Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/04/2023, 22:04

General

  • Target

    DNSBench.exe

  • Size

    159KB

  • MD5

    154ee28facb62e73e1dcaf3562c2d6ec

  • SHA1

    570b1f2153c735ea0f9e5680c8f21cc581cd69e9

  • SHA256

    ab42c94fc03ddbf446319772518b229d7b2e2546fdddaae7c01abe0fa8a02be1

  • SHA512

    b000502243b66e9dc535b0eb6fbd9212ba6adabc519c0ca4c44d65ace1c659efa8be12a843f480e3e8ff436246d919ba19e5307e9aedd81893b77343274d7735

  • SSDEEP

    3072:XSww+ICvU0Qv8Z9yzvSh3gzaDKzHDa4cn2qTWM9gbYfNjh:XSwwPC08CzvSh3geOzm4cn2AWM9gb4

Score
7/10

Malware Config

Signatures

  • Unexpected DNS network traffic destination 64 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DNSBench.exe
    "C:\Users\Admin\AppData\Local\Temp\DNSBench.exe"
    1⤵
      PID:1320
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x508 0x510
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4832

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1320-133-0x0000000000400000-0x00000000004AA000-memory.dmp

      Filesize

      680KB

    • memory/1320-134-0x0000000000030000-0x0000000000033000-memory.dmp

      Filesize

      12KB

    • memory/1320-135-0x0000000000400000-0x00000000004AA000-memory.dmp

      Filesize

      680KB

    • memory/1320-136-0x0000000000400000-0x00000000004AA000-memory.dmp

      Filesize

      680KB

    • memory/1320-137-0x0000000000400000-0x00000000004AA000-memory.dmp

      Filesize

      680KB

    • memory/1320-138-0x0000000000400000-0x00000000004AA000-memory.dmp

      Filesize

      680KB

    • memory/1320-141-0x0000000000400000-0x00000000004AA000-memory.dmp

      Filesize

      680KB

    • memory/1320-142-0x0000000000400000-0x00000000004AA000-memory.dmp

      Filesize

      680KB

    • memory/1320-143-0x0000000000400000-0x00000000004AA000-memory.dmp

      Filesize

      680KB

    • memory/1320-144-0x0000000000400000-0x00000000004AA000-memory.dmp

      Filesize

      680KB

    • memory/1320-147-0x0000000000400000-0x00000000004AA000-memory.dmp

      Filesize

      680KB

    • memory/1320-148-0x0000000000400000-0x00000000004AA000-memory.dmp

      Filesize

      680KB

    • memory/1320-149-0x0000000000400000-0x00000000004AA000-memory.dmp

      Filesize

      680KB