Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

c1210bfa51...79.exe

windows7-x64

7

c1210bfa51...79.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    1s
  • max time network
    6s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/10/2023, 07:55 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c1210bfa51de1eecc994cdfd73eac8222a3b7fb6e7fb68b98921fe99f6f2fd79.exe

  • Size

    6.2MB

  • MD5

    44964176a36d913c78fdcf6570ca10b5

  • SHA1

    c919e9b8779aa15465250adc386a80308d47fa11

  • SHA256

    c1210bfa51de1eecc994cdfd73eac8222a3b7fb6e7fb68b98921fe99f6f2fd79

  • SHA512

    c5a6b85001b4a4c351579f15be9892d77fb32ca7684ad01dc2f249a902f16dc912fd4224a982152e48e91b0b2922d0cae4a55021e7a8dd942b2e75a293c497e2

  • SSDEEP

    98304:kRiC10wxNleXTQwBA8aK9dmMZNBrpcFrPVyAEdjtw8TLhMhndN:/A0wET1AHKvmIrpctxEbfq

Score
7/10
vmprotect

Malware Config

Signatures

  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c1210bfa51de1eecc994cdfd73eac8222a3b7fb6e7fb68b98921fe99f6f2fd79.exe
    "C:\Users\Admin\AppData\Local\Temp\c1210bfa51de1eecc994cdfd73eac8222a3b7fb6e7fb68b98921fe99f6f2fd79.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:2664

Network

  • flag-us
    DNS
    67.31.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    67.31.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    2.136.104.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    2.136.104.51.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    241.154.82.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.154.82.20.in-addr.arpa
    IN PTR
    Response
No results found
  • 8.8.8.8:53
    67.31.126.40.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    67.31.126.40.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    2.136.104.51.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    2.136.104.51.in-addr.arpa

  • 8.8.8.8:53
    241.154.82.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    241.154.82.20.in-addr.arpa

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2664-0-0x0000000000400000-0x0000000000A50000-memory.dmp

    Filesize

    6.3MB

    Download

  • memory/2664-1-0x0000000010000000-0x0000000010038000-memory.dmp

    Filesize

    224KB

    Download

  • memory/2664-9-0x0000000000BF0000-0x0000000000C01000-memory.dmp

    Filesize

    68KB

    Download

  • memory/2664-15-0x0000000000C10000-0x0000000000C11000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2664-17-0x0000000000C10000-0x0000000000C11000-memory.dmp

    Filesize

    4KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.