Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
240s -
max time network
435s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
02/05/2023, 18:29 UTC
General
-
Target
railway/Object/1/Estaciones/1 Pantitlan/top3.bmp
-
Size
256KB
-
MD5
803d73ecc8d08a6f5ec497bc94bcc475
-
SHA1
da6aaac6eae913b41e1502d89b99d2bf05525f3f
-
SHA256
94c4f2fc6f81e5b174b29fe136d706eaa1a1d4cda288fb0a7eee5316b061bca1
-
SHA512
badc3c186147eafe391fde6f01fd7d0a8ffd14c73a93e0734977202d3f9464e8ba26bec80104907cd4d844ccce117b6525e0968e2c541415f97492e46a005067
-
SSDEEP
6:KKlsECfffffffffffffffffffffffffffffffffffffffffffffffffffffffff3:K+/
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\railway\Object\1\Estaciones\1 Pantitlan\top3.bmp"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\railway\Object\1\Estaciones\1 Pantitlan\top3.bmp"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵
Network
-
DNS58.55.71.13.in-addr.arpaRemote address:8.8.8.8:53Request58.55.71.13.in-addr.arpaIN PTRResponse -
DNS254.1.248.8.in-addr.arpaRemote address:8.8.8.8:53Request254.1.248.8.in-addr.arpaIN PTRResponse
-
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
DNS50.23.12.20.in-addr.arpaRemote address:8.8.8.8:53Request50.23.12.20.in-addr.arpaIN PTRResponse
-
DNS206.23.85.13.in-addr.arpaRemote address:8.8.8.8:53Request206.23.85.13.in-addr.arpaIN PTRResponse
-
DNS0.77.109.52.in-addr.arpaRemote address:8.8.8.8:53Request0.77.109.52.in-addr.arpaIN PTRResponse
-
DNS228.249.119.40.in-addr.arpaRemote address:8.8.8.8:53Request228.249.119.40.in-addr.arpaIN PTRResponse
-
DNS241.150.49.20.in-addr.arpaRemote address:8.8.8.8:53Request241.150.49.20.in-addr.arpaIN PTRResponse
-
DNS192.3.40.23.in-addr.arpaRemote address:8.8.8.8:53Request192.3.40.23.in-addr.arpaIN PTRResponse192.3.40.23.in-addr.arpaIN PTRa23-40-3-192deploystaticakamaitechnologiescom
-
DNS178.223.142.52.in-addr.arpaRemote address:8.8.8.8:53Request178.223.142.52.in-addr.arpaIN PTRResponse
-
DNS72.32.126.40.in-addr.arpaRemote address:8.8.8.8:53Request72.32.126.40.in-addr.arpaIN PTRResponse
-
DNS104.219.191.52.in-addr.arpaRemote address:8.8.8.8:53Request104.219.191.52.in-addr.arpaIN PTRResponse
-
DNS6.173.189.20.in-addr.arpaRemote address:8.8.8.8:53Request6.173.189.20.in-addr.arpaIN PTRResponse
-
20.42.65.90:443
-
8.8.8.8:5358.55.71.13.in-addr.arpadns
DNS Request
58.55.71.13.in-addr.arpa
-
8.8.8.8:53254.1.248.8.in-addr.arpadns
DNS Request
254.1.248.8.in-addr.arpa
-
8.8.8.8:5395.221.229.192.in-addr.arpadns
DNS Request
95.221.229.192.in-addr.arpa
-
8.8.8.8:5350.23.12.20.in-addr.arpadns
DNS Request
50.23.12.20.in-addr.arpa
-
8.8.8.8:53206.23.85.13.in-addr.arpadns
DNS Request
206.23.85.13.in-addr.arpa
-
8.8.8.8:530.77.109.52.in-addr.arpadns
DNS Request
0.77.109.52.in-addr.arpa
-
8.8.8.8:53228.249.119.40.in-addr.arpadns
DNS Request
228.249.119.40.in-addr.arpa
-
8.8.8.8:53241.150.49.20.in-addr.arpadns
DNS Request
241.150.49.20.in-addr.arpa
-
8.8.8.8:53192.3.40.23.in-addr.arpadns
DNS Request
192.3.40.23.in-addr.arpa
-
8.8.8.8:53178.223.142.52.in-addr.arpadns
DNS Request
178.223.142.52.in-addr.arpa
-
8.8.8.8:5372.32.126.40.in-addr.arpadns
DNS Request
72.32.126.40.in-addr.arpa
-
8.8.8.8:53104.219.191.52.in-addr.arpadns
DNS Request
104.219.191.52.in-addr.arpa
-
8.8.8.8:536.173.189.20.in-addr.arpadns
DNS Request
6.173.189.20.in-addr.arpa