Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
3Setup.exe
windows7-x64
1Setup.exe
windows10-2004-x64
1jre/Welcome.html
windows7-x64
1jre/Welcome.html
windows10-2004-x64
1jre/bin/JA...32.dll
windows7-x64
1jre/bin/JA...32.dll
windows10-2004-x64
1jre/bin/JA...ge.dll
windows7-x64
1jre/bin/JA...ge.dll
windows10-2004-x64
1jre/bin/Ja...32.dll
windows7-x64
1jre/bin/Ja...32.dll
windows10-2004-x64
1jre/bin/Ja...ge.dll
windows7-x64
1jre/bin/Ja...ge.dll
windows10-2004-x64
1jre/bin/Wi...32.dll
windows7-x64
3jre/bin/Wi...32.dll
windows10-2004-x64
3jre/bin/Wi...ge.dll
windows7-x64
3jre/bin/Wi...ge.dll
windows10-2004-x64
3jre/bin/awt.dll
windows7-x64
1jre/bin/awt.dll
windows10-2004-x64
1jre/bin/bci.dll
windows7-x64
3jre/bin/bci.dll
windows10-2004-x64
3jre/bin/cl...vm.dll
windows7-x64
3jre/bin/cl...vm.dll
windows10-2004-x64
3jre/bin/dcpr.dll
windows7-x64
1jre/bin/dcpr.dll
windows10-2004-x64
1jre/bin/de...se.dll
windows7-x64
3jre/bin/de...se.dll
windows10-2004-x64
3jre/bin/deploy.dll
windows7-x64
3jre/bin/deploy.dll
windows10-2004-x64
3jre/bin/dt_shmem.dll
windows7-x64
3jre/bin/dt_shmem.dll
windows10-2004-x64
3jre/bin/dt_socket.dll
windows7-x64
1jre/bin/dt_socket.dll
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24/12/2023, 03:17 UTC
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
jre/Welcome.html
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
jre/Welcome.html
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
jre/bin/JAWTAccessBridge-32.dll
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
jre/bin/JAWTAccessBridge-32.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
jre/bin/JAWTAccessBridge.dll
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
jre/bin/JAWTAccessBridge.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
jre/bin/JavaAccessBridge-32.dll
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
jre/bin/JavaAccessBridge-32.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral11
Sample
jre/bin/JavaAccessBridge.dll
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
jre/bin/JavaAccessBridge.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
jre/bin/WindowsAccessBridge-32.dll
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
jre/bin/WindowsAccessBridge-32.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
jre/bin/WindowsAccessBridge.dll
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
jre/bin/WindowsAccessBridge.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
jre/bin/awt.dll
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
jre/bin/awt.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
jre/bin/bci.dll
Resource
win7-20231215-en
Behavioral task
behavioral20
Sample
jre/bin/bci.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
jre/bin/client/jvm.dll
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
jre/bin/client/jvm.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral23
Sample
jre/bin/dcpr.dll
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
jre/bin/dcpr.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
jre/bin/decora_sse.dll
Resource
win7-20231129-en
Behavioral task
behavioral26
Sample
jre/bin/decora_sse.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
jre/bin/deploy.dll
Resource
win7-20231215-en
Behavioral task
behavioral28
Sample
jre/bin/deploy.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral29
Sample
jre/bin/dt_shmem.dll
Resource
win7-20231215-en
Behavioral task
behavioral30
Sample
jre/bin/dt_shmem.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral31
Sample
jre/bin/dt_socket.dll
Resource
win7-20231215-en
Behavioral task
behavioral32
Sample
jre/bin/dt_socket.dll
Resource
win10v2004-20231222-en
General
-
Target
Setup.exe
-
Size
98KB
-
MD5
382e32f39b1ab097ff51cd04a54af166
-
SHA1
d4794322457464b31d5d45533d232faaddce91d8
-
SHA256
9755f3bfbde367b75c7f8a454fd8f1a862583c75cbe46dd193d51a487ef75390
-
SHA512
5ab8ec92db81d2d1dc79b2ed0f22cf169ef9c848c59bc7ec681fc670a6d644b0fb59afe89ed15f087081d11dd8d316c556f6e19cb826a7635b1b8b7fa4bcd66b
-
SSDEEP
384:voI1gYZw33FUWUcC6TBhdsDgZH4o5NEvdlcn0ScPmPn0Avsl9EPg/s4Xsn+KvHKY:37Zw33FNUf6Nhd/fQ1l+0vM0iT9H26E
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1860 wrote to memory of 716 1860 Setup.exe 90 PID 1860 wrote to memory of 716 1860 Setup.exe 90 PID 1860 wrote to memory of 716 1860 Setup.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\jre\bin\javaw.exe"C:\Users\Admin\AppData\Local\Temp\jre\bin\javaw.exe" -Dfile.encoding=UTF-8 -classpath "lib\.;lib\..;lib\activation.jar;lib\antlr4-runtime.jar;lib\asm-all.jar;lib\commons-email.jar;lib\connector-api.jar;lib\dn-compiled-module.jar;lib\dn-php-sdk.jar;lib\dyn4j.jar;lib\gson.jar;lib\HikariCP-java6.jar;lib\javassist-GA.jar;lib\jaybird-jdk18.jar;lib\jfoenix.jar;lib\jkeymaster.jar;lib\jna.jar;lib\jphp-app-framework.jar;lib\jphp-core.jar;lib\jphp-desktop-ext.jar;lib\jphp-desktop-hotkey-ext.jar;lib\jphp-game-ext.jar;lib\jphp-gui-ext.jar;lib\jphp-gui-jfoenix-ext.jar;lib\jphp-json-ext.jar;lib\jphp-jsoup-ext.jar;lib\jphp-mail-ext.jar;lib\jphp-runtime.jar;lib\jphp-sql-ext.jar;lib\jphp-systemtray-ext.jar;lib\jphp-xml-ext.jar;lib\jphp-zend-ext.jar;lib\jphp-zip-ext.jar;lib\jsoup.jar;lib\mail.jar;lib\mysql-connector-java.jar;lib\postgresql.jre7.jar;lib\slf4j-api.jar;lib\slf4j-simple.jar;lib\sqlite-jdbc.jar;lib\zt-zip.jar" org.develnext.jphp.ext.javafx.FXLauncher2⤵PID:716
-
Network
-
Remote address:8.8.8.8:53Requestg.bing.comIN AResponseg.bing.comIN CNAMEg-bing-com.a-0001.a-msedge.netg-bing-com.a-0001.a-msedge.netIN CNAMEdual-a-0001.a-msedge.netdual-a-0001.a-msedge.netIN A204.79.197.200dual-a-0001.a-msedge.netIN A13.107.21.200
-
Remote address:8.8.8.8:53Request208.194.73.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request21.53.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request173.178.17.96.in-addr.arpaIN PTRResponse173.178.17.96.in-addr.arpaIN PTRa96-17-178-173deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request241.154.82.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request88.156.103.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request41.110.16.96.in-addr.arpaIN PTRResponse41.110.16.96.in-addr.arpaIN PTRa96-16-110-41deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request2.136.104.51.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request2.136.104.51.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request26.165.165.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request198.187.3.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request217.135.221.88.in-addr.arpaIN PTRResponse217.135.221.88.in-addr.arpaIN PTRa88-221-135-217deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request240.221.184.93.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request146.78.124.51.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request19.229.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request43.58.199.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requesttse1.mm.bing.netIN AResponsetse1.mm.bing.netIN CNAMEmm-mm.bing.net.trafficmanager.netmm-mm.bing.net.trafficmanager.netIN CNAMEdual-a-0001.a-msedge.netdual-a-0001.a-msedge.netIN A204.79.197.200dual-a-0001.a-msedge.netIN A13.107.21.200
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301267_1DRGD58Z9HZ3H41RQ&pid=21.2&w=1920&h=1080&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301267_1DRGD58Z9HZ3H41RQ&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 388086
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: D0D6A182E9774759A16BE0B14ED5F16E Ref B: LON04EDGE0716 Ref C: 2023-12-24T03:24:01Z
date: Sun, 24 Dec 2023 03:24:01 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301676_1V8Q5FWLJGMRQZK8H&pid=21.2&w=1080&h=1920&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301676_1V8Q5FWLJGMRQZK8H&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 321165
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: EA91530CDA60412EBDE85AF7F93E7C52 Ref B: LON04EDGE0716 Ref C: 2023-12-24T03:24:01Z
date: Sun, 24 Dec 2023 03:24:01 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301205_1OM9XZCKYFXI34HLQ&pid=21.2&w=1920&h=1080&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301205_1OM9XZCKYFXI34HLQ&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 309098
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 903DF22ADF574B1A93BA66BDAED661B1 Ref B: LON04EDGE0716 Ref C: 2023-12-24T03:24:01Z
date: Sun, 24 Dec 2023 03:24:01 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301662_176VB0P3XGJB59KS3&pid=21.2&w=1080&h=1920&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301662_176VB0P3XGJB59KS3&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 373081
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 31FB2F3F4ABF44699B2C1CFDD78D6271 Ref B: LON04EDGE0716 Ref C: 2023-12-24T03:24:01Z
date: Sun, 24 Dec 2023 03:24:01 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301253_1ITZSO8YS9ZANR3WZ&pid=21.2&w=1920&h=1080&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301253_1ITZSO8YS9ZANR3WZ&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 319171
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 5A9C5D4AE8A54032AD4AB35F1AD5A9A9 Ref B: LON04EDGE0716 Ref C: 2023-12-24T03:24:01Z
date: Sun, 24 Dec 2023 03:24:01 GMT
-
2.3kB 9.4kB 23 19
-
204.79.197.200:443https://tse1.mm.bing.net/th?id=OADD2.10239317301253_1ITZSO8YS9ZANR3WZ&pid=21.2&w=1920&h=1080&c=4tls, http219.2kB 466.0kB 349 344
HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301267_1DRGD58Z9HZ3H41RQ&pid=21.2&w=1920&h=1080&c=4HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301676_1V8Q5FWLJGMRQZK8H&pid=21.2&w=1080&h=1920&c=4HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301205_1OM9XZCKYFXI34HLQ&pid=21.2&w=1920&h=1080&c=4HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301662_176VB0P3XGJB59KS3&pid=21.2&w=1080&h=1920&c=4HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301253_1ITZSO8YS9ZANR3WZ&pid=21.2&w=1920&h=1080&c=4HTTP Response
200HTTP Response
200HTTP Response
200HTTP Response
200HTTP Response
200 -
1.2kB 8.3kB 15 14
-
1.4kB 8.2kB 16 13
-
1.4kB 8.2kB 16 13
-
1.2kB 8.3kB 15 14
-
56 B 158 B 1 1
DNS Request
g.bing.com
DNS Response
204.79.197.20013.107.21.200
-
72 B 158 B 1 1
DNS Request
208.194.73.20.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
21.53.126.40.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
173.178.17.96.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
241.154.82.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
88.156.103.20.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
41.110.16.96.in-addr.arpa
-
142 B 157 B 2 1
DNS Request
2.136.104.51.in-addr.arpa
DNS Request
2.136.104.51.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
26.165.165.52.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
198.187.3.20.in-addr.arpa
-
73 B 139 B 1 1
DNS Request
217.135.221.88.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
240.221.184.93.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
146.78.124.51.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
19.229.111.52.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
43.58.199.20.in-addr.arpa
-
62 B 173 B 1 1
DNS Request
tse1.mm.bing.net
DNS Response
204.79.197.20013.107.21.200