Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

5f144b5c59...41.exe

windows7-x64

7

5f144b5c59...41.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    13/10/2023, 22:04 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5f144b5c595441bee0111a44da33e6933087898f52fc7b9ac0bc1e92b548b341.exe

  • Size

    367KB

  • MD5

    fd504368a55c9c18596bc73d503d9bad

  • SHA1

    1611ac879df371a8ac1de17ca6813f4684f7f44b

  • SHA256

    5f144b5c595441bee0111a44da33e6933087898f52fc7b9ac0bc1e92b548b341

  • SHA512

    9c55efb642a096dd0fca9633f60858fd9df8fcb771576da02685ffd01984f1c652b8ae141ffbca1e95fd7613b49d8d6cf2c02e6e0628bc87ea349bca15b6d1c4

  • SSDEEP

    6144:hIgPXkuqyyrhzchRYL+RBhtIJDmazKrLu:hvFqyy6tptI7eu

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Kills process with taskkill 1 IoCs
    evasion
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5f144b5c595441bee0111a44da33e6933087898f52fc7b9ac0bc1e92b548b341.exe
    "C:\Users\Admin\AppData\Local\Temp\5f144b5c595441bee0111a44da33e6933087898f52fc7b9ac0bc1e92b548b341.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2196
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /im "5f144b5c595441bee0111a44da33e6933087898f52fc7b9ac0bc1e92b548b341.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\5f144b5c595441bee0111a44da33e6933087898f52fc7b9ac0bc1e92b548b341.exe" & exit
      2⤵
      • Deletes itself
      • Suspicious use of WriteProcessMemory
      PID:2644
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /im "5f144b5c595441bee0111a44da33e6933087898f52fc7b9ac0bc1e92b548b341.exe" /f
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2580

Network

  • flag-us
    DNS
    script.google.com
    5f144b5c595441bee0111a44da33e6933087898f52fc7b9ac0bc1e92b548b341.exe
    Remote address:
    8.8.8.8:53
    Request
    script.google.com
    IN A
    Response
    script.google.com
    IN A
    172.217.23.206
  • flag-de
    GET
    http://script.google.com/macros/s/AKfycbxu6XZln0F2VKs8FMpn924RlKozFV5XZApwvto57voh-zMdTnkCnYo38kxDLRAyW0hb/exec?xfgnxfgn&stream=5&ip=NOIP&slots=2222&param=empty
    5f144b5c595441bee0111a44da33e6933087898f52fc7b9ac0bc1e92b548b341.exe
    Remote address:
    172.217.23.206:80
    Request
    GET /macros/s/AKfycbxu6XZln0F2VKs8FMpn924RlKozFV5XZApwvto57voh-zMdTnkCnYo38kxDLRAyW0hb/exec?xfgnxfgn&stream=5&ip=NOIP&slots=2222&param=empty HTTP/1.1
    Connection: Keep-Alive
    Content-Type: application/x-www-form-urlencoded
    Host: script.google.com
    Response
    HTTP/1.1 301 Moved Permanently
    Content-Type: text/html; charset=UTF-8
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: Mon, 01 Jan 1990 00:00:00 GMT
    Date: Sat, 14 Oct 2023 09:15:59 GMT
    Location: https://script.google.com/macros/s/AKfycbxu6XZln0F2VKs8FMpn924RlKozFV5XZApwvto57voh-zMdTnkCnYo38kxDLRAyW0hb/exec?xfgnxfgn&stream=5&ip=NOIP&slots=2222&param=empty
    X-Content-Type-Options: nosniff
    X-Frame-Options: SAMEORIGIN
    Content-Security-Policy: frame-ancestors 'self'
    X-XSS-Protection: 1; mode=block
    Server: GSE
    Accept-Ranges: none
    Vary: Accept-Encoding
    Transfer-Encoding: chunked
  • flag-de
    GET
    https://script.google.com/macros/s/AKfycbxu6XZln0F2VKs8FMpn924RlKozFV5XZApwvto57voh-zMdTnkCnYo38kxDLRAyW0hb/exec?xfgnxfgn&stream=5&ip=NOIP&slots=2222&param=empty
    5f144b5c595441bee0111a44da33e6933087898f52fc7b9ac0bc1e92b548b341.exe
    Remote address:
    172.217.23.206:443
    Request
    GET /macros/s/AKfycbxu6XZln0F2VKs8FMpn924RlKozFV5XZApwvto57voh-zMdTnkCnYo38kxDLRAyW0hb/exec?xfgnxfgn&stream=5&ip=NOIP&slots=2222&param=empty HTTP/1.1
    Connection: Keep-Alive
    Content-Type: application/x-www-form-urlencoded
    Host: script.google.com
    Response
    HTTP/1.1 302 Moved Temporarily
    Content-Type: text/html; charset=UTF-8
    Access-Control-Allow-Origin: *
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: Mon, 01 Jan 1990 00:00:00 GMT
    Date: Sat, 14 Oct 2023 09:16:01 GMT
    Location: https://script.googleusercontent.com/macros/echo?user_content_key=raXAAC01xgieAeehMpK7YF6Cly2FD5_eFDkvoQq6O2noRC-lbXW9hNYB_cAleaot3Dv-kT6vOOlb_-RuUiARtLgpWaIb4q6bOJmA1Yb3SEsKFZqtv3DaNYcMrmhZHmUMWojr9NvTBuBLhyHCd5hHa_kSw3KJAyZKK3RTU5bpIFQ10ckTyHVSt1vTS5MZ6zqvS4V0cmy1dEEXVXg5zXDjcYCeAylu8DyVhn7i0fteRV_StcynBwb4deQK9NYe9nyjGugVZE-wIMxqgQX8JhELwW1HKFlogGMzl5YZMv-zanmfUJ0nV5QOX3d-7DXRm3Ta&lib=MAg_X_j8YJSR0PZgL-LNb21v93CYKtC0D
    X-Content-Type-Options: nosniff
    X-Frame-Options: SAMEORIGIN
    Content-Security-Policy: frame-ancestors 'self'
    X-XSS-Protection: 1; mode=block
    Server: GSE
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
    Accept-Ranges: none
    Vary: Accept-Encoding
    Transfer-Encoding: chunked
  • flag-us
    DNS
    script.googleusercontent.com
    5f144b5c595441bee0111a44da33e6933087898f52fc7b9ac0bc1e92b548b341.exe
    Remote address:
    8.8.8.8:53
    Request
    script.googleusercontent.com
    IN A
    Response
    script.googleusercontent.com
    IN CNAME
    googlehosted.l.googleusercontent.com
    googlehosted.l.googleusercontent.com
    IN A
    142.251.36.1
  • flag-nl
    GET
    https://script.googleusercontent.com/macros/echo?user_content_key=raXAAC01xgieAeehMpK7YF6Cly2FD5_eFDkvoQq6O2noRC-lbXW9hNYB_cAleaot3Dv-kT6vOOlb_-RuUiARtLgpWaIb4q6bOJmA1Yb3SEsKFZqtv3DaNYcMrmhZHmUMWojr9NvTBuBLhyHCd5hHa_kSw3KJAyZKK3RTU5bpIFQ10ckTyHVSt1vTS5MZ6zqvS4V0cmy1dEEXVXg5zXDjcYCeAylu8DyVhn7i0fteRV_StcynBwb4deQK9NYe9nyjGugVZE-wIMxqgQX8JhELwW1HKFlogGMzl5YZMv-zanmfUJ0nV5QOX3d-7DXRm3Ta&lib=MAg_X_j8YJSR0PZgL-LNb21v93CYKtC0D
    5f144b5c595441bee0111a44da33e6933087898f52fc7b9ac0bc1e92b548b341.exe
    Remote address:
    142.251.36.1:443
    Request
    GET /macros/echo?user_content_key=raXAAC01xgieAeehMpK7YF6Cly2FD5_eFDkvoQq6O2noRC-lbXW9hNYB_cAleaot3Dv-kT6vOOlb_-RuUiARtLgpWaIb4q6bOJmA1Yb3SEsKFZqtv3DaNYcMrmhZHmUMWojr9NvTBuBLhyHCd5hHa_kSw3KJAyZKK3RTU5bpIFQ10ckTyHVSt1vTS5MZ6zqvS4V0cmy1dEEXVXg5zXDjcYCeAylu8DyVhn7i0fteRV_StcynBwb4deQK9NYe9nyjGugVZE-wIMxqgQX8JhELwW1HKFlogGMzl5YZMv-zanmfUJ0nV5QOX3d-7DXRm3Ta&lib=MAg_X_j8YJSR0PZgL-LNb21v93CYKtC0D HTTP/1.1
    Connection: Keep-Alive
    Content-Type: application/x-www-form-urlencoded
    Host: script.googleusercontent.com
    Response
    HTTP/1.1 200 OK
    Content-Type: text/plain; charset=utf-8
    Access-Control-Allow-Origin: *
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: Mon, 01 Jan 1990 00:00:00 GMT
    Date: Sat, 14 Oct 2023 09:16:01 GMT
    X-Content-Type-Options: nosniff
    X-Frame-Options: SAMEORIGIN
    Content-Security-Policy: frame-ancestors 'self'
    X-XSS-Protection: 1; mode=block
    Server: GSE
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
    Accept-Ranges: none
    Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding
    Transfer-Encoding: chunked
  • flag-us
    DNS
    trk.srcstat.com
    5f144b5c595441bee0111a44da33e6933087898f52fc7b9ac0bc1e92b548b341.exe
    Remote address:
    8.8.8.8:53
    Request
    trk.srcstat.com
    IN A
    Response
    trk.srcstat.com
    IN CNAME
    xxe82.bmtrck.com
    xxe82.bmtrck.com
    IN A
    52.204.19.219
  • flag-us
    GET
    http://trk.srcstat.com/postback?cid=REPLACE&payout=OPTIONAL&txid=OPTIONAL
    5f144b5c595441bee0111a44da33e6933087898f52fc7b9ac0bc1e92b548b341.exe
    Remote address:
    52.204.19.219:80
    Request
    GET /postback?cid=REPLACE&payout=OPTIONAL&txid=OPTIONAL HTTP/1.1
    Connection: Keep-Alive
    Content-Type: application/x-www-form-urlencoded
    Host: trk.srcstat.com
    Response
    HTTP/1.1 200 OK
    Server: openresty
    Date: Sat, 14 Oct 2023 09:16:01 GMT
    Content-Type: text/html; charset=utf-8
    Content-Length: 134
    Connection: keep-alive
    Vary: Accept-Encoding
    accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Full-Version,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Reduced
    Access-Control-Allow-Origin: *
    ETag: W/"86-W1anoWM3jbC0X5xVlSksmemF4cY"
    X-Response-Time: 8.296ms
    Expires: Thu, 01 Jan 1970 00:00:01 GMT
    Cache-Control: no-cache
  • 5.42.64.2:80
    5f144b5c595441bee0111a44da33e6933087898f52fc7b9ac0bc1e92b548b341.exe
    152 B
     120 B
     3
    3
  • 5.42.64.2:80
    5f144b5c595441bee0111a44da33e6933087898f52fc7b9ac0bc1e92b548b341.exe
    152 B
     120 B
     3
    3
  • 5.42.64.2:80
    5f144b5c595441bee0111a44da33e6933087898f52fc7b9ac0bc1e92b548b341.exe
    152 B
     120 B
     3
    3
  • 5.42.64.2:80
    5f144b5c595441bee0111a44da33e6933087898f52fc7b9ac0bc1e92b548b341.exe
    152 B
     120 B
     3
    3
  • 5.42.64.2:80
    5f144b5c595441bee0111a44da33e6933087898f52fc7b9ac0bc1e92b548b341.exe
    152 B
     120 B
     3
    3
  • 5.42.64.2:80
    5f144b5c595441bee0111a44da33e6933087898f52fc7b9ac0bc1e92b548b341.exe
    152 B
     120 B
     3
    3
  • 5.42.64.2:80
    5f144b5c595441bee0111a44da33e6933087898f52fc7b9ac0bc1e92b548b341.exe
    152 B
     120 B
     3
    3
  • 5.42.64.2:80
    5f144b5c595441bee0111a44da33e6933087898f52fc7b9ac0bc1e92b548b341.exe
    152 B
     120 B
     3
    3
  • 5.42.64.2:80
    5f144b5c595441bee0111a44da33e6933087898f52fc7b9ac0bc1e92b548b341.exe
    152 B
     120 B
     3
    3
  • 5.42.64.2:80
    5f144b5c595441bee0111a44da33e6933087898f52fc7b9ac0bc1e92b548b341.exe
    152 B
     120 B
     3
    3
  • 5.42.64.2:80
    5f144b5c595441bee0111a44da33e6933087898f52fc7b9ac0bc1e92b548b341.exe
    152 B
     120 B
     3
    3
  • 5.42.64.2:80
    5f144b5c595441bee0111a44da33e6933087898f52fc7b9ac0bc1e92b548b341.exe
    152 B
     120 B
     3
    3
  • 5.42.64.2:80
    5f144b5c595441bee0111a44da33e6933087898f52fc7b9ac0bc1e92b548b341.exe
    152 B
     120 B
     3
    3
  • 5.42.64.2:80
    5f144b5c595441bee0111a44da33e6933087898f52fc7b9ac0bc1e92b548b341.exe
    152 B
     120 B
     3
    3
  • 5.42.64.2:80
    5f144b5c595441bee0111a44da33e6933087898f52fc7b9ac0bc1e92b548b341.exe
    152 B
     120 B
     3
    3
  • 5.42.64.2:80
    5f144b5c595441bee0111a44da33e6933087898f52fc7b9ac0bc1e92b548b341.exe
    152 B
     120 B
     3
    3
  • 5.42.64.2:80
    5f144b5c595441bee0111a44da33e6933087898f52fc7b9ac0bc1e92b548b341.exe
    152 B
     120 B
     3
    3
  • 172.217.23.206:80
    http://script.google.com/macros/s/AKfycbxu6XZln0F2VKs8FMpn924RlKozFV5XZApwvto57voh-zMdTnkCnYo38kxDLRAyW0hb/exec?xfgnxfgn&stream=5&ip=NOIP&slots=2222&param=empty
    http
    5f144b5c595441bee0111a44da33e6933087898f52fc7b9ac0bc1e92b548b341.exe
    481 B
     1.2kB
     5
    4

    HTTP Request

    GET http://script.google.com/macros/s/AKfycbxu6XZln0F2VKs8FMpn924RlKozFV5XZApwvto57voh-zMdTnkCnYo38kxDLRAyW0hb/exec?xfgnxfgn&stream=5&ip=NOIP&slots=2222&param=empty

    HTTP Response

    301
  • 172.217.23.206:443
    https://script.google.com/macros/s/AKfycbxu6XZln0F2VKs8FMpn924RlKozFV5XZApwvto57voh-zMdTnkCnYo38kxDLRAyW0hb/exec?xfgnxfgn&stream=5&ip=NOIP&slots=2222&param=empty
    tls, http
    5f144b5c595441bee0111a44da33e6933087898f52fc7b9ac0bc1e92b548b341.exe
    1.0kB
     9.0kB
     11
    13

    HTTP Request

    GET https://script.google.com/macros/s/AKfycbxu6XZln0F2VKs8FMpn924RlKozFV5XZApwvto57voh-zMdTnkCnYo38kxDLRAyW0hb/exec?xfgnxfgn&stream=5&ip=NOIP&slots=2222&param=empty

    HTTP Response

    302
  • 142.251.36.1:443
    https://script.googleusercontent.com/macros/echo?user_content_key=raXAAC01xgieAeehMpK7YF6Cly2FD5_eFDkvoQq6O2noRC-lbXW9hNYB_cAleaot3Dv-kT6vOOlb_-RuUiARtLgpWaIb4q6bOJmA1Yb3SEsKFZqtv3DaNYcMrmhZHmUMWojr9NvTBuBLhyHCd5hHa_kSw3KJAyZKK3RTU5bpIFQ10ckTyHVSt1vTS5MZ6zqvS4V0cmy1dEEXVXg5zXDjcYCeAylu8DyVhn7i0fteRV_StcynBwb4deQK9NYe9nyjGugVZE-wIMxqgQX8JhELwW1HKFlogGMzl5YZMv-zanmfUJ0nV5QOX3d-7DXRm3Ta&lib=MAg_X_j8YJSR0PZgL-LNb21v93CYKtC0D
    tls, http
    5f144b5c595441bee0111a44da33e6933087898f52fc7b9ac0bc1e92b548b341.exe
    1.3kB
     10.3kB
     10
    13

    HTTP Request

    GET https://script.googleusercontent.com/macros/echo?user_content_key=raXAAC01xgieAeehMpK7YF6Cly2FD5_eFDkvoQq6O2noRC-lbXW9hNYB_cAleaot3Dv-kT6vOOlb_-RuUiARtLgpWaIb4q6bOJmA1Yb3SEsKFZqtv3DaNYcMrmhZHmUMWojr9NvTBuBLhyHCd5hHa_kSw3KJAyZKK3RTU5bpIFQ10ckTyHVSt1vTS5MZ6zqvS4V0cmy1dEEXVXg5zXDjcYCeAylu8DyVhn7i0fteRV_StcynBwb4deQK9NYe9nyjGugVZE-wIMxqgQX8JhELwW1HKFlogGMzl5YZMv-zanmfUJ0nV5QOX3d-7DXRm3Ta&lib=MAg_X_j8YJSR0PZgL-LNb21v93CYKtC0D

    HTTP Response

    200
  • 52.204.19.219:80
    http://trk.srcstat.com/postback?cid=REPLACE&payout=OPTIONAL&txid=OPTIONAL
    http
    5f144b5c595441bee0111a44da33e6933087898f52fc7b9ac0bc1e92b548b341.exe
    394 B
     817 B
     5
    3

    HTTP Request

    GET http://trk.srcstat.com/postback?cid=REPLACE&payout=OPTIONAL&txid=OPTIONAL

    HTTP Response

    200
  • 8.8.8.8:53
    script.google.com
    dns
    5f144b5c595441bee0111a44da33e6933087898f52fc7b9ac0bc1e92b548b341.exe
    63 B
     79 B
     1
    1

    DNS Request

    script.google.com

    DNS Response

    172.217.23.206

  • 8.8.8.8:53
    script.googleusercontent.com
    dns
    5f144b5c595441bee0111a44da33e6933087898f52fc7b9ac0bc1e92b548b341.exe
    74 B
     119 B
     1
    1

    DNS Request

    script.googleusercontent.com

    DNS Response

    142.251.36.1

  • 8.8.8.8:53
    trk.srcstat.com
    dns
    5f144b5c595441bee0111a44da33e6933087898f52fc7b9ac0bc1e92b548b341.exe
    61 B
     104 B
     1
    1

    DNS Request

    trk.srcstat.com

    DNS Response

    52.204.19.219

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2196-1-0x0000000000870000-0x0000000000970000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/2196-2-0x0000000000220000-0x000000000025E000-memory.dmp

    Filesize

    248KB

    Download

  • memory/2196-3-0x0000000000400000-0x000000000072A000-memory.dmp

    Filesize

    3.2MB

    Download

  • memory/2196-4-0x0000000000870000-0x0000000000970000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/2196-5-0x0000000000220000-0x000000000025E000-memory.dmp

    Filesize

    248KB

    Download

  • memory/2196-6-0x0000000000400000-0x000000000072A000-memory.dmp

    Filesize

    3.2MB

    Download

  • memory/2196-8-0x0000000000400000-0x000000000072A000-memory.dmp

    Filesize

    3.2MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.