Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03/04/2023, 22:04
Static task
static1
Behavioral task
behavioral1
Sample
DNSBench.exe
Resource
win7-20230220-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
DNSBench.exe
Resource
win10v2004-20230220-en
2 signatures
150 seconds
General
-
Target
DNSBench.exe
-
Size
159KB
-
MD5
154ee28facb62e73e1dcaf3562c2d6ec
-
SHA1
570b1f2153c735ea0f9e5680c8f21cc581cd69e9
-
SHA256
ab42c94fc03ddbf446319772518b229d7b2e2546fdddaae7c01abe0fa8a02be1
-
SHA512
b000502243b66e9dc535b0eb6fbd9212ba6adabc519c0ca4c44d65ace1c659efa8be12a843f480e3e8ff436246d919ba19e5307e9aedd81893b77343274d7735
-
SSDEEP
3072:XSww+ICvU0Qv8Z9yzvSh3gzaDKzHDa4cn2qTWM9gbYfNjh:XSwwPC08CzvSh3geOzm4cn2AWM9gb4
Score
7/10
Malware Config
Signatures
-
Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 198.153.194.1 Destination IP 68.4.16.30 Destination IP 68.11.16.30 Destination IP 64.81.159.2 Destination IP 68.4.16.25 Destination IP 208.67.222.222 Destination IP 66.92.159.2 Destination IP 66.92.224.2 Destination IP 68.10.16.25 Destination IP 68.6.16.25 Destination IP 156.154.70.1 Destination IP 68.111.16.30 Destination IP 9.9.9.9 Destination IP 24.113.32.30 Destination IP 68.12.16.30 Destination IP 216.231.41.2 Destination IP 68.87.64.154 Destination IP 66.93.87.2 Destination IP 156.154.71.1 Destination IP 216.27.175.2 Destination IP 68.13.16.30 Destination IP 4.2.2.5 Destination IP 129.250.35.250 Destination IP 4.2.2.2 Destination IP 4.2.2.4 Destination IP 66.92.64.2 Destination IP 74.118.212.1 Destination IP 204.117.214.10 Destination IP 208.67.222.220 Destination IP 68.87.68.170 Destination IP 68.100.16.30 Destination IP 64.81.45.2 Destination IP 64.81.79.2 Destination IP 68.2.16.30 Destination IP 208.67.222.123 Destination IP 68.6.16.30 Destination IP 208.67.220.123 Destination IP 68.9.16.30 Destination IP 68.11.16.25 Destination IP 156.154.70.25 Destination IP 209.55.1.220 Destination IP 1.0.0.1 Destination IP 68.13.16.25 Destination IP 156.154.71.22 Destination IP 4.2.2.6 Destination IP 208.67.220.222 Destination IP 198.41.0.4 Destination IP 24.113.32.29 Destination IP 64.81.111.2 Destination IP 74.118.212.2 Destination IP 216.254.95.2 Destination IP 68.1.18.25 Destination IP 68.87.69.154 Destination IP 198.153.192.1 Destination IP 208.67.220.220 Destination IP 64.81.127.2 Destination IP 68.10.16.30 Destination IP 199.2.252.10 Destination IP 204.194.232.200 Destination IP 68.1.18.30 Destination IP 68.100.16.25 Destination IP 68.111.16.25 Destination IP 129.250.35.251 Destination IP 204.194.234.200 -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 4832 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4832 AUDIODG.EXE