Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

23ac69eb03...01.exe

windows7-x64

8

23ac69eb03...01.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20230703-en
  • resource tags

    arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
  • submitted
    11/07/2023, 07:56 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    23ac69eb0388a0fc0828c9e41b769201.exe

  • Size

    23KB

  • MD5

    23ac69eb0388a0fc0828c9e41b769201

  • SHA1

    f61ed517f92b306df0ff2f185c0ab097c5dbf46d

  • SHA256

    7a78f5f7471015b05f36a45b9d53d05224e8b4796240c709c3a7067bd44bc543

  • SHA512

    84925b643e6613cf698d78d68235d3469969a6f3d4d1f640aa80926de2ce38d42e211bb2efa651d6528050ced0d96fd3d07bba433a057eaac8aa1d4be44d8e90

  • SSDEEP

    384:9dMK6b2GZsx/Yr1+liORH1kciFQ6Lg9gSOYRr9mRvR6JZlbw8hqIusZzZkz:9+b9glF51MRpcnul

Score
8/10
evasion

Malware Config

Signatures

  • Modifies Windows Firewall 1 TTPs 1 IoCs
    evasion
  • Drops startup file 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\23ac69eb0388a0fc0828c9e41b769201.exe
    "C:\Users\Admin\AppData\Local\Temp\23ac69eb0388a0fc0828c9e41b769201.exe"
    1⤵
    • Drops startup file
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2256
    • C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\23ac69eb0388a0fc0828c9e41b769201.exe" "23ac69eb0388a0fc0828c9e41b769201.exe" ENABLE
      2⤵
      • Modifies Windows Firewall
      PID:1256

Network

  • flag-us
    DNS
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    Remote address:
    8.8.8.8:53
    Request
    0.tcp.sa.ngrok.io
    IN A
    Response
    0.tcp.sa.ngrok.io
    IN A
    18.228.115.60
  • flag-us
    DNS
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    Remote address:
    8.8.8.8:53
    Request
    0.tcp.sa.ngrok.io
    IN A
    Response
    0.tcp.sa.ngrok.io
    IN A
    18.229.248.167
  • flag-us
    DNS
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    Remote address:
    8.8.8.8:53
    Request
    0.tcp.sa.ngrok.io
    IN A
    Response
    0.tcp.sa.ngrok.io
    IN A
    18.231.93.153
  • flag-us
    DNS
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    Remote address:
    8.8.8.8:53
    Request
    0.tcp.sa.ngrok.io
    IN A
    Response
    0.tcp.sa.ngrok.io
    IN A
    18.231.93.153
  • 18.228.115.60:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    528 B
     367 B
     5
    5
  • 18.228.115.60:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    528 B
     367 B
     5
    5
  • 18.228.115.60:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    528 B
     367 B
     5
    5
  • 18.228.115.60:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    528 B
     367 B
     5
    5
  • 18.228.115.60:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    528 B
     367 B
     5
    5
  • 18.228.115.60:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    528 B
     367 B
     5
    5
  • 18.228.115.60:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    528 B
     367 B
     5
    5
  • 18.228.115.60:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    528 B
     367 B
     5
    5
  • 18.228.115.60:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    528 B
     367 B
     5
    5
  • 18.228.115.60:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    528 B
     367 B
     5
    5
  • 18.228.115.60:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    528 B
     367 B
     5
    5
  • 18.228.115.60:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    528 B
     367 B
     5
    5
  • 18.228.115.60:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    528 B
     367 B
     5
    5
  • 18.228.115.60:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    528 B
     367 B
     5
    5
  • 18.228.115.60:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    528 B
     367 B
     5
    5
  • 18.228.115.60:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    528 B
     367 B
     5
    5
  • 18.228.115.60:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    528 B
     367 B
     5
    5
  • 18.228.115.60:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    528 B
     367 B
     5
    5
  • 18.228.115.60:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    528 B
     367 B
     5
    5
  • 18.228.115.60:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    528 B
     367 B
     5
    5
  • 18.229.248.167:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    528 B
     367 B
     5
    5
  • 18.229.248.167:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    528 B
     367 B
     5
    5
  • 18.229.248.167:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    528 B
     367 B
     5
    5
  • 18.229.248.167:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    528 B
     367 B
     5
    5
  • 18.229.248.167:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    528 B
     367 B
     5
    5
  • 18.229.248.167:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    528 B
     367 B
     5
    5
  • 18.229.248.167:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    528 B
     367 B
     5
    5
  • 18.229.248.167:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    528 B
     354 B
     5
    5
  • 18.229.248.167:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    528 B
     354 B
     5
    5
  • 18.229.248.167:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    528 B
     354 B
     5
    5
  • 18.229.248.167:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    528 B
     354 B
     5
    5
  • 18.229.248.167:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    528 B
     354 B
     5
    5
  • 18.229.248.167:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    528 B
     354 B
     5
    5
  • 18.229.248.167:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    528 B
     354 B
     5
    5
  • 18.229.248.167:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    528 B
     354 B
     5
    5
  • 18.229.248.167:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    528 B
     354 B
     5
    5
  • 18.229.248.167:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    528 B
     354 B
     5
    5
  • 18.229.248.167:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    482 B
     354 B
     4
    5
  • 18.229.248.167:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    528 B
     354 B
     5
    5
  • 18.229.248.167:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    528 B
     354 B
     5
    5
  • 18.231.93.153:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    528 B
     354 B
     5
    5
  • 18.231.93.153:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    528 B
     354 B
     5
    5
  • 18.231.93.153:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    528 B
     354 B
     5
    5
  • 18.231.93.153:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    528 B
     354 B
     5
    5
  • 18.231.93.153:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    528 B
     354 B
     5
    5
  • 18.231.93.153:17200
    0.tcp.sa.ngrok.io
    23ac69eb0388a0fc0828c9e41b769201.exe
    528 B
     354 B
     5
    5
  • 18.231.93.153:17200
    23ac69eb0388a0fc0828c9e41b769201.exe
  • 8.8.8.8:53
    0.tcp.sa.ngrok.io
    dns
    23ac69eb0388a0fc0828c9e41b769201.exe
    63 B
     79 B
     1
    1

    DNS Request

    0.tcp.sa.ngrok.io

    DNS Response

    18.228.115.60

  • 8.8.8.8:53
    0.tcp.sa.ngrok.io
    dns
    23ac69eb0388a0fc0828c9e41b769201.exe
    63 B
     79 B
     1
    1

    DNS Request

    0.tcp.sa.ngrok.io

    DNS Response

    18.229.248.167

  • 8.8.8.8:53
    0.tcp.sa.ngrok.io
    dns
    23ac69eb0388a0fc0828c9e41b769201.exe
    63 B
     79 B
     1
    1

    DNS Request

    0.tcp.sa.ngrok.io

    DNS Response

    18.231.93.153

  • 8.8.8.8:53
    0.tcp.sa.ngrok.io
    dns
    23ac69eb0388a0fc0828c9e41b769201.exe
    63 B
     79 B
     1
    1

    DNS Request

    0.tcp.sa.ngrok.io

    DNS Response

    18.231.93.153

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2256-54-0x0000000000F90000-0x0000000000FD0000-memory.dmp

    Filesize

    256KB

    Download

  • memory/2256-56-0x0000000000F90000-0x0000000000FD0000-memory.dmp

    Filesize

    256KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.