Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    78s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/03/2023, 14:09 UTC

General

  • Target

    Crack_HK.zip

  • Size

    6.1MB

  • MD5

    b758b483c53af320e2585991b65cd2d9

  • SHA1

    1b537b71ff1afe5787492141682551650883bbfb

  • SHA256

    1408d798dd57c889f4742819a33d1abf4969229acf6dbf118c2c9214a5228bd0

  • SHA512

    19f58232d6ca98abb9cd320ae2c71d43710028dea29f14da63468fbaae283dd35d9e9e4590d13e6449ee9bd78df46bec9570cc2fc012f82a89b29f7352e7f36e

  • SSDEEP

    196608:F1JzXRqlEn8ml3RfFWyLDBzo4dhACs8nT:F1JzMo82TFzo4ps0

Score
1/10

Malware Config

Signatures

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Crack_HK.zip
    1⤵
      PID:216
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:2228

      Network

      • flag-us
        DNS
        154.239.44.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        154.239.44.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        126.50.247.8.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        126.50.247.8.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        76.38.195.152.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        76.38.195.152.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        134.17.126.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        134.17.126.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        232.168.11.51.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        232.168.11.51.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        103.169.127.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        103.169.127.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        177.238.32.23.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        177.238.32.23.in-addr.arpa
        IN PTR
        Response
        177.238.32.23.in-addr.arpa
        IN PTR
        a23-32-238-177deploystaticakamaitechnologiescom
      • flag-us
        DNS
        206.23.85.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        206.23.85.13.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        45.8.109.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        45.8.109.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        2.36.159.162.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        2.36.159.162.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        206.23.85.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        206.23.85.13.in-addr.arpa
        IN PTR
        Response
      • 52.152.108.96:443
        260 B
        5
      • 40.79.141.154:443
        322 B
        7
      • 93.184.221.240:80
        322 B
        7
      • 93.184.221.240:80
        322 B
        7
      • 93.184.221.240:80
        322 B
        7
      • 173.223.113.164:443
        322 B
        7
      • 173.223.113.131:80
        322 B
        7
      • 204.79.197.203:80
        api.msn.com
        322 B
        7
      • 8.8.8.8:53
        154.239.44.20.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        154.239.44.20.in-addr.arpa

      • 8.8.8.8:53
        126.50.247.8.in-addr.arpa
        dns
        71 B
        125 B
        1
        1

        DNS Request

        126.50.247.8.in-addr.arpa

      • 8.8.8.8:53
        76.38.195.152.in-addr.arpa
        dns
        72 B
        143 B
        1
        1

        DNS Request

        76.38.195.152.in-addr.arpa

      • 8.8.8.8:53
        134.17.126.40.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        134.17.126.40.in-addr.arpa

      • 8.8.8.8:53
        232.168.11.51.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        232.168.11.51.in-addr.arpa

      • 8.8.8.8:53
        103.169.127.40.in-addr.arpa
        dns
        73 B
        147 B
        1
        1

        DNS Request

        103.169.127.40.in-addr.arpa

      • 8.8.8.8:53
        177.238.32.23.in-addr.arpa
        dns
        72 B
        137 B
        1
        1

        DNS Request

        177.238.32.23.in-addr.arpa

      • 8.8.8.8:53
        206.23.85.13.in-addr.arpa
        dns
        71 B
        145 B
        1
        1

        DNS Request

        206.23.85.13.in-addr.arpa

      • 8.8.8.8:53
        45.8.109.52.in-addr.arpa
        dns
        70 B
        144 B
        1
        1

        DNS Request

        45.8.109.52.in-addr.arpa

      • 8.8.8.8:53
        2.36.159.162.in-addr.arpa
        dns
        71 B
        133 B
        1
        1

        DNS Request

        2.36.159.162.in-addr.arpa

      • 8.8.8.8:53
        206.23.85.13.in-addr.arpa
        dns
        71 B
        145 B
        1
        1

        DNS Request

        206.23.85.13.in-addr.arpa

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.