Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
157s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
22/12/2023, 13:45 UTC
General
-
Target
ac44be360811ad7bedb0985b6c0283e2.exe
-
Size
116KB
-
MD5
ac44be360811ad7bedb0985b6c0283e2
-
SHA1
77a62a4f616ea73976a266010ba59f5b75d0211a
-
SHA256
9eb7d6b504aa4033118f7c0848869b1529f60c397a450e6f66f6772717de5575
-
SHA512
b813f5e37d0c0bbc81ccf6fe9f12e23ab26b0e11221240e25215313a92bcb20c6c227f3d3ce414d6754f6d0f90aa023f989d0d530d64c9beb42207b947171950
-
SSDEEP
1536:X/0TcIg9MtpJFmAGUk+++pZgGEbplftRkDhfdxoMqYjFe1Jsl0KuwOZZZZH1gMiV:P0TUMBFmAGUIRsjsO0xdZZZZVg3x
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 27 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac44be360811ad7bedb0985b6c0283e2.exe"C:\Users\Admin\AppData\Local\Temp\ac44be360811ad7bedb0985b6c0283e2.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\cauofi.exe"C:\Users\Admin\cauofi.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
-
DNS79.121.231.20.in-addr.arpaRemote address:8.8.8.8:53Request79.121.231.20.in-addr.arpaIN PTRResponse -
DNS79.121.231.20.in-addr.arpaRemote address:8.8.8.8:53Request79.121.231.20.in-addr.arpaIN PTR
-
DNS173.178.17.96.in-addr.arpaRemote address:8.8.8.8:53Request173.178.17.96.in-addr.arpaIN PTRResponse173.178.17.96.in-addr.arpaIN PTRa96-17-178-173deploystaticakamaitechnologiescom
-
DNS0.181.190.20.in-addr.arpaRemote address:8.8.8.8:53Request0.181.190.20.in-addr.arpaIN PTRResponse
-
DNS2.136.104.51.in-addr.arpaRemote address:8.8.8.8:53Request2.136.104.51.in-addr.arpaIN PTRResponse
-
DNS2.136.104.51.in-addr.arpaRemote address:8.8.8.8:53Request2.136.104.51.in-addr.arpaIN PTR
-
DNS2.136.104.51.in-addr.arpaRemote address:8.8.8.8:53Request2.136.104.51.in-addr.arpaIN PTR
-
DNSns1.musiczipz.comRemote address:8.8.8.8:53Requestns1.musiczipz.comIN AResponse
-
DNSns1.musicmixa.netRemote address:8.8.8.8:53Requestns1.musicmixa.netIN AResponse
-
DNSns1.musicmixa.orgRemote address:8.8.8.8:53Requestns1.musicmixa.orgIN AResponse
-
DNSns1.musicmixa.orgRemote address:8.8.8.8:53Requestns1.musicmixa.orgIN A
-
DNSns1.musicmixb.coRemote address:8.8.8.8:53Requestns1.musicmixb.coIN AResponse
-
DNSns1.musicmixc.comRemote address:8.8.8.8:53Requestns1.musicmixc.comIN AResponse
-
DNS183.59.114.20.in-addr.arpaRemote address:8.8.8.8:53Request183.59.114.20.in-addr.arpaIN PTRResponse
-
DNS171.39.242.20.in-addr.arpaRemote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
DNS217.135.221.88.in-addr.arpaRemote address:8.8.8.8:53Request217.135.221.88.in-addr.arpaIN PTRResponse217.135.221.88.in-addr.arpaIN PTRa88-221-135-217deploystaticakamaitechnologiescom
-
DNStse1.mm.bing.netRemote address:8.8.8.8:53Requesttse1.mm.bing.netIN AResponsetse1.mm.bing.netIN CNAMEmm-mm.bing.net.trafficmanager.netmm-mm.bing.net.trafficmanager.netIN CNAMEdual-a-0001.a-msedge.netdual-a-0001.a-msedge.netIN A204.79.197.200dual-a-0001.a-msedge.netIN A13.107.21.200
-
DNS57.169.31.20.in-addr.arpaRemote address:8.8.8.8:53Request57.169.31.20.in-addr.arpaIN PTRResponse
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301687_13GOH55SKYYKR3YGC&pid=21.2&w=1080&h=1920&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301687_13GOH55SKYYKR3YGC&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 345324
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 308BA8FDB23A4D5E8E40C3D20088CBEA Ref B: LON04EDGE1012 Ref C: 2023-12-23T19:58:24Z
date: Sat, 23 Dec 2023 19:58:24 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301073_18LC40ETNMF8SEVBD&pid=21.2&w=1920&h=1080&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301073_18LC40ETNMF8SEVBD&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 484032
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 846AC8FC36E5489F8600A929756005BE Ref B: LON04EDGE1012 Ref C: 2023-12-23T19:58:24Z
date: Sat, 23 Dec 2023 19:58:24 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301506_1F0FLOT3FW11VH0B0&pid=21.2&w=1080&h=1920&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301506_1F0FLOT3FW11VH0B0&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 547436
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 1B56B5D26EF1437CA9E65AED49714EE1 Ref B: LON04EDGE1012 Ref C: 2023-12-23T19:58:24Z
date: Sat, 23 Dec 2023 19:58:24 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301278_1VRPF8TFV4TZXU6S8&pid=21.2&w=1920&h=1080&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301278_1VRPF8TFV4TZXU6S8&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 488784
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 2503AE66C63040F095FCE1071C5CE7C3 Ref B: LON04EDGE1012 Ref C: 2023-12-23T19:58:24Z
date: Sat, 23 Dec 2023 19:58:24 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301001_13IM8GUOR3WVGE77H&pid=21.2&w=1920&h=1080&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301001_13IM8GUOR3WVGE77H&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 289523
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 26137DC54BED48238E7532E4652105F7 Ref B: LON04EDGE1012 Ref C: 2023-12-23T19:58:24Z
date: Sat, 23 Dec 2023 19:58:24 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301434_155CLHAG1DOW615HP&pid=21.2&w=1080&h=1920&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301434_155CLHAG1DOW615HP&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 270070
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: C21992A6BF4049F1929072486D68F082 Ref B: LON04EDGE1012 Ref C: 2023-12-23T19:58:28Z
date: Sat, 23 Dec 2023 19:58:27 GMT
-
DNS200.197.79.204.in-addr.arpaRemote address:8.8.8.8:53Request200.197.79.204.in-addr.arpaIN PTRResponse200.197.79.204.in-addr.arpaIN PTRa-0001a-msedgenet
-
DNS200.197.79.204.in-addr.arpaRemote address:8.8.8.8:53Request200.197.79.204.in-addr.arpaIN PTR
-
DNS48.229.111.52.in-addr.arpaRemote address:8.8.8.8:53Request48.229.111.52.in-addr.arpaIN PTRResponse
-
DNS48.229.111.52.in-addr.arpaRemote address:8.8.8.8:53Request48.229.111.52.in-addr.arpaIN PTR
-
DNS48.229.111.52.in-addr.arpaRemote address:8.8.8.8:53Request48.229.111.52.in-addr.arpaIN PTR
-
DNS88.65.42.20.in-addr.arpaRemote address:8.8.8.8:53Request88.65.42.20.in-addr.arpaIN PTRResponse
-
204.79.197.200:443tse1.mm.bing.nettls, http2
-
204.79.197.200:443tse1.mm.bing.nettls, http2
-
204.79.197.200:443tse1.mm.bing.nettls, http2
-
204.79.197.200:443tse1.mm.bing.nettls, http2
-
204.79.197.200:443https://tse1.mm.bing.net/th?id=OADD2.10239317301434_155CLHAG1DOW615HP&pid=21.2&w=1080&h=1920&c=4tls, http2
HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301687_13GOH55SKYYKR3YGC&pid=21.2&w=1080&h=1920&c=4HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301073_18LC40ETNMF8SEVBD&pid=21.2&w=1920&h=1080&c=4HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301506_1F0FLOT3FW11VH0B0&pid=21.2&w=1080&h=1920&c=4HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301278_1VRPF8TFV4TZXU6S8&pid=21.2&w=1920&h=1080&c=4HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301001_13IM8GUOR3WVGE77H&pid=21.2&w=1920&h=1080&c=4HTTP Response
200HTTP Response
200HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301434_155CLHAG1DOW615HP&pid=21.2&w=1080&h=1920&c=4HTTP Response
200HTTP Response
200HTTP Response
200HTTP Response
200 -
96.16.110.41:443 -
192.229.221.95:80
-
8.8.8.8:5379.121.231.20.in-addr.arpadns
DNS Request
79.121.231.20.in-addr.arpa
DNS Request
79.121.231.20.in-addr.arpa
-
8.8.8.8:53173.178.17.96.in-addr.arpadns
DNS Request
173.178.17.96.in-addr.arpa
-
8.8.8.8:530.181.190.20.in-addr.arpadns
DNS Request
0.181.190.20.in-addr.arpa
-
8.8.8.8:532.136.104.51.in-addr.arpadns
DNS Request
2.136.104.51.in-addr.arpa
DNS Request
2.136.104.51.in-addr.arpa
DNS Request
2.136.104.51.in-addr.arpa
-
8.8.8.8:53ns1.musiczipz.comdns
DNS Request
ns1.musiczipz.com
-
8.8.8.8:53ns1.musicmixa.netdns
DNS Request
ns1.musicmixa.net
-
8.8.8.8:53ns1.musicmixa.orgdns
DNS Request
ns1.musicmixa.org
DNS Request
ns1.musicmixa.org
-
8.8.8.8:53ns1.musicmixb.codns
DNS Request
ns1.musicmixb.co
-
8.8.8.8:53ns1.musicmixc.comdns
DNS Request
ns1.musicmixc.com
-
8.8.8.8:53183.59.114.20.in-addr.arpadns
DNS Request
183.59.114.20.in-addr.arpa
-
8.8.8.8:53171.39.242.20.in-addr.arpadns
DNS Request
171.39.242.20.in-addr.arpa
-
8.8.8.8:53217.135.221.88.in-addr.arpadns
DNS Request
217.135.221.88.in-addr.arpa
-
8.8.8.8:53tse1.mm.bing.netdns
DNS Request
tse1.mm.bing.net
DNS Response
204.79.197.20013.107.21.200
-
8.8.8.8:5357.169.31.20.in-addr.arpadns
DNS Request
57.169.31.20.in-addr.arpa
-
8.8.8.8:53200.197.79.204.in-addr.arpadns
DNS Request
200.197.79.204.in-addr.arpa
DNS Request
200.197.79.204.in-addr.arpa
-
8.8.8.8:5348.229.111.52.in-addr.arpadns
DNS Request
48.229.111.52.in-addr.arpa
DNS Request
48.229.111.52.in-addr.arpa
DNS Request
48.229.111.52.in-addr.arpa
-
8.8.8.8:5388.65.42.20.in-addr.arpadns
DNS Request
88.65.42.20.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
116KB
MD5aae6a60b9b31bbca2089b7649adacd31
SHA1636a9782d116cf16471eda5c2f4f46c1144edc8c
SHA25616799089092dd24af98bfd3670aa99d186e536b9db0b891011ab0f4a34c432c5
SHA51253bb3bf7e9a44572da8e2704d3d356af725f284deee8ff01b8ef1e7502438feeeb16225c3f46bf6c76bb1740688a840b04152eea37d828e8584c0211f533c817