Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
83s -
max time network
197s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
31/05/2023, 20:03 UTC
General
-
Target
http://rwin.show
Score
1/10
Malware Config
Signatures
-
Modifies Internet Explorer settings 1 TTPs 39 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://rwin.show1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:684 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
Network
-
DNS97.97.242.52.in-addr.arpaRemote address:8.8.8.8:53Request97.97.242.52.in-addr.arpaIN PTRResponse -
DNSrwin.showRemote address:8.8.8.8:53Requestrwin.showIN AResponserwin.showIN A104.21.43.141rwin.showIN A172.67.180.52
-
DNS254.1.248.8.in-addr.arpaRemote address:8.8.8.8:53Request254.1.248.8.in-addr.arpaIN PTRResponse
-
DNS13.86.106.20.in-addr.arpaRemote address:8.8.8.8:53Request13.86.106.20.in-addr.arpaIN PTRResponse
-
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
GEThttp://rwin.show/Remote address:104.21.43.141:80RequestGET / HTTP/1.1
Accept: text/html, application/xhtml+xml, image/jxr, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: rwin.show
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Date: Wed, 31 May 2023 20:05:17 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Tue, 30 May 2023 12:07:36 GMT
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=g7QBfqGCP%2Foq7c4jfh9z4V0i6naYYklK3iabYnGByXE%2FG%2BASV5zGj6mGq3RwnQqbOhq5y52pqN5TePPjN8jYeH17uun9jrdBKf8%2FCbWNZwlN07YfNtL0wmzrNjE%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 7d01d4af898db779-AMS
Content-Encoding: gzip
alt-svc: h3=":443"; ma=86400
-
GEThttp://rwin.show/main.jsRemote address:104.21.43.141:80RequestGET /main.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: http://rwin.show/
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: rwin.show
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Date: Wed, 31 May 2023 20:05:17 GMT
Content-Type: text/plain
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Tue, 30 May 2023 12:07:18 GMT
ETag: W/"6475e6f6-398"
Cache-Control: max-age=14400
CF-Cache-Status: HIT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=obmOv1iDss3zt1BKmG3cYCXmpMfAzLtLOYcro5%2BnrnVTJkl%2FyAbdRALTEHpruTeSKZnkEhBOAebqtK6u0b1M5LvDdqVWzDpk9L%2FjGHUE4nzUehEzYC8GL45k0iw%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7d01d4b20c27b779-AMS
Content-Encoding: gzip
alt-svc: h3=":443"; ma=86400
-
GEThttp://rwin.show/favicon.icoRemote address:104.21.43.141:80RequestGET /favicon.ico HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Host: rwin.show
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Date: Wed, 31 May 2023 20:05:19 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Tue, 30 May 2023 12:07:36 GMT
Cache-Control: max-age=14400
CF-Cache-Status: HIT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XPIWOJBM1o3f%2BGFa1ntlVZiDorfVa3RlXvOdsxjltH1%2B1NgP3aXj7Tgbqec1UqbIUwtB%2F%2FclVIBwBnXHsrL2AQdhcUxwuj06QOl3iFPOZRTobJ%2FoED%2FqpRT4Gao%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7d01d4bb3d45b779-AMS
Content-Encoding: gzip
alt-svc: h3=":443"; ma=86400
-
DNS141.43.21.104.in-addr.arpaRemote address:8.8.8.8:53Request141.43.21.104.in-addr.arpaIN PTRResponse
-
DNS76.38.195.152.in-addr.arpaRemote address:8.8.8.8:53Request76.38.195.152.in-addr.arpaIN PTRResponse
-
DNS241.150.49.20.in-addr.arpaRemote address:8.8.8.8:53Request241.150.49.20.in-addr.arpaIN PTRResponse
-
DNS200.232.18.117.in-addr.arpaRemote address:8.8.8.8:53Request200.232.18.117.in-addr.arpaIN PTRResponse
-
DNS97.17.167.52.in-addr.arpaRemote address:8.8.8.8:53Request97.17.167.52.in-addr.arpaIN PTRResponse
-
DNS62.13.109.52.in-addr.arpaRemote address:8.8.8.8:53Request62.13.109.52.in-addr.arpaIN PTRResponse
-
DNS200.197.79.204.in-addr.arpaRemote address:8.8.8.8:53Request200.197.79.204.in-addr.arpaIN PTRResponse200.197.79.204.in-addr.arpaIN PTRa-0001a-msedgenet
-
DNS183.59.114.20.in-addr.arpaRemote address:8.8.8.8:53Request183.59.114.20.in-addr.arpaIN PTRResponse
-
DNS183.59.114.20.in-addr.arpaRemote address:8.8.8.8:53Request183.59.114.20.in-addr.arpaIN PTRResponse
-
DNS171.39.242.20.in-addr.arpaRemote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
104.21.43.141:80http://rwin.show/favicon.icohttp
HTTP Request
GET http://rwin.show/HTTP Response
200HTTP Request
GET http://rwin.show/main.jsHTTP Response
200HTTP Request
GET http://rwin.show/favicon.icoHTTP Response
200 -
104.21.43.141:80rwin.show
-
52.242.101.226:443
-
51.11.192.49:443 -
52.242.101.226:443
-
117.18.232.240:80
-
204.79.197.200:443ieonline.microsoft.comtls, http2
-
117.18.232.240:80
-
117.18.232.240:80
-
117.18.232.240:80
-
173.223.113.164:443
-
8.8.8.8:5397.97.242.52.in-addr.arpadns
DNS Request
97.97.242.52.in-addr.arpa
-
8.8.8.8:53rwin.showdns
DNS Request
rwin.show
DNS Response
104.21.43.141172.67.180.52
-
8.8.8.8:53254.1.248.8.in-addr.arpadns
DNS Request
254.1.248.8.in-addr.arpa
-
8.8.8.8:5313.86.106.20.in-addr.arpadns
DNS Request
13.86.106.20.in-addr.arpa
-
8.8.8.8:5395.221.229.192.in-addr.arpadns
DNS Request
95.221.229.192.in-addr.arpa
-
8.8.8.8:53141.43.21.104.in-addr.arpadns
DNS Request
141.43.21.104.in-addr.arpa
-
8.8.8.8:5376.38.195.152.in-addr.arpadns
DNS Request
76.38.195.152.in-addr.arpa
-
8.8.8.8:53241.150.49.20.in-addr.arpadns
DNS Request
241.150.49.20.in-addr.arpa
-
8.8.8.8:53200.232.18.117.in-addr.arpadns
DNS Request
200.232.18.117.in-addr.arpa
-
8.8.8.8:5397.17.167.52.in-addr.arpadns
DNS Request
97.17.167.52.in-addr.arpa
-
8.8.8.8:5362.13.109.52.in-addr.arpadns
DNS Request
62.13.109.52.in-addr.arpa
-
8.8.8.8:53200.197.79.204.in-addr.arpadns
DNS Request
200.197.79.204.in-addr.arpa
-
8.8.8.8:53183.59.114.20.in-addr.arpadns
DNS Request
183.59.114.20.in-addr.arpa
DNS Request
183.59.114.20.in-addr.arpa
-
8.8.8.8:53171.39.242.20.in-addr.arpadns
DNS Request
171.39.242.20.in-addr.arpa
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
471B
MD5080320bb3fe7e7f860019942e6f77f9c
SHA12d6f3813b1ed7972c01df6330eb3b0c30339eda9
SHA2569eb11d5a62c35054e50d193211638a08c9b94d5b360f943df4124e28ab793a6f
SHA5129def7fa57fc58af72dc374f0ca010107585a355ffcb3c1d3b99064a455acf3fe8ed7d42052234fe2d042b5ccda8af4ba16a8b2dd882b01f0be7edb8cf7aa8944
-
Filesize
404B
MD567e6b7c96bf5053db4fc7d4fafaa6f5c
SHA16e92de695b819620751f4cc63b8e34b73bb1405a
SHA2562dda412bbec565afc876a9ca9ed63104d71c5ce7b6021dc9258dc934ee8653ee
SHA5126704a3c13fbe30ce803079aa0a4dbf1865c5a740a345015e5e4dc7f47a02d4172bd35d240c05f325bef6bf68d5c143e06f5cb9fb4bc3ba6e03025ad71e7b8d42
-
Filesize
1KB
MD50ce8fa73af17deabfcfce5e7a87d42f3
SHA12e00929ae2a323fdad141f035af6a016a49eedf6
SHA2569cbed088f1896e44d7a8e2eebff4b3853053cdbc4e76aad74652abdaec3aff16
SHA512e7f13e6c79e1b6d34dfa8ef18e2cb261627fafeece43808182ec0fd9453f7c42ea1152ac5b94692f18ac2aaa904cfaa7fb21139feab5f588292c95ecce224435
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee