Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

1

Static

static

1

f9ad9ce2f7...5a.exe

windows7-x64

1

f9ad9ce2f7...5a.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    62s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/03/2023, 22:40 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f9ad9ce2f7e4c244368dcfc60e14fa1078cf9ad7de86a8c5a5a877cb7df6895a.exe

  • Size

    274KB

  • MD5

    95a6407fecf242e7f5e7c611f5bdf671

  • SHA1

    d3fa81d1370cad7424f95417942fa3fe02a2f276

  • SHA256

    f9ad9ce2f7e4c244368dcfc60e14fa1078cf9ad7de86a8c5a5a877cb7df6895a

  • SHA512

    477f5da3586020fbd1c1bfc34d34a0b7dd44d441dcff6e8ebc3f25d1f47e295040cc8b389c436f64fe20b614f27348a7b5ab60b61268e081f01fe51792d3a8e5

  • SSDEEP

    6144:5qGhk8emhEsaQxF5k2HMM92CYIEmY1iSpig9:5P1EsaSuSMa2t

Score
1/10

Malware Config

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\f9ad9ce2f7e4c244368dcfc60e14fa1078cf9ad7de86a8c5a5a877cb7df6895a.exe
    "C:\Users\Admin\AppData\Local\Temp\f9ad9ce2f7e4c244368dcfc60e14fa1078cf9ad7de86a8c5a5a877cb7df6895a.exe"
    1⤵
      PID:4740

    Network

    • flag-us
      DNS
      196.249.167.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      196.249.167.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      131.17.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      131.17.126.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      58.55.71.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      58.55.71.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      1.77.109.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      1.77.109.52.in-addr.arpa
      IN PTR
      Response
    • 20.189.173.2:443
      322 B
       7
    • 13.107.4.50:80
      322 B
       7
    • 8.8.8.8:53
      196.249.167.52.in-addr.arpa
      dns
      73 B
       147 B
       1
      1

      DNS Request

      196.249.167.52.in-addr.arpa

    • 8.8.8.8:53
      131.17.126.40.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      131.17.126.40.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
       144 B
       1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      58.55.71.13.in-addr.arpa
      dns
      70 B
       144 B
       1
      1

      DNS Request

      58.55.71.13.in-addr.arpa

    • 8.8.8.8:53
      1.77.109.52.in-addr.arpa
      dns
      70 B
       144 B
       1
      1

      DNS Request

      1.77.109.52.in-addr.arpa

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4740-136-0x0000000000400000-0x0000000000445000-memory.dmp

      Filesize

      276KB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.