Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

3

Static

static

3

inst_resx.zip

windows10-1703-x64

1

inst_resx.zip

windows10-2004-x64

1

Resubmissions

19/05/2023, 16:23 UTC

230519-tv7aasef77 3

19/05/2023, 16:21 UTC

230519-tt1q5aef69 3

Analysis

  • max time kernel
    100s
  • max time network
    104s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/05/2023, 16:23 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    inst_resx.zip

  • Size

    66.2MB

  • MD5

    d34f65d0bbff490281438e74c6be0a4e

  • SHA1

    30ace830f784ad33a009b5745d755e0be0bd59d0

  • SHA256

    35d739d9c31a74d75c2575335324b99c9af811db19c798e76e46da48abe86e87

  • SHA512

    f14becf0aa6d9f6e81f4ee35425ca338a4494bf48b203ff95ab1ab365e725dd84ad070248abd050fb28d06b55a3c8425b7885d5b80b6ee5a034f64d3375347c0

  • SSDEEP

    1572864:EyO8v9v6wyMQ8duzmkIAPMArN+d2svKMqxj0VxiWlvqSmjpc6RHHEgkGVi:j5FEDUArw2sWxjSkWfy1EglVi

Score
1/10

Malware Config

Signatures

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\inst_resx.zip
    1⤵
      PID:4912

    Network

    • flag-nl
      GET
      http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20TLS%20Issuing%20CA%2005.crl
      Remote address:
      173.223.113.131:80
      Request
      GET /pkiops/crl/Microsoft%20Azure%20TLS%20Issuing%20CA%2005.crl HTTP/1.1
      Connection: Keep-Alive
      Accept: */*
      User-Agent: Microsoft-CryptoAPI/10.0
      Host: www.microsoft.com
    • flag-nl
      GET
      http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20TLS%20Issuing%20CA%2005.crl
      Remote address:
      173.223.113.131:80
      Request
      GET /pkiops/crl/Microsoft%20Azure%20TLS%20Issuing%20CA%2005.crl HTTP/1.1
      Connection: Keep-Alive
      Accept: */*
      User-Agent: Microsoft-CryptoAPI/10.0
      Host: www.microsoft.com
      Response
      HTTP/1.1 200 OK
      Content-Length: 1977
      Content-Type: application/octet-stream
      Content-MD5: stPHsXwcMjWO3rsU2SFuDQ==
      Last-Modified: Fri, 19 May 2023 03:06:10 GMT
      ETag: 0x8DB5815FF79C748
      x-ms-request-id: ef8724dc-801e-000a-6bff-89e307000000
      x-ms-version: 2009-09-19
      x-ms-lease-status: unlocked
      x-ms-blob-type: BlockBlob
      Date: Fri, 19 May 2023 16:25:01 GMT
      Connection: keep-alive
      TLS_version: UNKNOWN
      ms-cv: CASMicrosoftCV53ad0c5a.0
      ms-cv-esi: CASMicrosoftCV53ad0c5a.0
      X-RTag: RT
    • flag-us
      DNS
      183.59.114.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      183.59.114.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      232.168.11.51.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      232.168.11.51.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      72.32.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      72.32.126.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      198.187.3.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      198.187.3.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      68.32.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      68.32.126.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      138.32.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      138.32.126.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      62.13.109.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      62.13.109.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.143.109.104.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.143.109.104.in-addr.arpa
      IN PTR
      Response
      95.143.109.104.in-addr.arpa
      IN PTR
      a104-109-143-95deploystaticakamaitechnologiescom
    • flag-us
      DNS
      134.121.24.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      134.121.24.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      58.55.71.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      58.55.71.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      113.238.32.23.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      113.238.32.23.in-addr.arpa
      IN PTR
      Response
      113.238.32.23.in-addr.arpa
      IN PTR
      a23-32-238-113deploystaticakamaitechnologiescom
    • 173.223.113.131:80
      http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20TLS%20Issuing%20CA%2005.crl
      http
      216 B
       40 B
       1
      1

      HTTP Request

      GET http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20TLS%20Issuing%20CA%2005.crl
    • 173.223.113.131:80
      http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20TLS%20Issuing%20CA%2005.crl
      http
      406 B
       2.6kB
       5
      4

      HTTP Request

      GET http://www.microsoft.com/pkiops/crl/Microsoft%20Azure%20TLS%20Issuing%20CA%2005.crl

      HTTP Response

      200
    • 209.197.3.8:80
      260 B
       5
    • 20.234.34.18:443
      tls
      7.0kB
       12
    • 20.40.136.238:443
      tls, https
      6.2kB
       8
    • 52.182.143.210:443
      322 B
       7
    • 117.18.237.29:80
      46 B
       1
    • 20.40.136.238:443
      46 B
       1
    • 117.18.237.29:80
      208 B
       4
    • 8.8.8.8:53
      183.59.114.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      183.59.114.20.in-addr.arpa

    • 8.8.8.8:53
      232.168.11.51.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      232.168.11.51.in-addr.arpa

    • 8.8.8.8:53
      72.32.126.40.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      72.32.126.40.in-addr.arpa

    • 8.8.8.8:53
      198.187.3.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      198.187.3.20.in-addr.arpa

    • 8.8.8.8:53
      68.32.126.40.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      68.32.126.40.in-addr.arpa

    • 8.8.8.8:53
      138.32.126.40.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      138.32.126.40.in-addr.arpa

    • 8.8.8.8:53
      62.13.109.52.in-addr.arpa
      dns
      71 B
       145 B
       1
      1

      DNS Request

      62.13.109.52.in-addr.arpa

    • 8.8.8.8:53
      95.143.109.104.in-addr.arpa
      dns
      73 B
       139 B
       1
      1

      DNS Request

      95.143.109.104.in-addr.arpa

    • 8.8.8.8:53
      134.121.24.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      134.121.24.20.in-addr.arpa

    • 8.8.8.8:53
      58.55.71.13.in-addr.arpa
      dns
      70 B
       144 B
       1
      1

      DNS Request

      58.55.71.13.in-addr.arpa

    • 8.8.8.8:53
      113.238.32.23.in-addr.arpa
      dns
      72 B
       137 B
       1
      1

      DNS Request

      113.238.32.23.in-addr.arpa

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.