Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

1

Static

static

1

URLScan

urlscan

1

http://concordcc.cen...

windows10-2004-x64

1

Analysis

  • max time kernel
    135s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/05/2023, 22:47 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    http://concordcc.centrastage.net

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 25 IoCs
    adwarespyware
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://concordcc.centrastage.net
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3636
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3636 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2032

Network

  • flag-us
    DNS
    concordcc.centrastage.net
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    concordcc.centrastage.net
    IN A
    Response
    concordcc.centrastage.net
    IN A
    52.2.62.118
  • flag-us
    DNS
    228.249.119.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    228.249.119.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    concordcc.centrastage.net
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    concordcc.centrastage.net
    IN A
    Response
  • flag-us
    DNS
    126.20.238.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    126.20.238.8.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    142.145.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    142.145.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    76.38.195.152.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    76.38.195.152.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    13.86.106.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    13.86.106.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    200.197.79.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.197.79.204.in-addr.arpa
    IN PTR
    Response
    200.197.79.204.in-addr.arpa
    IN PTR
    a-0001a-msedgenet
  • flag-us
    DNS
    123.108.74.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    123.108.74.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    123.108.74.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    123.108.74.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    126.21.238.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    126.21.238.8.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    126.21.238.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    126.21.238.8.in-addr.arpa
    IN PTR
    Response
  • 52.2.62.118:80
    concordcc.centrastage.net
    IEXPLORE.EXE
    156 B
     3
  • 52.2.62.118:80
    concordcc.centrastage.net
    IEXPLORE.EXE
    156 B
     3
  • 52.2.62.118:80
    concordcc.centrastage.net
    IEXPLORE.EXE
    156 B
     3
  • 52.2.62.118:80
    concordcc.centrastage.net
    IEXPLORE.EXE
    156 B
     3
  • 40.125.122.176:443
    260 B
     5
  • 20.189.173.2:443
    322 B
     7
  • 40.125.122.176:443
    260 B
     5
  • 209.197.3.8:80
    322 B
     7
  • 209.197.3.8:80
    322 B
     7
  • 13.107.4.50:80
    322 B
     7
  • 173.223.113.164:443
    322 B
     7
  • 173.223.113.131:80
    322 B
     7
  • 204.79.197.203:80
    322 B
     7
  • 204.79.197.200:443
    ieonline.microsoft.com
    iexplore.exe
    156 B
     3
  • 40.125.122.176:443
    260 B
     5
  • 40.125.122.176:443
    260 B
     5
  • 40.125.122.176:443
    260 B
     5
  • 8.8.8.8:53
    concordcc.centrastage.net
    dns
    IEXPLORE.EXE
    71 B
     87 B
     1
    1

    DNS Request

    concordcc.centrastage.net

    DNS Response

    52.2.62.118

  • 8.8.8.8:53
    228.249.119.40.in-addr.arpa
    dns
    73 B
     159 B
     1
    1

    DNS Request

    228.249.119.40.in-addr.arpa

  • 8.8.8.8:53
    concordcc.centrastage.net
    dns
    IEXPLORE.EXE
    71 B
     71 B
     1
    1

    DNS Request

    concordcc.centrastage.net

  • 8.8.8.8:53
    126.20.238.8.in-addr.arpa
    dns
    71 B
     125 B
     1
    1

    DNS Request

    126.20.238.8.in-addr.arpa

  • 8.8.8.8:53
    142.145.190.20.in-addr.arpa
    dns
    73 B
     159 B
     1
    1

    DNS Request

    142.145.190.20.in-addr.arpa

  • 8.8.8.8:53
    76.38.195.152.in-addr.arpa
    dns
    72 B
     143 B
     1
    1

    DNS Request

    76.38.195.152.in-addr.arpa

  • 8.8.8.8:53
    13.86.106.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    13.86.106.20.in-addr.arpa

  • 8.8.8.8:53
    200.197.79.204.in-addr.arpa
    dns
    73 B
     106 B
     1
    1

    DNS Request

    200.197.79.204.in-addr.arpa

  • 8.8.8.8:53
    123.108.74.40.in-addr.arpa
    dns
    144 B
     292 B
     2
    2

    DNS Request

    123.108.74.40.in-addr.arpa

    DNS Request

    123.108.74.40.in-addr.arpa

  • 8.8.8.8:53
    126.21.238.8.in-addr.arpa
    dns
    142 B
     250 B
     2
    2

    DNS Request

    126.21.238.8.in-addr.arpa

    DNS Request

    126.21.238.8.in-addr.arpa

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YYL8D8JJ\suggestions[1].en-US
    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

    Download Submit

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.