Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
16/10/2023, 16:06 UTC
General
-
Target
Filters/BW/Amp 50-100-50-0-50 x2.bmp
-
Size
10KB
-
MD5
c8fb1c8e84c693f1bd2b0762cfca962e
-
SHA1
8890f244a07fbfaa9ff6fd98d773d4bfb802c1dc
-
SHA256
ad768a7afbadf5888ca14f1e98ed579f21fcc770b71be5c7ed22ed06807f9fa1
-
SHA512
5402460444ab5208a82f7879c76db9aebe4c3c6a408ba02291d49d2cd49827dd3b641cb09f7177e0cbe06516537168b72e47011e4f1857f532ca1dc0d0c56bef
-
SSDEEP
192:a5n1SRQeQUNHaoa1/pu1bN+/Y4eNsXUQmQILRwu4FyYu0NH/puj3kuaEe5aJf3c:asg6NymDF30Jf
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Filters\BW\Amp 50-100-50-0-50 x2.bmp"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Filters\BW\Amp 50-100-50-0-50 x2.bmp"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵
Network
-
DNS208.194.73.20.in-addr.arpaRemote address:8.8.8.8:53Request208.194.73.20.in-addr.arpaIN PTRResponse -
DNS59.82.57.23.in-addr.arpaRemote address:8.8.8.8:53Request59.82.57.23.in-addr.arpaIN PTRResponse59.82.57.23.in-addr.arpaIN PTRa23-57-82-59deploystaticakamaitechnologiescom
-
DNS81.171.91.138.in-addr.arpaRemote address:8.8.8.8:53Request81.171.91.138.in-addr.arpaIN PTRResponse
-
DNS108.211.229.192.in-addr.arpaRemote address:8.8.8.8:53Request108.211.229.192.in-addr.arpaIN PTRResponse
-
DNS183.59.114.20.in-addr.arpaRemote address:8.8.8.8:53Request183.59.114.20.in-addr.arpaIN PTRResponse
-
DNS198.187.3.20.in-addr.arpaRemote address:8.8.8.8:53Request198.187.3.20.in-addr.arpaIN PTRResponse
-
DNS254.177.238.8.in-addr.arpaRemote address:8.8.8.8:53Request254.177.238.8.in-addr.arpaIN PTRResponse
-
DNS8.3.197.209.in-addr.arpaRemote address:8.8.8.8:53Request8.3.197.209.in-addr.arpaIN PTRResponse8.3.197.209.in-addr.arpaIN PTRvip0x008map2sslhwcdnnet
-
DNS14.227.111.52.in-addr.arpaRemote address:8.8.8.8:53Request14.227.111.52.in-addr.arpaIN PTRResponse
-
DNS130.109.69.13.in-addr.arpaRemote address:8.8.8.8:53Request130.109.69.13.in-addr.arpaIN PTRResponse
No results found
-
8.8.8.8:53208.194.73.20.in-addr.arpadns
DNS Request
208.194.73.20.in-addr.arpa
-
8.8.8.8:5359.82.57.23.in-addr.arpadns
DNS Request
59.82.57.23.in-addr.arpa
-
8.8.8.8:5381.171.91.138.in-addr.arpadns
DNS Request
81.171.91.138.in-addr.arpa
-
8.8.8.8:53108.211.229.192.in-addr.arpadns
DNS Request
108.211.229.192.in-addr.arpa
-
8.8.8.8:53183.59.114.20.in-addr.arpadns
DNS Request
183.59.114.20.in-addr.arpa
-
8.8.8.8:53198.187.3.20.in-addr.arpadns
DNS Request
198.187.3.20.in-addr.arpa
-
8.8.8.8:53254.177.238.8.in-addr.arpadns
DNS Request
254.177.238.8.in-addr.arpa
-
8.8.8.8:538.3.197.209.in-addr.arpadns
DNS Request
8.3.197.209.in-addr.arpa
-
8.8.8.8:5314.227.111.52.in-addr.arpadns
DNS Request
14.227.111.52.in-addr.arpa
-
8.8.8.8:53130.109.69.13.in-addr.arpadns
DNS Request
130.109.69.13.in-addr.arpa