Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
11/03/2023, 14:09 UTC
General
-
Target
CCDisk (v2021.02.19)/ccdisksetup.exe
-
Size
4.0MB
-
MD5
dee9faa70dd7776cb8f21e4de5e908ca
-
SHA1
1dd6c2d94f55fa7955f61f845741af981021e368
-
SHA256
acbdef532ec5dfab992396e07b8d4c86597d567d805c8855184e0523c169f1cc
-
SHA512
ae1222ab83f881527ebcff24870d83632b9c69cf14adfe891b3788b3a4ef2fa09494508902244f8b539c872165f8f6612108ebac6a874266b42fbc72bdc6991d
-
SSDEEP
98304:C9OYMNeGvmsrRsusL43x/JW/IB5+JiPZ3lgoT:2yeGvmsrKj43xB6I2Ex3n
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CCDisk (v2021.02.19)\ccdisksetup.exe"C:\Users\Admin\AppData\Local\Temp\CCDisk (v2021.02.19)\ccdisksetup.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-9AFFF.tmp\ccdisksetup.tmp"C:\Users\Admin\AppData\Local\Temp\is-9AFFF.tmp\ccdisksetup.tmp" /SL5="$A0030,3962269,58368,C:\Users\Admin\AppData\Local\Temp\CCDisk (v2021.02.19)\ccdisksetup.exe"2⤵
- Executes dropped EXE
-
Network
-
DNS241.150.49.20.in-addr.arpaRemote address:8.8.8.8:53Request241.150.49.20.in-addr.arpaIN PTRResponse -
DNS210.81.184.52.in-addr.arpaRemote address:8.8.8.8:53Request210.81.184.52.in-addr.arpaIN PTRResponse
-
DNS58.55.71.13.in-addr.arpaRemote address:8.8.8.8:53Request58.55.71.13.in-addr.arpaIN PTRResponse
-
DNS28.118.140.52.in-addr.arpaRemote address:8.8.8.8:53Request28.118.140.52.in-addr.arpaIN PTRResponse
-
DNS139.238.32.23.in-addr.arpaRemote address:8.8.8.8:53Request139.238.32.23.in-addr.arpaIN PTRResponse139.238.32.23.in-addr.arpaIN PTRa23-32-238-139deploystaticakamaitechnologiescom
-
DNS199.176.139.52.in-addr.arpaRemote address:8.8.8.8:53Request199.176.139.52.in-addr.arpaIN PTRResponse
-
DNS177.238.32.23.in-addr.arpaRemote address:8.8.8.8:53Request177.238.32.23.in-addr.arpaIN PTRResponse177.238.32.23.in-addr.arpaIN PTRa23-32-238-177deploystaticakamaitechnologiescom
-
DNS2.77.109.52.in-addr.arpaRemote address:8.8.8.8:53Request2.77.109.52.in-addr.arpaIN PTRResponse
-
8.238.179.126:80 -
173.223.113.164:443
-
173.223.113.131:80
-
131.253.33.203:80
-
13.107.42.16:443
-
8.8.8.8:53241.150.49.20.in-addr.arpadns
DNS Request
241.150.49.20.in-addr.arpa
-
8.8.8.8:53210.81.184.52.in-addr.arpadns
DNS Request
210.81.184.52.in-addr.arpa
-
8.8.8.8:5358.55.71.13.in-addr.arpadns
DNS Request
58.55.71.13.in-addr.arpa
-
8.8.8.8:5328.118.140.52.in-addr.arpadns
DNS Request
28.118.140.52.in-addr.arpa
-
8.8.8.8:53139.238.32.23.in-addr.arpadns
DNS Request
139.238.32.23.in-addr.arpa
-
8.8.8.8:53199.176.139.52.in-addr.arpadns
DNS Request
199.176.139.52.in-addr.arpa
-
8.8.8.8:53177.238.32.23.in-addr.arpadns
DNS Request
177.238.32.23.in-addr.arpa
-
8.8.8.8:532.77.109.52.in-addr.arpadns
DNS Request
2.77.109.52.in-addr.arpa
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
709KB
MD57bc6ee10dbc76acb9dbc72294cff3553
SHA16fde2a3122e9bd69e4b2c532d9ecd8471bafdf95
SHA2569e26391f9a54ab1098a35ca415efd75117275d2c765c8aa9b3846b2bb8e8a3d1
SHA5123cdc67ae60d6b88b55b1ca5a062d83fa629f825943064ee2d42477b6ed263f619cb011acc7f599b20088f8bd06b8e8b6a5786671d04bb8df828771a6bf7cfd18
-
Filesize
4KB
-
Filesize
764KB
-
Filesize
84KB
-
Filesize
84KB