Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
1ps2_bios.zip
windows7-x64
1ps2_bios.zip
windows10-2004-x64
1PS2 Bios 3...al.mec
windows7-x64
3PS2 Bios 3...al.mec
windows10-2004-x64
3PS2 Bios 3...al.nvm
windows7-x64
3PS2 Bios 3...al.nvm
windows10-2004-x64
3PS2 Bios 3...al.bin
windows7-x64
3PS2 Bios 3...al.bin
windows10-2004-x64
3SCPH-70004...00.bin
windows7-x64
3SCPH-70004...00.bin
windows10-2004-x64
3SCPH-70004...0.erom
windows7-x64
3SCPH-70004...0.erom
windows10-2004-x64
3SCPH-70004...00.nvm
windows7-x64
3SCPH-70004...00.nvm
windows10-2004-x64
3SCPH-70004...0.rom1
windows7-x64
3SCPH-70004...0.rom1
windows10-2004-x64
3SCPH-70004...0.rom2
windows7-x64
3SCPH-70004...0.rom2
windows10-2004-x64
3rom1.bin
windows7-x64
3rom1.bin
windows10-2004-x64
3scph10000.nvm
windows7-x64
3scph10000.nvm
windows10-2004-x64
3scph10000.bin
windows7-x64
3scph10000.bin
windows10-2004-x64
3scph39001.mec
windows7-x64
3scph39001.mec
windows10-2004-x64
3scph39001.nvm
windows7-x64
3scph39001.nvm
windows10-2004-x64
3scph39001.bin
windows7-x64
3scph39001.bin
windows10-2004-x64
3Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
07/12/2023, 16:09 UTC
Static task
static1
Behavioral task
behavioral1
Sample
ps2_bios.zip
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
ps2_bios.zip
Resource
win10v2004-20231127-en
Behavioral task
behavioral3
Sample
PS2 Bios 30004R V6 Pal.mec
Resource
win7-20231130-en
Behavioral task
behavioral4
Sample
PS2 Bios 30004R V6 Pal.mec
Resource
win10v2004-20231130-en
Behavioral task
behavioral5
Sample
PS2 Bios 30004R V6 Pal.nvm
Resource
win7-20231201-en
Behavioral task
behavioral6
Sample
PS2 Bios 30004R V6 Pal.nvm
Resource
win10v2004-20231130-en
Behavioral task
behavioral7
Sample
PS2 Bios 30004R V6 Pal.bin
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
PS2 Bios 30004R V6 Pal.bin
Resource
win10v2004-20231201-en
Behavioral task
behavioral9
Sample
SCPH-70004_BIOS_V12_PAL_200.bin
Resource
win7-20231023-en
Behavioral task
behavioral10
Sample
SCPH-70004_BIOS_V12_PAL_200.bin
Resource
win10v2004-20231127-en
Behavioral task
behavioral11
Sample
SCPH-70004_BIOS_V12_PAL_200.erom
Resource
win7-20231130-en
Behavioral task
behavioral12
Sample
SCPH-70004_BIOS_V12_PAL_200.erom
Resource
win10v2004-20231127-en
Behavioral task
behavioral13
Sample
SCPH-70004_BIOS_V12_PAL_200.nvm
Resource
win7-20231020-en
Behavioral task
behavioral14
Sample
SCPH-70004_BIOS_V12_PAL_200.nvm
Resource
win10v2004-20231130-en
Behavioral task
behavioral15
Sample
SCPH-70004_BIOS_V12_PAL_200.rom1
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
SCPH-70004_BIOS_V12_PAL_200.rom1
Resource
win10v2004-20231127-en
Behavioral task
behavioral17
Sample
SCPH-70004_BIOS_V12_PAL_200.rom2
Resource
win7-20231025-en
Behavioral task
behavioral18
Sample
SCPH-70004_BIOS_V12_PAL_200.rom2
Resource
win10v2004-20231130-en
Behavioral task
behavioral19
Sample
rom1.bin
Resource
win7-20231020-en
Behavioral task
behavioral20
Sample
rom1.bin
Resource
win10v2004-20231201-en
Behavioral task
behavioral21
Sample
scph10000.nvm
Resource
win7-20231130-en
Behavioral task
behavioral22
Sample
scph10000.nvm
Resource
win10v2004-20231127-en
Behavioral task
behavioral23
Sample
scph10000.bin
Resource
win7-20231023-en
Behavioral task
behavioral24
Sample
scph10000.bin
Resource
win10v2004-20231127-en
Behavioral task
behavioral25
Sample
scph39001.mec
Resource
win7-20231201-en
Behavioral task
behavioral26
Sample
scph39001.mec
Resource
win10v2004-20231130-en
Behavioral task
behavioral27
Sample
scph39001.nvm
Resource
win7-20231201-en
Behavioral task
behavioral28
Sample
scph39001.nvm
Resource
win10v2004-20231130-en
Behavioral task
behavioral29
Sample
scph39001.bin
Resource
win7-20231130-en
Behavioral task
behavioral30
Sample
scph39001.bin
Resource
win10v2004-20231130-en
General
-
Target
SCPH-70004_BIOS_V12_PAL_200.rom1
-
Size
512KB
-
MD5
82dc50fa18e636850f557c4ea66c7bfd
-
SHA1
cc44355ded232a2ba5309bb24d4cd55af08696b2
-
SHA256
b86fbccaa111ca7497630337dafea7da7320fc4f924ada22b92145ef806e7b42
-
SHA512
ec1dc6cf74dfc34f01fbbcc2e0f11bb32d7a52101f8ebbd4ca10268165fe2639efa98e018f0a6ae58f74a491461ab301b9dbf9213687731cc2fb4dcb1e22317b
-
SSDEEP
6144:DBFsXCSZ3B4YEXxyCpmDqoPYmMsHw1SiXWIXjxqJ4Li:1Sf3ounMsMjq4O
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1067295379-1486014338-1703171060-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1067295379-1486014338-1703171060-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeManageVolumePrivilege 3764 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1040 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\SCPH-70004_BIOS_V12_PAL_200.rom11⤵
- Modifies registry class
PID:4800
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1040
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵PID:3016
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3764
Network
-
Remote address:8.8.8.8:53Request14.160.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request208.194.73.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request9.228.82.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestg.bing.comIN AResponseg.bing.comIN CNAMEg-bing-com.a-0001.a-msedge.netg-bing-com.a-0001.a-msedge.netIN CNAMEdual-a-0001.a-msedge.netdual-a-0001.a-msedge.netIN A204.79.197.200dual-a-0001.a-msedge.netIN A13.107.21.200
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=58d9538bcb46444fac73be0ceb394bdd&localId=w:952BB0C0-A72A-3B52-348D-33E02EF16565&deviceId=6896189399884861&anid=Remote address:204.79.197.200:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=58d9538bcb46444fac73be0ceb394bdd&localId=w:952BB0C0-A72A-3B52-348D-33E02EF16565&deviceId=6896189399884861&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=06F18B99BC716AB1188C9879BD266BFB; domain=.bing.com; expires=Tue, 31-Dec-2024 16:09:47 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 60D35A6B96674F2AA8F05DFF15A566E3 Ref B: AMS04EDGE1122 Ref C: 2023-12-07T16:09:47Z
date: Thu, 07 Dec 2023 16:09:47 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=58d9538bcb46444fac73be0ceb394bdd&localId=w:952BB0C0-A72A-3B52-348D-33E02EF16565&deviceId=6896189399884861&anid=Remote address:204.79.197.200:443RequestGET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=58d9538bcb46444fac73be0ceb394bdd&localId=w:952BB0C0-A72A-3B52-348D-33E02EF16565&deviceId=6896189399884861&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=06F18B99BC716AB1188C9879BD266BFB
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 2553331A7E7C4031B17861694DDD937C Ref B: AMS04EDGE1122 Ref C: 2023-12-07T16:09:47Z
date: Thu, 07 Dec 2023 16:09:47 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=58d9538bcb46444fac73be0ceb394bdd&localId=w:952BB0C0-A72A-3B52-348D-33E02EF16565&deviceId=6896189399884861&anid=Remote address:204.79.197.200:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=58d9538bcb46444fac73be0ceb394bdd&localId=w:952BB0C0-A72A-3B52-348D-33E02EF16565&deviceId=6896189399884861&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=06F18B99BC716AB1188C9879BD266BFB
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 16A16F0A503A45F587DDD936ED340D95 Ref B: AMS04EDGE1122 Ref C: 2023-12-07T16:09:47Z
date: Thu, 07 Dec 2023 16:09:47 GMT
-
Remote address:8.8.8.8:53Request155.245.36.23.in-addr.arpaIN PTRResponse155.245.36.23.in-addr.arpaIN PTRa23-36-245-155deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request200.197.79.204.in-addr.arpaIN PTRResponse200.197.79.204.in-addr.arpaIN PTRa-0001a-msedgenet
-
Remote address:8.8.8.8:53Requesttse1.mm.bing.netIN AResponsetse1.mm.bing.netIN CNAMEmm-mm.bing.net.trafficmanager.netmm-mm.bing.net.trafficmanager.netIN CNAMEdual-a-0001.a-msedge.netdual-a-0001.a-msedge.netIN A204.79.197.200dual-a-0001.a-msedge.netIN A13.107.21.200
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301205_1OM9XZCKYFXI34HLQ&pid=21.2&w=1920&h=1080&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301205_1OM9XZCKYFXI34HLQ&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 373081
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: DFFB7959284B46F4B7F2BB66FFE40448 Ref B: AMS04EDGE1322 Ref C: 2023-12-07T16:09:49Z
date: Thu, 07 Dec 2023 16:09:49 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301614_1PEIP2AXZTPQ08R0S&pid=21.2&w=1080&h=1920&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301614_1PEIP2AXZTPQ08R0S&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 350318
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 874D204EF5B340CEB4F7BE2840B46ED2 Ref B: AMS04EDGE1322 Ref C: 2023-12-07T16:09:49Z
date: Thu, 07 Dec 2023 16:09:49 GMT
-
Remote address:8.8.8.8:53Request50.23.12.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request56.126.166.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request135.1.85.104.in-addr.arpaIN PTRResponse135.1.85.104.in-addr.arpaIN PTRa104-85-1-135deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request119.110.54.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request59.128.231.4.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request218.240.110.104.in-addr.arpaIN PTRResponse218.240.110.104.in-addr.arpaIN PTRa104-110-240-218deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request232.194.19.2.in-addr.arpaIN PTRResponse232.194.19.2.in-addr.arpaIN PTRa2-19-194-232deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request1.208.79.178.in-addr.arpaIN PTRResponse1.208.79.178.in-addr.arpaIN PTRhttps-178-79-208-1amsllnwnet
-
Remote address:8.8.8.8:53Request203.194.19.2.in-addr.arpaIN PTRResponse203.194.19.2.in-addr.arpaIN PTRa2-19-194-203deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request19.229.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request8.179.89.13.in-addr.arpaIN PTRResponse
-
204.79.197.200:443https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=58d9538bcb46444fac73be0ceb394bdd&localId=w:952BB0C0-A72A-3B52-348D-33E02EF16565&deviceId=6896189399884861&anid=tls, http21.9kB 9.3kB 22 19
HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=58d9538bcb46444fac73be0ceb394bdd&localId=w:952BB0C0-A72A-3B52-348D-33E02EF16565&deviceId=6896189399884861&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=58d9538bcb46444fac73be0ceb394bdd&localId=w:952BB0C0-A72A-3B52-348D-33E02EF16565&deviceId=6896189399884861&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=58d9538bcb46444fac73be0ceb394bdd&localId=w:952BB0C0-A72A-3B52-348D-33E02EF16565&deviceId=6896189399884861&anid=HTTP Response
204 -
204.79.197.200:443https://tse1.mm.bing.net/th?id=OADD2.10239317301614_1PEIP2AXZTPQ08R0S&pid=21.2&w=1080&h=1920&c=4tls, http226.3kB 756.4kB 554 550
HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301205_1OM9XZCKYFXI34HLQ&pid=21.2&w=1920&h=1080&c=4HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301614_1PEIP2AXZTPQ08R0S&pid=21.2&w=1080&h=1920&c=4HTTP Response
200HTTP Response
200 -
1.2kB 8.3kB 16 14
-
72 B 158 B 1 1
DNS Request
14.160.190.20.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
208.194.73.20.in-addr.arpa
-
70 B 156 B 1 1
DNS Request
9.228.82.20.in-addr.arpa
-
56 B 158 B 1 1
DNS Request
g.bing.com
DNS Response
204.79.197.20013.107.21.200
-
72 B 137 B 1 1
DNS Request
155.245.36.23.in-addr.arpa
-
73 B 106 B 1 1
DNS Request
200.197.79.204.in-addr.arpa
-
62 B 173 B 1 1
DNS Request
tse1.mm.bing.net
DNS Response
204.79.197.20013.107.21.200
-
70 B 156 B 1 1
DNS Request
50.23.12.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
56.126.166.20.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
135.1.85.104.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
119.110.54.20.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
59.128.231.4.in-addr.arpa
-
74 B 141 B 1 1
DNS Request
218.240.110.104.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
232.194.19.2.in-addr.arpa
-
71 B 116 B 1 1
DNS Request
1.208.79.178.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
203.194.19.2.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
19.229.111.52.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
8.179.89.13.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD5045357d107af693312668dacf6429297
SHA16decf7ee134d72fa9af1c8389a76f5c84f92e6ad
SHA25638cc10e7f27d8336c8c61f0d8cd26d63598380c3651a67a1ca3226dc430835bd
SHA5121184c1968b718c775fe873166e6b87a66ac8e96744b1c7b5e13a78adc33ae2586ce31ff4a45487af0f168686f607e561f4d60add46bfc7466e4bd917289bbfa1