Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

1

Static

static

1

URLScan

urlscan

1

http://nxl001-cygd1....

windows10-2004-x64

1

Analysis

  • max time kernel
    156s
  • max time network
    168s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/03/2023, 22:18 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    http://nxl001-cygd1.cyberguards.co

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 33 IoCs
    adwarespyware
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://nxl001-cygd1.cyberguards.co
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3176
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3176 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:712

Network

  • flag-us
    DNS
    nxl001-cygd1.cyberguards.co
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    nxl001-cygd1.cyberguards.co
    IN A
    Response
    nxl001-cygd1.cyberguards.co
    IN A
    144.129.40.236
  • flag-us
    DNS
    28.118.140.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    28.118.140.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    254.165.241.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    254.165.241.8.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    nxl001-cygd1.cyberguards.co
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    nxl001-cygd1.cyberguards.co
    IN A
    Response
    nxl001-cygd1.cyberguards.co
    IN A
    144.129.40.236
  • flag-us
    DNS
    200.232.18.117.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.232.18.117.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    176.122.125.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    176.122.125.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    23.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    23.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    76.38.195.152.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    76.38.195.152.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    18.31.95.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.31.95.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    2.36.159.162.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    2.36.159.162.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    200.197.79.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.197.79.204.in-addr.arpa
    IN PTR
    Response
    200.197.79.204.in-addr.arpa
    IN PTR
    a-0001a-msedgenet
  • flag-us
    DNS
    240.81.21.72.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    240.81.21.72.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    103.169.127.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    103.169.127.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    4.b.1.9.1.6.7.1.0.0.0.0.0.0.0.0.1.0.0.9.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa
    Remote address:
    8.8.8.8:53
    Request
    4.b.1.9.1.6.7.1.0.0.0.0.0.0.0.0.1.0.0.9.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa
    IN PTR
    Response
  • flag-us
    DNS
    67.31.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    67.31.126.40.in-addr.arpa
    IN PTR
    Response
  • 152.195.38.76:80
    92 B
     80 B
     2
    2
  • 144.129.40.236:80
    nxl001-cygd1.cyberguards.co
    IEXPLORE.EXE
    156 B
     3
  • 144.129.40.236:80
    nxl001-cygd1.cyberguards.co
    IEXPLORE.EXE
    156 B
     3
  • 144.129.40.236:80
    nxl001-cygd1.cyberguards.co
    IEXPLORE.EXE
    156 B
     3
  • 144.129.40.236:80
    nxl001-cygd1.cyberguards.co
    IEXPLORE.EXE
    156 B
     3
  • 104.208.16.90:443
    322 B
     7
  • 192.229.221.95:80
    46 B
     40 B
     1
    1
  • 204.79.197.200:443
    40 B
     1
  • 204.79.197.200:443
    ieonline.microsoft.com
    iexplore.exe
    156 B
     3
  • 204.79.197.200:443
    ieonline.microsoft.com
    iexplore.exe
    156 B
     3
  • 8.8.8.8:53
    nxl001-cygd1.cyberguards.co
    dns
    IEXPLORE.EXE
    73 B
     89 B
     1
    1

    DNS Request

    nxl001-cygd1.cyberguards.co

    DNS Response

    144.129.40.236

  • 8.8.8.8:53
    28.118.140.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    28.118.140.52.in-addr.arpa

  • 8.8.8.8:53
    254.165.241.8.in-addr.arpa
    dns
    72 B
     126 B
     1
    1

    DNS Request

    254.165.241.8.in-addr.arpa

  • 8.8.8.8:53
    nxl001-cygd1.cyberguards.co
    dns
    IEXPLORE.EXE
    73 B
     89 B
     1
    1

    DNS Request

    nxl001-cygd1.cyberguards.co

    DNS Response

    144.129.40.236

  • 8.8.8.8:53
    200.232.18.117.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    200.232.18.117.in-addr.arpa

  • 8.8.8.8:53
    176.122.125.40.in-addr.arpa
    dns
    73 B
     159 B
     1
    1

    DNS Request

    176.122.125.40.in-addr.arpa

  • 8.8.8.8:53
    23.159.190.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    23.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    76.38.195.152.in-addr.arpa
    dns
    72 B
     143 B
     1
    1

    DNS Request

    76.38.195.152.in-addr.arpa

  • 8.8.8.8:53
    18.31.95.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    18.31.95.13.in-addr.arpa

  • 8.8.8.8:53
    2.36.159.162.in-addr.arpa
    dns
    71 B
     133 B
     1
    1

    DNS Request

    2.36.159.162.in-addr.arpa

  • 8.8.8.8:53
    200.197.79.204.in-addr.arpa
    dns
    73 B
     106 B
     1
    1

    DNS Request

    200.197.79.204.in-addr.arpa

  • 8.8.8.8:53
    240.81.21.72.in-addr.arpa
    dns
    71 B
     142 B
     1
    1

    DNS Request

    240.81.21.72.in-addr.arpa

  • 8.8.8.8:53
    103.169.127.40.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    103.169.127.40.in-addr.arpa

  • 8.8.8.8:53
    4.b.1.9.1.6.7.1.0.0.0.0.0.0.0.0.1.0.0.9.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa
    dns
    118 B
     118 B
     1
    1

    DNS Request

    4.b.1.9.1.6.7.1.0.0.0.0.0.0.0.0.1.0.0.9.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa

  • 8.8.8.8:53
    67.31.126.40.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    67.31.126.40.in-addr.arpa

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\69C6F6EC64E114822DF688DC12CDD86C
    Filesize

    779B

    MD5

    9384ab7f52e0e78d1d16a44577f4a394

    SHA1

    ef6bd7d905251a84fc9c8855677d7a374e00a381

    SHA256

    805a55c4aa3a02174c5c96e8a7ad2c47f45b151cb87a3a6f89da7cc17b4a4fc8

    SHA512

    9f8a0786b55f02c0279e9bef90068a34c2cc2713b103a47fbfa13825942e0835d25c2f837bc34b2f31859fa14c888a403c6b30926ad2332ae6ef9b222c1fd8b3

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\69C6F6EC64E114822DF688DC12CDD86C
    Filesize

    246B

    MD5

    61dd26af7a7befee00902e2b5706b814

    SHA1

    bc1918384dc5fa0a87a42492aeb95e8244f9fd96

    SHA256

    bd5f5c8e0194ffa497f96f3e42d3d77525198271f3a43db5407dc522f0348ecf

    SHA512

    2946fcc020f2dac3ba4aafcfa4c4c5e310a9c508dfd625370e09d1a16381914bc517a5b8934eeae3573c0b4a1d8ce6643f18a86c3bfd978781042e66d6c998ce

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verB8A1.tmp
    Filesize

    15KB

    MD5

    1a545d0052b581fbb2ab4c52133846bc

    SHA1

    62f3266a9b9925cd6d98658b92adec673cbe3dd3

    SHA256

    557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

    SHA512

    bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4HAJQ22Y\suggestions[1].en-US
    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

    Download Submit

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.