Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
11/10/2023, 23:48 UTC
General
-
Target
Vievsp.dll
-
Size
583KB
-
MD5
e57ccafa9f8c49657073add0d0536e42
-
SHA1
77e9056492e97c49ea2bd9294abcfc03eeee0772
-
SHA256
766653b6e5db8d5ffc46735bc95d73aa75ec2e3776136076f76a1fd6483518c5
-
SHA512
1f923e2c3e31fa923fe51082fad57c2abb4b1f82f31919ecc010066354d2af8202d9e79a1864fa586145efd891b37287619abb39ec3c3930be86d0f05d496885
-
SSDEEP
12288:pjan3B7+2BoGEwYXorDxBDWgyv9cii8VPezCTr:Mn3B7+2ByJo/DWz9cS2zW
Malware Config
Signatures
-
Modifies registry class 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\Vievsp.dll1⤵
- Modifies registry class
Network
-
DNSjkbarmossen.comRemote address:8.8.8.8:53Requestjkbarmossen.comIN AResponsejkbarmossen.comIN A173.255.204.62 -
DNSevinakortu.comRemote address:8.8.8.8:53Requestevinakortu.comIN AResponseevinakortu.comIN A94.232.46.27
-
DNShofsaalos.comRemote address:8.8.8.8:53Requesthofsaalos.comIN AResponsehofsaalos.comIN A92.118.112.113
-
DNSskrechelres.comRemote address:8.8.8.8:53Requestskrechelres.comIN AResponse
-
DNSskrechelres.comRemote address:8.8.8.8:53Requestskrechelres.comIN AResponse
-
DNSjerryposter.comRemote address:8.8.8.8:53Requestjerryposter.comIN AResponsejerryposter.comIN A77.105.140.181
-
POSThttps://jerryposter.com/news/1/255/0Remote address:77.105.140.181:443RequestPOST /news/1/255/0 HTTP/1.1
Connection: Keep-Alive
Content-Type: application/octet-stream
Authorization: Basic MzYxODkzODcyOjM2MzY0MTYwMjM6MTExOjY2OjE=
Cookie: session=MDowOjA6MzA0OjA=
Content-Length: 332
Host: jerryposter.com
ResponseHTTP/1.1 200 OK
Server: nginx
Date: Wed, 11 Oct 2023 23:51:56 GMT
Content-Type: text/plain
Content-Length: 9
Connection: keep-alive
-
GEThttps://jerryposter.com/news/18/255/0Remote address:77.105.140.181:443RequestGET /news/18/255/0 HTTP/1.1
Connection: Keep-Alive
Authorization: Basic MzYxODkzODcyOjM2MzY0MTYwMjM6MTExOjY2OjE=
Host: jerryposter.com
ResponseHTTP/1.1 200 OK
Server: nginx
Date: Wed, 11 Oct 2023 23:51:57 GMT
Content-Type: application/octet-stream
Transfer-Encoding: chunked
Connection: keep-alive
-
173.255.204.62:443jkbarmossen.comtls
-
94.232.46.27:443evinakortu.com -
92.118.112.113:443hofsaalos.com
-
77.105.140.181:443https://jerryposter.com/news/18/255/0tls, http
HTTP Request
POST https://jerryposter.com/news/1/255/0HTTP Response
200HTTP Request
GET https://jerryposter.com/news/18/255/0HTTP Response
200
-
8.8.8.8:53jkbarmossen.comdns
DNS Request
jkbarmossen.com
DNS Response
173.255.204.62
-
8.8.8.8:53evinakortu.comdns
DNS Request
evinakortu.com
DNS Response
94.232.46.27
-
8.8.8.8:53hofsaalos.comdns
DNS Request
hofsaalos.com
DNS Response
92.118.112.113
-
8.8.8.8:53skrechelres.comdns
DNS Request
skrechelres.com
DNS Request
skrechelres.com
-
8.8.8.8:53jerryposter.comdns
DNS Request
jerryposter.com
DNS Response
77.105.140.181
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
316KB
-
Filesize
304KB
-
Filesize
316KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB