Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

2f82266410...JC.exe

windows7-x64

1

2f82266410...JC.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/08/2023, 15:14 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2f822664107e39c75a110358c1142687_mafia_JC.exe

  • Size

    199KB

  • MD5

    2f822664107e39c75a110358c1142687

  • SHA1

    bc31aac8a32be0c9a4e9c08082d2c324f03aea29

  • SHA256

    c59e76375979f09a387a42dcfc3311a0214faf0368f5eacd6b6d0e6d74d41362

  • SHA512

    79bae31e85f178e8ced1e90be704a3431a1299873cdbb5b5b0ef06a9cf070da1e6380ced3a09c915652dd127d085ec44fc78307872b2b96df47a16b0ee41d716

  • SSDEEP

    3072:vfUomEuYm98dlSq7gt5q7Dx+XgS6aCEwhOfUbCalNT2pbB3fIL1Xi6FLPo3c:vfUauY68uSWCx+XA7mg2pNu1Ljo3c

Score
10/10
oskiinfostealerspywarestealer

Malware Config

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\2f822664107e39c75a110358c1142687_mafia_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\2f822664107e39c75a110358c1142687_mafia_JC.exe"
    1⤵
      PID:2520
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 1336
        2⤵
        • Program crash
        PID:1140
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2520 -ip 2520
      1⤵
        PID:4476

      Network

      • flag-us
        DNS
        2.136.104.51.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        2.136.104.51.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        254.139.241.8.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        254.139.241.8.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        71.159.190.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        71.159.190.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        95.221.229.192.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        95.221.229.192.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        158.240.127.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        158.240.127.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        146.78.124.51.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        146.78.124.51.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        103.169.127.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        103.169.127.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        18.31.95.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        18.31.95.13.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        63.13.109.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        63.13.109.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        10.179.89.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        10.179.89.13.in-addr.arpa
        IN PTR
        Response
      • 103.114.107.28:80
        2f822664107e39c75a110358c1142687_mafia_JC.exe
        260 B
         5
      • 103.114.107.28:80
        2f822664107e39c75a110358c1142687_mafia_JC.exe
        260 B
         5
      • 103.114.107.28:80
        2f822664107e39c75a110358c1142687_mafia_JC.exe
        260 B
         5
      • 103.114.107.28:80
        2f822664107e39c75a110358c1142687_mafia_JC.exe
        260 B
         5
      • 103.114.107.28:80
        2f822664107e39c75a110358c1142687_mafia_JC.exe
        260 B
         5
      • 103.114.107.28:80
        2f822664107e39c75a110358c1142687_mafia_JC.exe
        260 B
         5
      • 103.114.107.28:80
        2f822664107e39c75a110358c1142687_mafia_JC.exe
        260 B
         5
      • 8.8.8.8:53
        2.136.104.51.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        2.136.104.51.in-addr.arpa

      • 8.8.8.8:53
        254.139.241.8.in-addr.arpa
        dns
        72 B
         126 B
         1
        1

        DNS Request

        254.139.241.8.in-addr.arpa

      • 8.8.8.8:53
        71.159.190.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        71.159.190.20.in-addr.arpa

      • 8.8.8.8:53
        95.221.229.192.in-addr.arpa
        dns
        73 B
         144 B
         1
        1

        DNS Request

        95.221.229.192.in-addr.arpa

      • 8.8.8.8:53
        158.240.127.40.in-addr.arpa
        dns
        73 B
         147 B
         1
        1

        DNS Request

        158.240.127.40.in-addr.arpa

      • 8.8.8.8:53
        146.78.124.51.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        146.78.124.51.in-addr.arpa

      • 8.8.8.8:53
        103.169.127.40.in-addr.arpa
        dns
        73 B
         147 B
         1
        1

        DNS Request

        103.169.127.40.in-addr.arpa

      • 8.8.8.8:53
        18.31.95.13.in-addr.arpa
        dns
        70 B
         144 B
         1
        1

        DNS Request

        18.31.95.13.in-addr.arpa

      • 8.8.8.8:53
        63.13.109.52.in-addr.arpa
        dns
        71 B
         145 B
         1
        1

        DNS Request

        63.13.109.52.in-addr.arpa

      • 8.8.8.8:53
        10.179.89.13.in-addr.arpa
        dns
        71 B
         145 B
         1
        1

        DNS Request

        10.179.89.13.in-addr.arpa

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.