Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    299s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    23/02/2023, 04:52 UTC

General

  • Target

    4ca6df75008045a45e441869a4389b4ef620df9f89cd5f05fd329d0f9987c822.exe

  • Size

    312KB

  • MD5

    eb7d2add3fe15ee8524a07c2c75bedb9

  • SHA1

    d13c52cd6709f416aefe338922c77bae33a85f31

  • SHA256

    4ca6df75008045a45e441869a4389b4ef620df9f89cd5f05fd329d0f9987c822

  • SHA512

    484f1172d1c0c240a8b3cb7412f41cafc25a6473256d96da4a2ed7657a7606e1a2ae202b4db43e5db180dc3325c3211b524f2d52389bd52452c5f09e2d194701

  • SSDEEP

    6144:E4PWLN3m+XeeqeO0UQeQ8KbLVHqAQg5jIQshEPn:6aeqeO0UQB8KFHqAYhEPn

Malware Config

Signatures

  • Detects PseudoManuscrypt payload 8 IoCs
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • PseudoManuscrypt

    PseudoManuscrypt is a malware Lazarus’s Manuscrypt targeting government organizations and ICS.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 13 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 22 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 37 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\system32\services.exe
    C:\Windows\system32\services.exe
    1⤵
      PID:460
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious use of SetThreadContext
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:840
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k WspService
        2⤵
        • Drops file in System32 directory
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        PID:1916
    • C:\Users\Admin\AppData\Local\Temp\4ca6df75008045a45e441869a4389b4ef620df9f89cd5f05fd329d0f9987c822.exe
      "C:\Users\Admin\AppData\Local\Temp\4ca6df75008045a45e441869a4389b4ef620df9f89cd5f05fd329d0f9987c822.exe"
      1⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1668
      • C:\Users\Admin\AppData\Local\Temp\4ca6df75008045a45e441869a4389b4ef620df9f89cd5f05fd329d0f9987c822.exe
        "C:\Users\Admin\AppData\Local\Temp\4ca6df75008045a45e441869a4389b4ef620df9f89cd5f05fd329d0f9987c822.exe" -h
        2⤵
        • Suspicious use of SetWindowsHookEx
        PID:1588
    • C:\Windows\system32\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
      1⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:1468
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
        2⤵
        • Loads dropped DLL
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:576

    Network

    • flag-us
      DNS
      xv.yxzgamen.com
      4ca6df75008045a45e441869a4389b4ef620df9f89cd5f05fd329d0f9987c822.exe
      Remote address:
      8.8.8.8:53
      Request
      xv.yxzgamen.com
      IN A
      Response
      xv.yxzgamen.com
      IN A
      104.21.27.36
      xv.yxzgamen.com
      IN A
      172.67.141.51
    • flag-us
      GET
      https://xv.yxzgamen.com/2701.html
      4ca6df75008045a45e441869a4389b4ef620df9f89cd5f05fd329d0f9987c822.exe
      Remote address:
      104.21.27.36:443
      Request
      GET /2701.html HTTP/1.1
      Connection: Keep-Alive
      Accept: */*
      User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
      Host: xv.yxzgamen.com
      Response
      HTTP/1.1 200 OK
      Date: Thu, 23 Feb 2023 04:52:44 GMT
      Content-Length: 571230
      Connection: keep-alive
      Last-Modified: Mon, 29 Aug 2022 04:55:09 GMT
      ETag: "8b75e-5e75a116ff4a3"
      Accept-Ranges: bytes
      CF-Cache-Status: DYNAMIC
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=x3ICrd7xkI1Iq%2BLN9MHq%2BFAa3oXPBRo4XttUPJXNqu0XTFZ9gkUPuwKrIv0YAFj9TxleoQZfUD11SYvF5c1UTBv1MMs8%2BzoAaHxUVJHx%2BbenPKOMfp96VA%2BeRwQc%2Fw1iMDA%3D"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 79dd5a91fb11b918-AMS
      alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
    • flag-us
      GET
      https://xv.yxzgamen.com/logo.png
      4ca6df75008045a45e441869a4389b4ef620df9f89cd5f05fd329d0f9987c822.exe
      Remote address:
      104.21.27.36:443
      Request
      GET /logo.png HTTP/1.1
      Connection: Keep-Alive
      Accept: */*
      User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
      Host: xv.yxzgamen.com
      Response
      HTTP/1.1 200 OK
      Date: Thu, 23 Feb 2023 04:52:46 GMT
      Content-Type: image/png
      Content-Length: 59217
      Connection: keep-alive
      Last-Modified: Tue, 31 Jan 2023 07:35:43 GMT
      ETag: "e751-5f38a611cd3c7"
      Cache-Control: max-age=14400
      CF-Cache-Status: HIT
      Age: 2838
      Accept-Ranges: bytes
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=F%2FZyYi24eyQlr9%2FteBv0DLRruX2gM7AgUg1fNgKIeQhGr58E9Kr711YA70Kh9%2FK8Sx5Rm0jQNyWDDRcg%2BJhmmgMlXsyLIPBKKd3cXlmjxqlrid%2BbLAJ5C8kFZlNBKLwIgzw%3D"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 79dd5a9c0e12b918-AMS
      alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
    • flag-us
      DNS
      g.agametog.com
      WspService
      Remote address:
      8.8.8.8:53
      Request
      g.agametog.com
      IN A
      Response
      g.agametog.com
      IN A
      34.142.181.181
    • flag-us
      DNS
      g.agametog.com
      WspService
      Remote address:
      8.8.8.8:53
      Request
      g.agametog.com
      IN AAAA
      Response
    • flag-us
      DNS
      g.agametog.com
      WspService
      Remote address:
      8.8.8.8:53
      Request
      g.agametog.com
      IN AAAA
      Response
    • flag-us
      DNS
      ip-api.com
      WspService
      Remote address:
      8.8.8.8:53
      Request
      ip-api.com
      IN A
      Response
      ip-api.com
      IN A
      208.95.112.1
    • flag-us
      GET
      http://ip-api.com/json/?fields=8198
      WspService
      Remote address:
      208.95.112.1:80
      Request
      GET /json/?fields=8198 HTTP/1.1
      Accept: */*
      Content-Type: application/x-www-form-urlencoded
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36
      Host: ip-api.com
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Thu, 23 Feb 2023 04:53:14 GMT
      Content-Type: application/json; charset=utf-8
      Content-Length: 57
      Access-Control-Allow-Origin: *
      X-Ttl: 60
      X-Rl: 44
    • flag-us
      GET
      http://ip-api.com/json/?fields=8198
      WspService
      Remote address:
      208.95.112.1:80
      Request
      GET /json/?fields=8198 HTTP/1.1
      Accept: */*
      Content-Type: application/x-www-form-urlencoded
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36
      Host: ip-api.com
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Thu, 23 Feb 2023 04:53:16 GMT
      Content-Type: application/json; charset=utf-8
      Content-Length: 57
      Access-Control-Allow-Origin: *
      X-Ttl: 46
      X-Rl: 42
    • flag-us
      GET
      http://ip-api.com/json/?fields=8198
      WspService
      Remote address:
      208.95.112.1:80
      Request
      GET /json/?fields=8198 HTTP/1.1
      Accept: */*
      Content-Type: application/x-www-form-urlencoded
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36
      Host: ip-api.com
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Thu, 23 Feb 2023 04:53:17 GMT
      Content-Type: application/json; charset=utf-8
      Content-Length: 57
      Access-Control-Allow-Origin: *
      X-Ttl: 56
      X-Rl: 43
    • flag-us
      DNS
      pp.abcgameabc.com
      WspService
      Remote address:
      8.8.8.8:53
      Request
      pp.abcgameabc.com
      IN A
      Response
      pp.abcgameabc.com
      IN A
      172.67.161.69
      pp.abcgameabc.com
      IN A
      104.21.34.132
    • flag-us
      POST
      https://pp.abcgameabc.com/api5.php
      WspService
      Remote address:
      172.67.161.69:443
      Request
      POST /api5.php HTTP/1.1
      Accept: */*
      Content-Type: application/x-www-form-urlencoded
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36
      Host: pp.abcgameabc.com
      Content-Length: 282
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Thu, 23 Feb 2023 04:53:17 GMT
      Content-Type: application/json; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      Vary: Accept-Encoding
      CF-Cache-Status: DYNAMIC
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kb2Dv0mHSGWjRXp1kE3BxiHy7z4FqnRKyY1g8yl5yhctAkNE5iILikqVHblP0eQfdly8UOtuyqRynUHF1g1mLu64NA2COt%2BA3l8QG8O7FCASVvhHm5jqsVfYQFFKiPI9%2B16BmQ%3D%3D"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 79dd5b5cfa4a0ea8-AMS
      alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
    • flag-us
      DNS
      apps.identrust.com
      WspService
      Remote address:
      8.8.8.8:53
      Request
      apps.identrust.com
      IN A
      Response
      apps.identrust.com
      IN CNAME
      identrust.edgesuite.net
      identrust.edgesuite.net
      IN CNAME
      a1952.dscq.akamai.net
      a1952.dscq.akamai.net
      IN A
      92.122.101.41
      a1952.dscq.akamai.net
      IN A
      92.122.101.8
    • flag-nl
      GET
      http://apps.identrust.com/roots/dstrootcax3.p7c
      WspService
      Remote address:
      92.122.101.41:80
      Request
      GET /roots/dstrootcax3.p7c HTTP/1.1
      Connection: Keep-Alive
      Accept: */*
      User-Agent: Microsoft-CryptoAPI/6.1
      Host: apps.identrust.com
      Response
      HTTP/1.1 200 OK
      X-XSS-Protection: 1; mode=block
      Strict-Transport-Security: max-age=15768000
      X-Frame-Options: SAMEORIGIN
      X-Content-Type-Options: nosniff
      Content-Security-Policy: default-src 'self' *.identrust.com
      Last-Modified: Wed, 08 Feb 2023 16:52:56 GMT
      ETag: "37d-5f433188daa00"
      Accept-Ranges: bytes
      Content-Length: 893
      X-Content-Type-Options: nosniff
      X-Frame-Options: sameorigin
      Content-Type: application/pkcs7-mime
      Cache-Control: max-age=3600
      Expires: Thu, 23 Feb 2023 05:53:15 GMT
      Date: Thu, 23 Feb 2023 04:53:15 GMT
      Connection: keep-alive
    • flag-us
      DNS
      www.microsoft.com
      WspService
      Remote address:
      8.8.8.8:53
      Request
      www.microsoft.com
      IN A
      Response
      www.microsoft.com
      IN CNAME
      www.microsoft.com-c-3.edgekey.net
      www.microsoft.com-c-3.edgekey.net
      IN CNAME
      www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net
      www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net
      IN CNAME
      e13678.dscb.akamaiedge.net
      e13678.dscb.akamaiedge.net
      IN A
      104.85.1.163
    • flag-us
      DNS
      x2.c.lencr.org
      WspService
      Remote address:
      8.8.8.8:53
      Request
      x2.c.lencr.org
      IN A
      Response
      x2.c.lencr.org
      IN CNAME
      crl.root-x1.letsencrypt.org.edgekey.net
      crl.root-x1.letsencrypt.org.edgekey.net
      IN CNAME
      e8652.dscx.akamaiedge.net
      e8652.dscx.akamaiedge.net
      IN A
      23.206.95.234
    • flag-nl
      GET
      http://x2.c.lencr.org/
      WspService
      Remote address:
      23.206.95.234:80
      Request
      GET / HTTP/1.1
      Connection: Keep-Alive
      Accept: */*
      User-Agent: Microsoft-CryptoAPI/6.1
      Host: x2.c.lencr.org
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Content-Type: application/pkix-crl
      Last-Modified: Mon, 13 Jun 2022 17:00:00 GMT
      ETag: "62a76d10-12c"
      Cache-Control: max-age=3600
      Expires: Thu, 23 Feb 2023 05:53:16 GMT
      Date: Thu, 23 Feb 2023 04:53:16 GMT
      Content-Length: 300
      Connection: keep-alive
    • flag-us
      DNS
      e1.o.lencr.org
      WspService
      Remote address:
      8.8.8.8:53
      Request
      e1.o.lencr.org
      IN A
      Response
      e1.o.lencr.org
      IN CNAME
      o.lencr.edgesuite.net
      o.lencr.edgesuite.net
      IN CNAME
      a1887.dscq.akamai.net
      a1887.dscq.akamai.net
      IN A
      92.122.101.9
      a1887.dscq.akamai.net
      IN A
      92.122.101.19
    • flag-nl
      GET
      http://e1.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBTvkAFw3ViPKmUeIVEf3NC7b1ErqwQUWvPtK%2Fw2wjd5uVIw6lRvz1XLLqwCEgTBvQc5ywKG7XhTY8cniZ24sw%3D%3D
      WspService
      Remote address:
      92.122.101.9:80
      Request
      GET /MFMwUTBPME0wSzAJBgUrDgMCGgUABBTvkAFw3ViPKmUeIVEf3NC7b1ErqwQUWvPtK%2Fw2wjd5uVIw6lRvz1XLLqwCEgTBvQc5ywKG7XhTY8cniZ24sw%3D%3D HTTP/1.1
      Connection: Keep-Alive
      Accept: */*
      User-Agent: Microsoft-CryptoAPI/6.1
      Host: e1.o.lencr.org
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Content-Type: application/ocsp-response
      Content-Length: 344
      ETag: "BCA9FD03B8129B2F7E51730301C42DB8E764C12582A83EF1F9F2F7C688AEA41D"
      Last-Modified: Wed, 22 Feb 2023 18:00:00 UTC
      Cache-Control: public, no-transform, must-revalidate, max-age=2050
      Expires: Thu, 23 Feb 2023 05:27:26 GMT
      Date: Thu, 23 Feb 2023 04:53:16 GMT
      Connection: keep-alive
    • flag-us
      POST
      https://pp.abcgameabc.com/api5.php
      WspService
      Remote address:
      172.67.161.69:443
      Request
      POST /api5.php HTTP/1.1
      Accept: */*
      Content-Type: application/x-www-form-urlencoded
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36
      Host: pp.abcgameabc.com
      Content-Length: 282
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Thu, 23 Feb 2023 04:53:18 GMT
      Content-Type: application/json; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      Vary: Accept-Encoding
      CF-Cache-Status: DYNAMIC
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=A3n2SbVxuY2wZAHAeZLgy0Fn56VtVsA0JWxtk%2BssAneBRoUUGeF4XtoDNEli0ewkSaBf0Yo96JPoURt1Lx7UipLMO67uWVFBZvLZ%2B6GXTXaPap5jFlwdWD3TEp6SrZgOT7RlwQ%3D%3D"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 79dd5b61df54b837-AMS
      alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
    • flag-us
      POST
      https://pp.abcgameabc.com/api5.php
      WspService
      Remote address:
      172.67.161.69:443
      Request
      POST /api5.php HTTP/1.1
      Accept: */*
      Content-Type: application/x-www-form-urlencoded
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36
      Host: pp.abcgameabc.com
      Content-Length: 254
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Thu, 23 Feb 2023 04:53:19 GMT
      Content-Type: application/json; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      Vary: Accept-Encoding
      CF-Cache-Status: DYNAMIC
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=p0ytdZb7Xq1VWXZb6Poxl9qAh1UejrNa4%2FwOKHymproasEtSCpd70Olq0B%2FWtFXAQY%2FQg%2FwaPhTBs2g0nvh9J%2BvjWg%2BepTgmG4vFs8Y%2BQtEPSoFW%2FLA2cfedGY7HwdtLSvo2Yg%3D%3D"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 79dd5b6838420bcc-AMS
      alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
    • 104.21.27.36:443
      https://xv.yxzgamen.com/logo.png
      tls, http
      4ca6df75008045a45e441869a4389b4ef620df9f89cd5f05fd329d0f9987c822.exe
      14.4kB
      664.9kB
      300
      581

      HTTP Request

      GET https://xv.yxzgamen.com/2701.html

      HTTP Response

      200

      HTTP Request

      GET https://xv.yxzgamen.com/logo.png

      HTTP Response

      200
    • 208.95.112.1:80
      http://ip-api.com/json/?fields=8198
      http
      WspService
      1.3kB
      951 B
      9
      6

      HTTP Request

      GET http://ip-api.com/json/?fields=8198

      HTTP Response

      200

      HTTP Request

      GET http://ip-api.com/json/?fields=8198

      HTTP Response

      200

      HTTP Request

      GET http://ip-api.com/json/?fields=8198

      HTTP Response

      200
    • 172.67.161.69:443
      https://pp.abcgameabc.com/api5.php
      tls, http
      WspService
      1.4kB
      5.8kB
      11
      12

      HTTP Request

      POST https://pp.abcgameabc.com/api5.php

      HTTP Response

      200
    • 92.122.101.41:80
      http://apps.identrust.com/roots/dstrootcax3.p7c
      http
      WspService
      421 B
      1.7kB
      6
      5

      HTTP Request

      GET http://apps.identrust.com/roots/dstrootcax3.p7c

      HTTP Response

      200
    • 23.206.95.234:80
      http://x2.c.lencr.org/
      http
      WspService
      350 B
      1.4kB
      5
      4

      HTTP Request

      GET http://x2.c.lencr.org/

      HTTP Response

      200
    • 92.122.101.9:80
      http://e1.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBTvkAFw3ViPKmUeIVEf3NC7b1ErqwQUWvPtK%2Fw2wjd5uVIw6lRvz1XLLqwCEgTBvQc5ywKG7XhTY8cniZ24sw%3D%3D
      http
      WspService
      472 B
      1.6kB
      5
      4

      HTTP Request

      GET http://e1.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBTvkAFw3ViPKmUeIVEf3NC7b1ErqwQUWvPtK%2Fw2wjd5uVIw6lRvz1XLLqwCEgTBvQc5ywKG7XhTY8cniZ24sw%3D%3D

      HTTP Response

      200
    • 172.67.161.69:443
      https://pp.abcgameabc.com/api5.php
      tls, http
      WspService
      1.4kB
      5.7kB
      10
      11

      HTTP Request

      POST https://pp.abcgameabc.com/api5.php

      HTTP Response

      200
    • 172.67.161.69:443
      https://pp.abcgameabc.com/api5.php
      tls, http
      WspService
      1.4kB
      5.8kB
      10
      11

      HTTP Request

      POST https://pp.abcgameabc.com/api5.php

      HTTP Response

      200
    • 8.8.8.8:53
      xv.yxzgamen.com
      dns
      4ca6df75008045a45e441869a4389b4ef620df9f89cd5f05fd329d0f9987c822.exe
      61 B
      93 B
      1
      1

      DNS Request

      xv.yxzgamen.com

      DNS Response

      104.21.27.36
      172.67.141.51

    • 8.8.8.8:53
      g.agametog.com
      dns
      WspService
      60 B
      76 B
      1
      1

      DNS Request

      g.agametog.com

      DNS Response

      34.142.181.181

    • 8.8.8.8:53
      g.agametog.com
      dns
      WspService
      120 B
      244 B
      2
      2

      DNS Request

      g.agametog.com

      DNS Request

      g.agametog.com

    • 34.142.181.181:53
      g.agametog.com
      WspService
      72.7kB
      787.0kB
      1388
      1414
    • 8.8.8.8:53
      ip-api.com
      dns
      WspService
      56 B
      72 B
      1
      1

      DNS Request

      ip-api.com

      DNS Response

      208.95.112.1

    • 8.8.8.8:53
      pp.abcgameabc.com
      dns
      WspService
      63 B
      95 B
      1
      1

      DNS Request

      pp.abcgameabc.com

      DNS Response

      172.67.161.69
      104.21.34.132

    • 8.8.8.8:53
      apps.identrust.com
      dns
      WspService
      64 B
      165 B
      1
      1

      DNS Request

      apps.identrust.com

      DNS Response

      92.122.101.41
      92.122.101.8

    • 8.8.8.8:53
      www.microsoft.com
      dns
      WspService
      63 B
      230 B
      1
      1

      DNS Request

      www.microsoft.com

      DNS Response

      104.85.1.163

    • 8.8.8.8:53
      x2.c.lencr.org
      dns
      WspService
      60 B
      165 B
      1
      1

      DNS Request

      x2.c.lencr.org

      DNS Response

      23.206.95.234

    • 8.8.8.8:53
      e1.o.lencr.org
      dns
      WspService
      60 B
      159 B
      1
      1

      DNS Request

      e1.o.lencr.org

      DNS Response

      92.122.101.9
      92.122.101.19

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\db.dat

      Filesize

      557KB

      MD5

      30d5f615722d12fdda4f378048221909

      SHA1

      e94e3e3a6fae8b29f0f80128761ad1b69304a7eb

      SHA256

      b7cb464cd0c61026ec38d89c0a041393bc9369e217303677551eec65a09d2628

      SHA512

      a561a224d7228ec531a966c7dbd6bc88138e2f4a1c8112e5950644f69bf3a43b1e87e03bc1b4fd5e9ca071b5a9353b18697573404602ccd51f2946faf95144c2

    • C:\Users\Admin\AppData\Local\Temp\db.dll

      Filesize

      52KB

      MD5

      1b20e998d058e813dfc515867d31124f

      SHA1

      c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f

      SHA256

      24a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00

      SHA512

      79849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6

    • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

      Filesize

      61KB

      MD5

      fc4666cbca561e864e7fdf883a9e6661

      SHA1

      2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

      SHA256

      10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

      SHA512

      c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

    • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

      Filesize

      1KB

      MD5

      a266bb7dcc38a562631361bbf61dd11b

      SHA1

      3b1efd3a66ea28b16697394703a72ca340a05bd5

      SHA256

      df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

      SHA512

      0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

    • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      304B

      MD5

      7f1a6299db263a6cce78bae711f06989

      SHA1

      0dac16cedecc5dad7c8607a2b4614524eab9ad3f

      SHA256

      7bda298da588a839f10fe0697ae7e02d223237203b4d743ea887fcb93d2fcaaa

      SHA512

      06f85e041c9829f38da0c00c676605708920aab2f5532a84ed3fb983b09450d5d846324843bf55a633765e77eac3a1715ce3dc042f4622c9dc4ad6835e104d9e

    • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

      Filesize

      242B

      MD5

      f7219891020bd88600e54103a8add379

      SHA1

      0ab22dc6de6c1bcf88741a8b2db91cc5b5f0b35b

      SHA256

      fbba29a5114552fa950a555dedf8249e2da14b10b6d804e9be220f4557ac3d85

      SHA512

      7d8f157dd3260a85a7860a10ebc23df67f10ad46e39d4015f394396c2c5834577ac27aac5d36f563537d34b0c8209960ce5b30b2195bad5adfd50712637f435f

    • C:\Windows\Temp\Cab8623.tmp

      Filesize

      29KB

      MD5

      d59a6b36c5a94916241a3ead50222b6f

      SHA1

      e274e9486d318c383bc4b9812844ba56f0cff3c6

      SHA256

      a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

      SHA512

      17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

    • C:\Windows\Temp\Tar883D.tmp

      Filesize

      161KB

      MD5

      73b4b714b42fc9a6aaefd0ae59adb009

      SHA1

      efdaffd5b0ad21913d22001d91bf6c19ecb4ac41

      SHA256

      c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd

      SHA512

      73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

    • \Users\Admin\AppData\Local\Temp\db.dll

      Filesize

      52KB

      MD5

      1b20e998d058e813dfc515867d31124f

      SHA1

      c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f

      SHA256

      24a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00

      SHA512

      79849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6

    • \Users\Admin\AppData\Local\Temp\db.dll

      Filesize

      52KB

      MD5

      1b20e998d058e813dfc515867d31124f

      SHA1

      c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f

      SHA256

      24a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00

      SHA512

      79849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6

    • \Users\Admin\AppData\Local\Temp\db.dll

      Filesize

      52KB

      MD5

      1b20e998d058e813dfc515867d31124f

      SHA1

      c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f

      SHA256

      24a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00

      SHA512

      79849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6

    • \Users\Admin\AppData\Local\Temp\db.dll

      Filesize

      52KB

      MD5

      1b20e998d058e813dfc515867d31124f

      SHA1

      c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f

      SHA256

      24a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00

      SHA512

      79849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6

    • memory/576-71-0x0000000000740000-0x000000000079E000-memory.dmp

      Filesize

      376KB

    • memory/576-70-0x0000000001F70000-0x0000000002071000-memory.dmp

      Filesize

      1.0MB

    • memory/840-73-0x00000000008C0000-0x000000000090D000-memory.dmp

      Filesize

      308KB

    • memory/840-74-0x00000000012A0000-0x0000000001312000-memory.dmp

      Filesize

      456KB

    • memory/840-65-0x00000000008C0000-0x000000000090D000-memory.dmp

      Filesize

      308KB

    • memory/840-82-0x00000000008C0000-0x000000000090D000-memory.dmp

      Filesize

      308KB

    • memory/840-63-0x00000000012A0000-0x0000000001312000-memory.dmp

      Filesize

      456KB

    • memory/840-62-0x00000000008C0000-0x000000000090D000-memory.dmp

      Filesize

      308KB

    • memory/1916-75-0x0000000000280000-0x00000000002F2000-memory.dmp

      Filesize

      456KB

    • memory/1916-90-0x0000000002A10000-0x0000000002B1A000-memory.dmp

      Filesize

      1.0MB

    • memory/1916-91-0x0000000000320000-0x0000000000340000-memory.dmp

      Filesize

      128KB

    • memory/1916-92-0x0000000000280000-0x00000000002F2000-memory.dmp

      Filesize

      456KB

    • memory/1916-93-0x0000000001C60000-0x0000000001C7B000-memory.dmp

      Filesize

      108KB

    • memory/1916-89-0x0000000000300000-0x000000000031B000-memory.dmp

      Filesize

      108KB

    • memory/1916-84-0x0000000000280000-0x00000000002F2000-memory.dmp

      Filesize

      456KB

    • memory/1916-83-0x0000000000280000-0x00000000002F2000-memory.dmp

      Filesize

      456KB

    • memory/1916-72-0x0000000000280000-0x00000000002F2000-memory.dmp

      Filesize

      456KB

    • memory/1916-67-0x0000000000280000-0x00000000002F2000-memory.dmp

      Filesize

      456KB

    • memory/1916-66-0x0000000000060000-0x00000000000AD000-memory.dmp

      Filesize

      308KB

    • memory/1916-249-0x0000000000300000-0x000000000031B000-memory.dmp

      Filesize

      108KB

    • memory/1916-250-0x0000000002A10000-0x0000000002B1A000-memory.dmp

      Filesize

      1.0MB

    • memory/1916-251-0x0000000000320000-0x0000000000340000-memory.dmp

      Filesize

      128KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.