Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
-
submitted
30/06/2023, 12:46 UTC
General
-
Target
https://caioaraujo.vip/CXUUV/ardAbnbIhodickpenis.bin
Score
8/10
Malware Config
Signatures
-
Downloads MZ/PE file
-
Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
-
Modifies Internet Explorer settings 1 TTPs 27 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://caioaraujo.vip/CXUUV/ardAbnbIhodickpenis.bin1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2068 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
Network
-
DNScaioaraujo.vipRemote address:8.8.8.8:53Requestcaioaraujo.vipIN AResponsecaioaraujo.vipIN A188.114.97.0caioaraujo.vipIN A188.114.96.0 -
GEThttps://caioaraujo.vip/CXUUV/ardAbnbIhodickpenis.binRemote address:188.114.97.0:443RequestGET /CXUUV/ardAbnbIhodickpenis.bin HTTP/2.0
host: caioaraujo.vip
accept: text/html, application/xhtml+xml, image/jxr, */*
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate
ResponseHTTP/2.0 200
date: Fri, 30 Jun 2023 13:15:13 GMT
content-type: application/octet-stream
content-length: 536576
last-modified: Mon, 13 Dec 2021 10:11:23 GMT
cache-control: max-age=14400
cf-cache-status: HIT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aYtfD7kTfSe96HCEfjWPQZ5cTK0i7f4BaVxQytc4eQwoQIRmpqcMg0xbFUX3J6V6%2Fq6j92%2FDIOXjY0BYh3u5z6nz4Ai1m%2BcpX2J2FYEbzHT1ulh8%2BVU6zLiaX4MWSeQLkg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7df6ad405f5bb903-AMS
alt-svc: h3=":443"; ma=86400
-
DNS0.97.114.188.in-addr.arpaRemote address:8.8.8.8:53Request0.97.114.188.in-addr.arpaIN PTRResponse
-
DNSx2.c.lencr.orgRemote address:8.8.8.8:53Requestx2.c.lencr.orgIN AResponsex2.c.lencr.orgIN CNAMEcrl.root-x1.letsencrypt.org.edgekey.netcrl.root-x1.letsencrypt.org.edgekey.netIN CNAMEe8652.dscx.akamaiedge.nete8652.dscx.akamaiedge.netIN A23.222.33.142
-
GEThttp://x2.c.lencr.org/Remote address:23.222.33.142:80RequestGET / HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: x2.c.lencr.org
ResponseHTTP/1.1 200 OK
Server: nginx
Content-Type: application/pkix-crl
Last-Modified: Sat, 15 Apr 2023 00:28:13 GMT
ETag: "6439ef9d-12c"
Cache-Control: max-age=3600
Expires: Fri, 30 Jun 2023 14:15:13 GMT
Date: Fri, 30 Jun 2023 13:15:13 GMT
Content-Length: 300
Connection: keep-alive
-
DNS142.33.222.23.in-addr.arpaRemote address:8.8.8.8:53Request142.33.222.23.in-addr.arpaIN PTRResponse142.33.222.23.in-addr.arpaIN PTRa23-222-33-142deploystaticakamaitechnologiescom
-
DNS103.169.127.40.in-addr.arpaRemote address:8.8.8.8:53Request103.169.127.40.in-addr.arpaIN PTRResponse
-
DNS161.19.199.152.in-addr.arpaRemote address:8.8.8.8:53Request161.19.199.152.in-addr.arpaIN PTRResponse
-
DNS64.13.109.52.in-addr.arpaRemote address:8.8.8.8:53Request64.13.109.52.in-addr.arpaIN PTRResponse
-
DNS72.32.126.40.in-addr.arpaRemote address:8.8.8.8:53Request72.32.126.40.in-addr.arpaIN PTRResponse
-
DNS59.128.231.4.in-addr.arpaRemote address:8.8.8.8:53Request59.128.231.4.in-addr.arpaIN PTRResponse
-
DNS171.39.242.20.in-addr.arpaRemote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTR
-
DNS171.39.242.20.in-addr.arpaRemote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTR
-
DNS171.39.242.20.in-addr.arpaRemote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTR
-
DNS171.39.242.20.in-addr.arpaRemote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTR
-
DNS171.39.242.20.in-addr.arpaRemote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTR
-
DNS2.36.159.162.in-addr.arpaRemote address:8.8.8.8:53Request2.36.159.162.in-addr.arpaIN PTRResponse
-
DNS171.39.242.20.in-addr.arpaRemote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
DNS200.197.79.204.in-addr.arpaRemote address:8.8.8.8:53Request200.197.79.204.in-addr.arpaIN PTRResponse200.197.79.204.in-addr.arpaIN PTRa-0001a-msedgenet
-
DNS183.59.114.20.in-addr.arpaRemote address:8.8.8.8:53Request183.59.114.20.in-addr.arpaIN PTRResponse
-
DNS57.169.31.20.in-addr.arpaRemote address:8.8.8.8:53Request57.169.31.20.in-addr.arpaIN PTRResponse
-
DNS8.9.0.a.e.e.f.b.0.0.0.0.0.0.0.0.5.0.0.0.0.0.8.0.0.3.0.1.3.0.6.2.ip6.arpaRemote address:8.8.8.8:53Request8.9.0.a.e.e.f.b.0.0.0.0.0.0.0.0.5.0.0.0.0.0.8.0.0.3.0.1.3.0.6.2.ip6.arpaIN PTRResponse
-
DNS76.121.18.2.in-addr.arpaRemote address:8.8.8.8:53Request76.121.18.2.in-addr.arpaIN PTRResponse76.121.18.2.in-addr.arpaIN PTRa2-18-121-76deploystaticakamaitechnologiescom
-
DNS69.121.18.2.in-addr.arpaRemote address:8.8.8.8:53Request69.121.18.2.in-addr.arpaIN PTRResponse69.121.18.2.in-addr.arpaIN PTRa2-18-121-69deploystaticakamaitechnologiescom
-
192.229.221.95:80
-
192.229.221.95:80
-
93.184.221.240:80
-
93.184.221.240:80
-
188.114.97.0:443https://caioaraujo.vip/CXUUV/ardAbnbIhodickpenis.bintls, http2
HTTP Request
GET https://caioaraujo.vip/CXUUV/ardAbnbIhodickpenis.binHTTP Response
200 -
188.114.97.0:443caioaraujo.vip
-
23.222.33.142:80http://x2.c.lencr.org/http
HTTP Request
GET http://x2.c.lencr.org/HTTP Response
200 -
188.114.96.0:443caioaraujo.vip
-
188.114.97.0:443caioaraujo.viptls, http2
-
20.189.173.10:443
-
204.79.197.200:443ieonline.microsoft.com
-
204.79.197.200:443ieonline.microsoft.comtls, http2
-
93.184.221.240:80
-
93.184.221.240:80
-
8.8.8.8:53caioaraujo.vipdns
DNS Request
caioaraujo.vip
DNS Response
188.114.97.0188.114.96.0
-
8.8.8.8:530.97.114.188.in-addr.arpadns
DNS Request
0.97.114.188.in-addr.arpa
-
8.8.8.8:53x2.c.lencr.orgdns
DNS Request
x2.c.lencr.org
DNS Response
23.222.33.142
-
8.8.8.8:53142.33.222.23.in-addr.arpadns
DNS Request
142.33.222.23.in-addr.arpa
-
8.8.8.8:53103.169.127.40.in-addr.arpadns
DNS Request
103.169.127.40.in-addr.arpa
-
8.8.8.8:53161.19.199.152.in-addr.arpadns
DNS Request
161.19.199.152.in-addr.arpa
-
8.8.8.8:5364.13.109.52.in-addr.arpadns
DNS Request
64.13.109.52.in-addr.arpa
-
8.8.8.8:5372.32.126.40.in-addr.arpadns
DNS Request
72.32.126.40.in-addr.arpa
-
8.8.8.8:5359.128.231.4.in-addr.arpadns
DNS Request
59.128.231.4.in-addr.arpa
-
8.8.8.8:53171.39.242.20.in-addr.arpadns
DNS Request
171.39.242.20.in-addr.arpa
DNS Request
171.39.242.20.in-addr.arpa
DNS Request
171.39.242.20.in-addr.arpa
DNS Request
171.39.242.20.in-addr.arpa
DNS Request
171.39.242.20.in-addr.arpa
-
8.8.8.8:532.36.159.162.in-addr.arpadns
DNS Request
2.36.159.162.in-addr.arpa
-
8.8.8.8:53171.39.242.20.in-addr.arpadns
DNS Request
171.39.242.20.in-addr.arpa
-
8.8.8.8:53200.197.79.204.in-addr.arpadns
DNS Request
200.197.79.204.in-addr.arpa
-
8.8.8.8:53183.59.114.20.in-addr.arpadns
DNS Request
183.59.114.20.in-addr.arpa
-
8.8.8.8:5357.169.31.20.in-addr.arpadns
DNS Request
57.169.31.20.in-addr.arpa
-
8.8.8.8:538.9.0.a.e.e.f.b.0.0.0.0.0.0.0.0.5.0.0.0.0.0.8.0.0.3.0.1.3.0.6.2.ip6.arpadns
DNS Request
8.9.0.a.e.e.f.b.0.0.0.0.0.0.0.0.5.0.0.0.0.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa
-
8.8.8.8:5376.121.18.2.in-addr.arpadns
DNS Request
76.121.18.2.in-addr.arpa
-
8.8.8.8:5369.121.18.2.in-addr.arpadns
DNS Request
69.121.18.2.in-addr.arpa
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee