020d509972bd8267d09c5764ea992925.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:4908
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 480
      2⤵
      • Program crash
      PID:912
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4908 -ip 4908
    1⤵
      PID:3696

    Network

    • flag-unknown
      DNS
      164.2.77.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      164.2.77.40.in-addr.arpa
      IN PTR
      Response
    • flag-unknown
      DNS
      7.6.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.2.0.0.0.0.2.0.1.3.0.6.2.ip6.arpa
      Remote address:
      8.8.8.8:53
      Request
      7.6.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.2.0.0.0.0.2.0.1.3.0.6.2.ip6.arpa
      IN PTR
      Response
    • 8.238.111.126:80
      322 B
       7
    • 20.42.73.26:443
      322 B
       7
    • 104.80.225.205:443
      322 B
       7
    • 40.125.122.151:443
      260 B
       5
    • 8.238.111.126:80
      322 B
       7
    • 8.238.111.126:80
      322 B
       7
    • 8.8.8.8:53
      164.2.77.40.in-addr.arpa
      dns
      70 B
       144 B
       1
      1

      DNS Request

      164.2.77.40.in-addr.arpa

    • 8.8.8.8:53
      7.6.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.2.0.0.0.0.2.0.1.3.0.6.2.ip6.arpa
      dns
      118 B
       204 B
       1
      1

      DNS Request

      7.6.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.2.0.0.0.0.2.0.1.3.0.6.2.ip6.arpa

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4908-132-0x0000000000400000-0x0000000000413000-memory.dmp

      Filesize

      76KB

      Download

    • memory/4908-133-0x0000000000400000-0x0000000000413000-memory.dmp

      Filesize

      76KB

      Download

    • memory/4908-134-0x0000000002040000-0x0000000002059000-memory.dmp

      Filesize

      100KB

      Download

    • memory/4908-135-0x0000000002040000-0x0000000002059000-memory.dmp

      Filesize

      100KB

      Download

    • memory/4908-136-0x0000000002040000-0x0000000002059000-memory.dmp

      Filesize

      100KB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.