Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231025-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2023, 20:56 UTC

General

  • Target

    NEAS.5691e467feaab17d5643617e1063dc20.exe

  • Size

    204KB

  • MD5

    5691e467feaab17d5643617e1063dc20

  • SHA1

    b227bfbeabbbb81f6966933c427bc70ecc951b8d

  • SHA256

    3fd5d3f31357295c5d1f367b9f229d4b634a9535634b7ba0e0926d85099913dc

  • SHA512

    4fa15aa22f27dfd8c54b000a6e883d7f7236f9952c8b92630ca1a3e4fd51ebe7514aa177323a31ba8b74d393a03619de196730b7df620dd01a8cbc77d6f4859b

  • SSDEEP

    768:zm0PkFaP+HUNHBoAhSyxt9GNFNCm2PeMTyq8e2y:60y/07zSYeNSXV2y

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.5691e467feaab17d5643617e1063dc20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5691e467feaab17d5643617e1063dc20.exe"
    1⤵
      PID:1512
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 224
        2⤵
        • Program crash
        PID:1192
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1512 -ip 1512
      1⤵
        PID:1976

      Network

      • flag-us
        DNS
        133.32.126.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        133.32.126.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        59.128.231.4.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        59.128.231.4.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        71.121.18.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        71.121.18.2.in-addr.arpa
        IN PTR
        Response
        71.121.18.2.in-addr.arpa
        IN PTR
        a2-18-121-71deploystaticakamaitechnologiescom
      • flag-us
        DNS
        198.52.96.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        198.52.96.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        226.173.246.72.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        226.173.246.72.in-addr.arpa
        IN PTR
        Response
        226.173.246.72.in-addr.arpa
        IN PTR
        a72-246-173-226deploystaticakamaitechnologiescom
      • flag-us
        DNS
        146.78.124.51.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        146.78.124.51.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        103.169.127.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        103.169.127.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        171.39.242.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        171.39.242.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        d.3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.8.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa
        Remote address:
        8.8.8.8:53
        Request
        d.3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.8.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa
        IN PTR
        Response
      • flag-us
        DNS
        18.31.95.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        18.31.95.13.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        2.36.159.162.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        2.36.159.162.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        241.54.22.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        241.54.22.2.in-addr.arpa
        IN PTR
        Response
        241.54.22.2.in-addr.arpa
        IN PTR
        a2-22-54-241deploystaticakamaitechnologiescom
      • flag-us
        DNS
        tse1.mm.bing.net
        Remote address:
        8.8.8.8:53
        Request
        tse1.mm.bing.net
        IN A
        Response
        tse1.mm.bing.net
        IN CNAME
        mm-mm.bing.net.trafficmanager.net
        mm-mm.bing.net.trafficmanager.net
        IN CNAME
        dual-a-0001.a-msedge.net
        dual-a-0001.a-msedge.net
        IN A
        204.79.197.200
        dual-a-0001.a-msedge.net
        IN A
        13.107.21.200
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239317301291_1H8FN9XYY8JWTIM5Q&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239317301291_1H8FN9XYY8JWTIM5Q&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 445278
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 168CB3D534DC4CAB91D9DDEB8814DFB6 Ref B: BRU30EDGE0906 Ref C: 2023-11-08T21:36:27Z
        date: Wed, 08 Nov 2023 21:36:26 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239317301600_1WSZ3EMFYHR1KRB2N&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239317301600_1WSZ3EMFYHR1KRB2N&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 768566
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 39FEE98E2CD34A1993E0D4542855AEE4 Ref B: BRU30EDGE0906 Ref C: 2023-11-08T21:36:27Z
        date: Wed, 08 Nov 2023 21:36:26 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239317301432_1NLWJ6W2YQQ4KOO33&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239317301432_1NLWJ6W2YQQ4KOO33&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 469097
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 8086D9CD7CC14C0288A9F154F53E70FE Ref B: BRU30EDGE0906 Ref C: 2023-11-08T21:36:27Z
        date: Wed, 08 Nov 2023 21:36:26 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239317301191_1O2H8JRMOAALOPCGS&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239317301191_1O2H8JRMOAALOPCGS&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 554966
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 30407D0A76A041BE9EC5D2C6C6AEBF0C Ref B: BRU30EDGE0906 Ref C: 2023-11-08T21:36:27Z
        date: Wed, 08 Nov 2023 21:36:26 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239317300999_19LLLSZ7BD69RXYBD&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239317300999_19LLLSZ7BD69RXYBD&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 467649
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 39C613F54C4C45699AFF56BBE74C518E Ref B: BRU30EDGE0906 Ref C: 2023-11-08T21:36:27Z
        date: Wed, 08 Nov 2023 21:36:26 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239317301700_18ZUY5V0A74HOX1SZ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239317301700_18ZUY5V0A74HOX1SZ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 975817
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 224519E3F19E4624A46AAFB57195B10A Ref B: BRU30EDGE0906 Ref C: 2023-11-08T21:36:29Z
        date: Wed, 08 Nov 2023 21:36:28 GMT
      • flag-us
        DNS
        112.208.253.8.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        112.208.253.8.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        50.192.11.51.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        50.192.11.51.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        50.192.11.51.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        50.192.11.51.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        50.192.11.51.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        50.192.11.51.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        50.192.11.51.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        50.192.11.51.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        50.192.11.51.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        50.192.11.51.in-addr.arpa
        IN PTR
      • 204.79.197.200:443
        tse1.mm.bing.net
        tls, http2
        1.2kB
        8.3kB
        16
        14
      • 204.79.197.200:443
        https://tse1.mm.bing.net/th?id=OADD2.10239317301700_18ZUY5V0A74HOX1SZ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
        tls, http2
        128.1kB
        3.8MB
        2755
        2748

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239317301291_1H8FN9XYY8JWTIM5Q&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239317301600_1WSZ3EMFYHR1KRB2N&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239317301432_1NLWJ6W2YQQ4KOO33&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239317301191_1O2H8JRMOAALOPCGS&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239317300999_19LLLSZ7BD69RXYBD&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

        HTTP Response

        200

        HTTP Response

        200

        HTTP Response

        200

        HTTP Response

        200

        HTTP Response

        200

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239317301700_18ZUY5V0A74HOX1SZ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

        HTTP Response

        200
      • 204.79.197.200:443
        tse1.mm.bing.net
        tls, http2
        1.2kB
        8.3kB
        16
        14
      • 204.79.197.200:443
        tse1.mm.bing.net
        tls, http2
        1.2kB
        8.3kB
        16
        14
      • 204.79.197.200:443
        tse1.mm.bing.net
        tls, http2
        1.2kB
        8.3kB
        16
        14
      • 8.8.8.8:53
        133.32.126.40.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        133.32.126.40.in-addr.arpa

      • 8.8.8.8:53
        59.128.231.4.in-addr.arpa
        dns
        71 B
        157 B
        1
        1

        DNS Request

        59.128.231.4.in-addr.arpa

      • 8.8.8.8:53
        71.121.18.2.in-addr.arpa
        dns
        70 B
        133 B
        1
        1

        DNS Request

        71.121.18.2.in-addr.arpa

      • 8.8.8.8:53
        198.52.96.20.in-addr.arpa
        dns
        71 B
        157 B
        1
        1

        DNS Request

        198.52.96.20.in-addr.arpa

      • 8.8.8.8:53
        226.173.246.72.in-addr.arpa
        dns
        73 B
        139 B
        1
        1

        DNS Request

        226.173.246.72.in-addr.arpa

      • 8.8.8.8:53
        146.78.124.51.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        146.78.124.51.in-addr.arpa

      • 8.8.8.8:53
        103.169.127.40.in-addr.arpa
        dns
        73 B
        147 B
        1
        1

        DNS Request

        103.169.127.40.in-addr.arpa

      • 8.8.8.8:53
        171.39.242.20.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        171.39.242.20.in-addr.arpa

      • 8.8.8.8:53
        d.3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.8.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa
        dns
        118 B
        204 B
        1
        1

        DNS Request

        d.3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.8.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa

      • 8.8.8.8:53
        18.31.95.13.in-addr.arpa
        dns
        70 B
        144 B
        1
        1

        DNS Request

        18.31.95.13.in-addr.arpa

      • 8.8.8.8:53
        2.36.159.162.in-addr.arpa
        dns
        71 B
        133 B
        1
        1

        DNS Request

        2.36.159.162.in-addr.arpa

      • 8.8.8.8:53
        241.54.22.2.in-addr.arpa
        dns
        70 B
        133 B
        1
        1

        DNS Request

        241.54.22.2.in-addr.arpa

      • 8.8.8.8:53
        tse1.mm.bing.net
        dns
        62 B
        173 B
        1
        1

        DNS Request

        tse1.mm.bing.net

        DNS Response

        204.79.197.200
        13.107.21.200

      • 8.8.8.8:53
        112.208.253.8.in-addr.arpa
        dns
        72 B
        126 B
        1
        1

        DNS Request

        112.208.253.8.in-addr.arpa

      • 8.8.8.8:53
        50.192.11.51.in-addr.arpa
        dns
        355 B
        5

        DNS Request

        50.192.11.51.in-addr.arpa

        DNS Request

        50.192.11.51.in-addr.arpa

        DNS Request

        50.192.11.51.in-addr.arpa

        DNS Request

        50.192.11.51.in-addr.arpa

        DNS Request

        50.192.11.51.in-addr.arpa

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1512-0-0x0000000000400000-0x0000000000433000-memory.dmp

        Filesize

        204KB

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.