Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
02/02/2023, 20:52 UTC
General
-
Target
75d2d468dbadf3866e5fffbc227990f44db1a43c861ed7102720fe39438ca9a6.exe
-
Size
3.2MB
-
MD5
e864c1cca28c7e2907a0c42eb81a8ac2
-
SHA1
9de6c625b88fb385bc48fd3bbfbae5316bba2bb8
-
SHA256
75d2d468dbadf3866e5fffbc227990f44db1a43c861ed7102720fe39438ca9a6
-
SHA512
52c34b9e47bec0d09ec15f23902300b5bc38a5912bb54fa2737f9d413752f1aaa3599da9f166f54aef94c334627cec257efa33259ee17ecb945baeb426ce2268
-
SSDEEP
49152:1Wa+9Owtny1hbPF3noLxbrrtUbi8GUcQfoDJt:1t3nkxb/tUbTTfoDf
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\75d2d468dbadf3866e5fffbc227990f44db1a43c861ed7102720fe39438ca9a6.exe"C:\Users\Admin\AppData\Local\Temp\75d2d468dbadf3866e5fffbc227990f44db1a43c861ed7102720fe39438ca9a6.exe"1⤵
- Drops file in Drivers directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x53c1⤵
- Suspicious use of AdjustPrivilegeToken
Network
-
DNSwww.zzwmo.comRemote address:8.8.8.8:53Requestwww.zzwmo.comIN AResponsewww.zzwmo.comIN CNAMEzzwmo.b0.aicdn.comzzwmo.b0.aicdn.comIN CNAMEno.aicdn.comno.aicdn.comIN A185.232.59.133 -
DNSwww.zzwmo.comRemote address:8.8.8.8:53Requestwww.zzwmo.comIN AResponsewww.zzwmo.comIN CNAMEzzwmo.b0.aicdn.comzzwmo.b0.aicdn.comIN CNAMEno.aicdn.comno.aicdn.comIN A185.232.59.133
-
GEThttp://www.zzwmo.com/fz/hostsRemote address:185.232.59.133:80RequestGET /fz/hosts HTTP/1.1
Accept: */*
Referer: http://www.zzwmo.com/fz/hosts
Accept-Language: zh-cn
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: www.zzwmo.com
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Server: marco/2.19
Date: Thu, 02 Feb 2023 20:52:10 GMT
Content-Type: text/plain
Content-Length: 824
Connection: keep-alive
Vary: Accept-Encoding
X-Source: C/200
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
ETag: "ba0610-338-5ec7987a315f0"
Last-Modified: Wed, 02 Nov 2022 09:33:14 GMT
Accept-Ranges: bytes
X-Request-Id: 07d81bf2135737dec618d3d266681ee6
Via: S.pcw-cn-hkg-163, T.163.D, V.pcw-cn-hkg-164, T.133.D, M.gtt-de-fra3-133
-
185.232.59.133:80http://www.zzwmo.com/fz/hostshttp
HTTP Request
GET http://www.zzwmo.com/fz/hostsHTTP Response
200
-
8.8.8.8:53www.zzwmo.comdns
DNS Request
www.zzwmo.com
DNS Request
www.zzwmo.com
DNS Response
185.232.59.133
DNS Response
185.232.59.133
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB