Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
6Static
static
6ROOT...pi.dll
windows7-x64
3ROOT...pi.dll
windows10-2004-x64
3ROOT...pi.dll
windows7-x64
1ROOT...pi.dll
windows10-2004-x64
3ROOT...er.apk
ROOT...er.apk
android-10-x64
ROOT...er.apk
android-11-x64
ROOT...db.exe
windows7-x64
1ROOT...db.exe
windows10-2004-x64
1ROOT...usybox
debian-9-armhf
1ROOT...les/su
debian-9-armhf
ROOT...rgRush
debian-9-armhf
ROOT...��.bat
windows7-x64
1ROOT...��.bat
windows10-2004-x64
1Analysis
-
max time kernel
90s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2023, 10:23 UTC
Static task
static1
Behavioral task
behavioral1
Sample
ROOT/files/AdbWinApi.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
ROOT/files/AdbWinApi.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
ROOT/files/AdbWinUsbApi.dll
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
ROOT/files/AdbWinUsbApi.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
ROOT/files/Superuser.apk
Behavioral task
behavioral6
Sample
ROOT/files/Superuser.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral7
Sample
ROOT/files/Superuser.apk
Resource
android-x64-arm64-20231215-en
Behavioral task
behavioral8
Sample
ROOT/files/adb.exe
Resource
win7-20231129-en
Behavioral task
behavioral9
Sample
ROOT/files/adb.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral10
Sample
ROOT/files/busybox
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral11
Sample
ROOT/files/su
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral12
Sample
ROOT/files/zergRush
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral13
Sample
ROOT/ҼԱģʽ.bat
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
ROOT/ҼԱģʽ.bat
Resource
win10v2004-20231215-en
General
-
Target
ROOT/files/AdbWinApi.dll
-
Size
94KB
-
MD5
47a6ee3f186b2c2f5057028906bac0c6
-
SHA1
fde9c22a2cfcd5e566cec2e987d942b78a4eeae8
-
SHA256
14a51482aa003db79a400f4b15c158397fe6d57ee6606b3d633fa431a7bfdf4b
-
SHA512
6a2675de0c445c75f7d5664ebe8f0e2f69c3312c50156161e483927e40235140d5e28e340112ac552d6462366143890a8ce32dbf65bd37e27cb1ea290fe14584
-
SSDEEP
1536:npCxybY0FS6MqS6WvgD9xj03TabrFvY5J6sCGt:npo0k6ZWVTaif6sCG
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3024 5040 WerFault.exe 14 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4784 wrote to memory of 5040 4784 rundll32.exe 14 PID 4784 wrote to memory of 5040 4784 rundll32.exe 14 PID 4784 wrote to memory of 5040 4784 rundll32.exe 14
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ROOT\files\AdbWinApi.dll,#11⤵PID:5040
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 6162⤵
- Program crash
PID:3024
-
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ROOT\files\AdbWinApi.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4784
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5040 -ip 50401⤵PID:4888
Network
-
Remote address:8.8.8.8:53Requestg.bing.comIN AResponseg.bing.comIN CNAMEg-bing-com.a-0001.a-msedge.netg-bing-com.a-0001.a-msedge.netIN CNAMEdual-a-0001.a-msedge.netdual-a-0001.a-msedge.netIN A204.79.197.200dual-a-0001.a-msedge.netIN A13.107.21.200
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=443d2ca213294c9fbaded8390ffff82a&localId=w:E944F1F3-CBEC-A3DA-080B-887FDBFE3333&deviceId=6896190258816330&anid=Remote address:204.79.197.200:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=443d2ca213294c9fbaded8390ffff82a&localId=w:E944F1F3-CBEC-A3DA-080B-887FDBFE3333&deviceId=6896190258816330&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=123F8B3C04C16017392198D305216196; domain=.bing.com; expires=Wed, 15-Jan-2025 10:59:13 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 47E08C3E008341F4817848DAC1F37715 Ref B: LON04EDGE1205 Ref C: 2023-12-22T10:59:13Z
date: Fri, 22 Dec 2023 10:59:12 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=443d2ca213294c9fbaded8390ffff82a&localId=w:E944F1F3-CBEC-A3DA-080B-887FDBFE3333&deviceId=6896190258816330&anid=Remote address:204.79.197.200:443RequestGET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=443d2ca213294c9fbaded8390ffff82a&localId=w:E944F1F3-CBEC-A3DA-080B-887FDBFE3333&deviceId=6896190258816330&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=123F8B3C04C16017392198D305216196
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MSPTC=Sq7W9KNf9ZaJAUvkBR-GsNf-UFCqjcYBQTMbK-VE0tE; domain=.bing.com; expires=Wed, 15-Jan-2025 10:59:13 GMT; path=/; Partitioned; secure; SameSite=None
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 93E32F777804444CB94BF1E2F3A53AE2 Ref B: LON04EDGE1205 Ref C: 2023-12-22T10:59:13Z
date: Fri, 22 Dec 2023 10:59:13 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=443d2ca213294c9fbaded8390ffff82a&localId=w:E944F1F3-CBEC-A3DA-080B-887FDBFE3333&deviceId=6896190258816330&anid=Remote address:204.79.197.200:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=443d2ca213294c9fbaded8390ffff82a&localId=w:E944F1F3-CBEC-A3DA-080B-887FDBFE3333&deviceId=6896190258816330&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=123F8B3C04C16017392198D305216196; MSPTC=Sq7W9KNf9ZaJAUvkBR-GsNf-UFCqjcYBQTMbK-VE0tE
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 28C5D0F4BBF5463E96D861DECCDAC54F Ref B: LON04EDGE1205 Ref C: 2023-12-22T10:59:13Z
date: Fri, 22 Dec 2023 10:59:13 GMT
-
Remote address:8.8.8.8:53Request1.181.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request173.178.17.96.in-addr.arpaIN PTRResponse173.178.17.96.in-addr.arpaIN PTRa96-17-178-173deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request9.228.82.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request200.197.79.204.in-addr.arpaIN PTRResponse200.197.79.204.in-addr.arpaIN PTRa-0001a-msedgenet
-
Remote address:8.8.8.8:53Request103.169.127.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request57.169.31.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request41.110.16.96.in-addr.arpaIN PTRResponse41.110.16.96.in-addr.arpaIN PTRa96-16-110-41deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request198.187.3.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request18.134.221.88.in-addr.arpaIN PTRResponse18.134.221.88.in-addr.arpaIN PTRa88-221-134-18deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request180.178.17.96.in-addr.arpaIN PTRResponse180.178.17.96.in-addr.arpaIN PTRa96-17-178-180deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request11.227.111.52.in-addr.arpaIN PTRResponse
-
204.79.197.200:443https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=443d2ca213294c9fbaded8390ffff82a&localId=w:E944F1F3-CBEC-A3DA-080B-887FDBFE3333&deviceId=6896190258816330&anid=tls, http22.0kB 9.4kB 21 19
HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=443d2ca213294c9fbaded8390ffff82a&localId=w:E944F1F3-CBEC-A3DA-080B-887FDBFE3333&deviceId=6896190258816330&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=443d2ca213294c9fbaded8390ffff82a&localId=w:E944F1F3-CBEC-A3DA-080B-887FDBFE3333&deviceId=6896190258816330&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=443d2ca213294c9fbaded8390ffff82a&localId=w:E944F1F3-CBEC-A3DA-080B-887FDBFE3333&deviceId=6896190258816330&anid=HTTP Response
204
-
56 B 158 B 1 1
DNS Request
g.bing.com
DNS Response
204.79.197.20013.107.21.200
-
71 B 157 B 1 1
DNS Request
1.181.190.20.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
173.178.17.96.in-addr.arpa
-
70 B 156 B 1 1
DNS Request
9.228.82.20.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
146 B 253 B 2 2
DNS Request
200.197.79.204.in-addr.arpa
DNS Request
103.169.127.40.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
57.169.31.20.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
41.110.16.96.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
198.187.3.20.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
18.134.221.88.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
180.178.17.96.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
11.227.111.52.in-addr.arpa