Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

Phoenix.rar

windows10-1703-x64

3

Phoenix.rar

windows10-2004-x64

8

Phoenix/An...rp.dll

windows10-1703-x64

1

Phoenix/An...rp.dll

windows10-2004-x64

1

Phoenix/Co...le.dll

windows10-1703-x64

1

Phoenix/Co...le.dll

windows10-2004-x64

1

Phoenix/IC...ib.dll

windows10-1703-x64

1

Phoenix/IC...ib.dll

windows10-2004-x64

1

Phoenix/Ne...on.dll

windows10-1703-x64

1

Phoenix/Ne...on.dll

windows10-2004-x64

1

Phoenix/Phoenix.exe

windows10-1703-x64

1

Phoenix/Phoenix.exe

windows10-2004-x64

1

Phoenix/Phoenix.exe

windows10-1703-x64

1

Phoenix/Phoenix.exe

windows10-2004-x64

1

Phoenix/Ph...g.json

windows10-1703-x64

3

Phoenix/Ph...g.json

windows10-2004-x64

3

Phoenix/WebDriver.dll

windows10-1703-x64

1

Phoenix/WebDriver.dll

windows10-2004-x64

1

Phoenix/We...er.dll

windows10-1703-x64

1

Phoenix/We...er.dll

windows10-2004-x64

1

Phoenix/Wo...ns.txt

windows10-1703-x64

1

Phoenix/Wo...ns.txt

windows10-2004-x64

1

Phoenix/se...anager

windows10-1703-x64

1

Phoenix/se...anager

windows10-2004-x64

1

Phoenix/se...anager

windows10-1703-x64

1

Phoenix/se...anager

windows10-2004-x64

1

Phoenix/se...er.exe

windows10-1703-x64

1

Phoenix/se...er.exe

windows10-2004-x64

1

Resubmissions

23/09/2023, 23:40

230923-3n4p9scf28 8

Analysis

  • max time kernel
    361s
  • max time network
    1597s
  • platform
    windows10-1703_x64
  • resource
    win10-20230915-es
  • resource tags

    arch:x64arch:x86image:win10-20230915-eslocale:es-esos:windows10-1703-x64systemwindows
  • submitted
    23/09/2023, 23:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Phoenix/WorkingTokens.txt

  • Size

    72B

  • MD5

    605fb0eb86149575ddf8f1dfce9fe04f

  • SHA1

    572295f401facfca5cc7eb0a8daa52da7cc0f5c9

  • SHA256

    964cf36c864eacdbdc3c4cdd1ba6870b6e6ed1abc7f358e78ba436a16a38f900

  • SHA512

    450de9b00570a44f29aff68f1b4dc2f964f69594a1a81a43edf34e5c8ca5ca82c7b02748aa7ced8726961da3f96413f941e44703628f9d9ff9a04d7662498463

Score
1/10

Malware Config

Signatures

  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware

Processes

  • C:\Windows\system32\NOTEPAD.EXE
    C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\Phoenix\WorkingTokens.txt
    1⤵
    • Opens file in notepad (likely ransom note)
    PID:2880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads