Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

7

trojan-lea...35.exe

windows7-x64

8

trojan-lea...35.exe

windows10-2004-x64

8

trojan-lea...07.exe

windows7-x64

8

trojan-lea...07.exe

windows10-2004-x64

8

trojan-lea...NT.rar

windows7-x64

3

trojan-lea...NT.rar

windows10-2004-x64

3

trojan-lea...1).zip

windows7-x64

1

trojan-lea...1).zip

windows10-2004-x64

1

trojan-lea...ys.exe

windows7-x64

7

trojan-lea...ys.exe

windows10-2004-x64

7

trojan-lea...0S.z01

windows7-x64

3

trojan-lea...0S.z01

windows10-2004-x64

3

trojan-lea...0S.z02

windows7-x64

3

trojan-lea...0S.z02

windows10-2004-x64

3

trojan-lea...0S.z03

windows7-x64

3

trojan-lea...0S.z03

windows10-2004-x64

3

trojan-lea...0S.zip

windows7-x64

1

trojan-lea...0S.zip

windows10-2004-x64

1

trojan-lea...er.exe

windows7-x64

3

trojan-lea...er.exe

windows10-2004-x64

8

trojan-lea...re.zip

windows7-x64

1

trojan-lea...re.zip

windows10-2004-x64

1

trojan-lea...32.exe

windows7-x64

10

trojan-lea...32.exe

windows10-2004-x64

trojan-lea...32.exe

windows7-x64

trojan-lea...32.exe

windows10-2004-x64

trojan-lea...64.exe

windows7-x64

trojan-lea...64.exe

windows10-2004-x64

trojan-lea...ne.exe

windows7-x64

1

trojan-lea...ne.exe

windows10-2004-x64

1

trojan-lea...64.exe

windows7-x64

1

trojan-lea...64.exe

windows10-2004-x64

1

Resubmissions

09/05/2023, 19:22 UTC

230509-x3fn4adg58 10

09/05/2023, 19:14 UTC

230509-xxsrgaff7x 10

09/05/2023, 19:14 UTC

230509-xxr5yadg42 7

09/05/2023, 19:14 UTC

230509-xxrt6sff7w 8

09/05/2023, 19:14 UTC

230509-xxrjeaff7v 8

09/05/2023, 19:14 UTC

230509-xxqxwadg39 7

09/05/2023, 19:14 UTC

230509-xxql4sff7t 10

09/05/2023, 19:14 UTC

230509-xxqbcadg38 7

09/05/2023, 19:10 UTC

230509-xvl6xadf64 10

Analysis

  • max time kernel
    151s
  • max time network
    191s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/05/2023, 19:22 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    trojan-leaks-main/AnCo250S.z01

  • Size

    24.0MB

  • MD5

    caf52c6eeabe95f8d3f8f8923a2977d6

  • SHA1

    5470d110ef71c8be4341a3f40d066b938b989b5c

  • SHA256

    1c94a2385b950919ba3760d551ddba9e471c6706a4b8b26504b1dd048d8abf37

  • SHA512

    175417b60d8c40c5761c858199aac5ac308085dcfeb4e4284542d0e2d3b92b4e218eedcae85f0a8e0fe9d1e9c018c05701241b449fd2191088d580de99f80941

  • SSDEEP

    393216:kJVfn85zXCJ5P3+ix6+fOigTl1odisR7QLMvLj0qO0SmUVWUdOVi3/dKtrvK9t2P:kWuSj+puodisRkQSmnfs3Kry9ti

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\AnCo250S.z01
    1⤵
    • Modifies registry class
    PID:4012
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3712

Network

  • flag-us
    DNS
    42.220.44.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    42.220.44.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    154.239.44.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    154.239.44.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    76.38.195.152.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    76.38.195.152.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    20.160.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    20.160.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    233.141.123.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    233.141.123.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    196.249.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    196.249.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    8.3.197.209.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.3.197.209.in-addr.arpa
    IN PTR
    Response
    8.3.197.209.in-addr.arpa
    IN PTR
    vip0x008map2sslhwcdnnet
  • 52.182.141.63:443
    322 B
     7
  • 173.223.113.164:443
    322 B
     7
  • 204.79.197.203:80
    322 B
     7
  • 13.107.4.50:80
    322 B
     7
  • 52.152.110.14:443
    260 B
     5
  • 52.152.110.14:443
    260 B
     5
  • 52.152.110.14:443
    260 B
     5
  • 52.152.110.14:443
    260 B
     5
  • 52.152.110.14:443
    260 B
     5
  • 52.152.110.14:443
    260 B
     5
  • 52.152.110.14:443
    52 B
     1
  • 8.8.8.8:53
    42.220.44.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    42.220.44.20.in-addr.arpa

  • 8.8.8.8:53
    154.239.44.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    154.239.44.20.in-addr.arpa

  • 8.8.8.8:53
    76.38.195.152.in-addr.arpa
    dns
    72 B
     143 B
     1
    1

    DNS Request

    76.38.195.152.in-addr.arpa

  • 8.8.8.8:53
    20.160.190.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    20.160.190.20.in-addr.arpa

  • 8.8.8.8:53
    233.141.123.20.in-addr.arpa
    dns
    73 B
     159 B
     1
    1

    DNS Request

    233.141.123.20.in-addr.arpa

  • 8.8.8.8:53
    196.249.167.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    196.249.167.52.in-addr.arpa

  • 8.8.8.8:53
    8.3.197.209.in-addr.arpa
    dns
    70 B
     111 B
     1
    1

    DNS Request

    8.3.197.209.in-addr.arpa

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.