Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    113s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/04/2023, 20:52 UTC

General

  • Target

    Cuphead-20230423T204732Z-001.zip

  • Size

    1.3MB

  • MD5

    d4cc7edb20f8faa85f938e7ff5e41d3a

  • SHA1

    06f8ffbf1bfe758ee14828979178a945d5adbf02

  • SHA256

    5bd23c4dc64b65701d8b7948d87f33c757db01fbd94446eb3bab9e1aea735ce1

  • SHA512

    a8c1f7ee5cbccbc0b870972651e9c7727ef566b9f85188d493946745f3c096b4198a163ce0713e24b084a3e25f204a8f2a82d4f2850d51be0ba356c77f902c06

  • SSDEEP

    24576:28li8rpc/7TgRjBLjo46zFKmIiHiGsaWOhg2lukS10DCIKFCPJNWu55gmf0:2r8rpEgRjBvo79iGgOqOAFCPzWf1

Score
1/10

Malware Config

Signatures

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Cuphead-20230423T204732Z-001.zip
    1⤵
      PID:4296

    Network

    • flag-us
      DNS
      149.220.183.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      149.220.183.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      8.3.197.209.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      8.3.197.209.in-addr.arpa
      IN PTR
      Response
      8.3.197.209.in-addr.arpa
      IN PTR
      vip0x008map2sslhwcdnnet
    • flag-us
      DNS
      171.39.242.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      171.39.242.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      171.39.242.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      171.39.242.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      2.36.159.162.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      2.36.159.162.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      63.13.109.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      63.13.109.52.in-addr.arpa
      IN PTR
      Response
    • 40.77.2.164:443
      260 B
      5
    • 8.238.179.126:80
      322 B
      7
    • 173.223.113.164:443
      322 B
      7
    • 173.223.113.131:80
      322 B
      7
    • 131.253.33.203:80
      322 B
      7
    • 13.107.42.16:443
      322 B
      7
    • 8.8.8.8:53
      149.220.183.52.in-addr.arpa
      dns
      73 B
      147 B
      1
      1

      DNS Request

      149.220.183.52.in-addr.arpa

    • 8.8.8.8:53
      8.3.197.209.in-addr.arpa
      dns
      70 B
      111 B
      1
      1

      DNS Request

      8.3.197.209.in-addr.arpa

    • 8.8.8.8:53
      171.39.242.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      171.39.242.20.in-addr.arpa

    • 8.8.8.8:53
      171.39.242.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      171.39.242.20.in-addr.arpa

    • 8.8.8.8:53
      2.36.159.162.in-addr.arpa
      dns
      71 B
      133 B
      1
      1

      DNS Request

      2.36.159.162.in-addr.arpa

    • 8.8.8.8:53
      63.13.109.52.in-addr.arpa
      dns
      71 B
      145 B
      1
      1

      DNS Request

      63.13.109.52.in-addr.arpa

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.