Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

0bac6e2367...9b.exe

windows7-x64

10

0bac6e2367...9b.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    157s
  • max time network
    165s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/12/2023, 06:29 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0bac6e23671f8f591d3329f527369d9b.exe

  • Size

    475KB

  • MD5

    0bac6e23671f8f591d3329f527369d9b

  • SHA1

    adf0579b98b0bcb62e3e853ed260d0c8adb39969

  • SHA256

    b2f0e158b12a041a617b6287fafdeba7b91994db225b73a6002dc6b544d4c0ed

  • SHA512

    f85fa63e907d469475347bb3d665289a3e8666cf75733fe2483d0362a7e3619fc3a1894e5d5f3125a7a7ba5550eebb265f76f49606ac24c426311fb2f0976f82

  • SSDEEP

    3072:+HXzNlUR5SeeL84Gezv7F36LvFBWFCfsiSim4XzPJm0:+DNi5qtLQ5BPsKm4Xv

Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 4 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0bac6e23671f8f591d3329f527369d9b.exe
    "C:\Users\Admin\AppData\Local\Temp\0bac6e23671f8f591d3329f527369d9b.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:844
    • C:\Users\Admin\AppData\Local\Temp\0bac6e23671f8f591d3329f527369d9b.exe
      C:\Users\Admin\AppData\Local\Temp\0bac6e23671f8f591d3329f527369d9b.exe
      2⤵
      • Modifies firewall policy service
      • Checks computer location settings
      • Adds Run key to start application
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1740
      • C:\Users\Admin\Microsoft-Driver-1-82-3875-8725-4265\winsvn.exe
        "C:\Users\Admin\Microsoft-Driver-1-82-3875-8725-4265\winsvn.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1640
        • C:\Users\Admin\Microsoft-Driver-1-82-3875-8725-4265\winsvn.exe
          C:\Users\Admin\Microsoft-Driver-1-82-3875-8725-4265\winsvn.exe
          4⤵
          • Executes dropped EXE
          PID:2804

Network

  • flag-us
    DNS
    178.223.142.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    178.223.142.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    178.223.142.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    178.223.142.52.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    2.181.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    2.181.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    2.136.104.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    2.136.104.51.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
    Response
    g.bing.com
    IN CNAME
    g-bing-com.a-0001.a-msedge.net
    g-bing-com.a-0001.a-msedge.net
    IN CNAME
    dual-a-0001.a-msedge.net
    dual-a-0001.a-msedge.net
    IN A
    204.79.197.200
    dual-a-0001.a-msedge.net
    IN A
    13.107.21.200
  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
  • flag-us
    DNS
    146.177.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    146.177.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    146.177.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    146.177.190.20.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ee171670f85e4071ac6dabbc1984d2bd&localId=w:5CCFAF18-3F96-093A-F0B7-3C3E79A9C582&deviceId=6966554353444491&anid=
    Remote address:
    204.79.197.200:443
    Request
    GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ee171670f85e4071ac6dabbc1984d2bd&localId=w:5CCFAF18-3F96-093A-F0B7-3C3E79A9C582&deviceId=6966554353444491&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MUID=0201C4EB80FC6DCC2AB2D71F81476CCA; domain=.bing.com; expires=Mon, 20-Jan-2025 09:38:37 GMT; path=/; SameSite=None; Secure; Priority=High;
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 95F8BEB672FF4E2B999C37CAC658796C Ref B: LON04EDGE0820 Ref C: 2023-12-27T09:38:37Z
    date: Wed, 27 Dec 2023 09:38:36 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=ee171670f85e4071ac6dabbc1984d2bd&localId=w:5CCFAF18-3F96-093A-F0B7-3C3E79A9C582&deviceId=6966554353444491&anid=
    Remote address:
    204.79.197.200:443
    Request
    GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=ee171670f85e4071ac6dabbc1984d2bd&localId=w:5CCFAF18-3F96-093A-F0B7-3C3E79A9C582&deviceId=6966554353444491&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=0201C4EB80FC6DCC2AB2D71F81476CCA
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MSPTC=ORHrZ-tqdgIcPJ0FzqYvcJRtG_1QcX4N5rEiXA8jEbc; domain=.bing.com; expires=Mon, 20-Jan-2025 09:38:37 GMT; path=/; Partitioned; secure; SameSite=None
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: DD943EB8F2194E658F7789AEC1E1CECD Ref B: LON04EDGE0820 Ref C: 2023-12-27T09:38:37Z
    date: Wed, 27 Dec 2023 09:38:37 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ee171670f85e4071ac6dabbc1984d2bd&localId=w:5CCFAF18-3F96-093A-F0B7-3C3E79A9C582&deviceId=6966554353444491&anid=
    Remote address:
    204.79.197.200:443
    Request
    GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ee171670f85e4071ac6dabbc1984d2bd&localId=w:5CCFAF18-3F96-093A-F0B7-3C3E79A9C582&deviceId=6966554353444491&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=0201C4EB80FC6DCC2AB2D71F81476CCA; MSPTC=ORHrZ-tqdgIcPJ0FzqYvcJRtG_1QcX4N5rEiXA8jEbc
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 969E3456CDF94DD9BE927CA5316822E6 Ref B: LON04EDGE0820 Ref C: 2023-12-27T09:38:38Z
    date: Wed, 27 Dec 2023 09:38:37 GMT
  • flag-us
    DNS
    146.78.124.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    146.78.124.51.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    146.78.124.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    146.78.124.51.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    146.78.124.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    146.78.124.51.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    200.197.79.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.197.79.204.in-addr.arpa
    IN PTR
    Response
    200.197.79.204.in-addr.arpa
    IN PTR
    a-0001a-msedgenet
  • flag-us
    DNS
    241.154.82.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.154.82.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    host5500.net
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    host5500.net
    IN A
    Response
  • flag-us
    DNS
    host5500.net
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    host5500.net
    IN A
  • flag-us
    DNS
    host5500.net
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    host5500.net
    IN A
  • flag-us
    DNS
    183.59.114.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    183.59.114.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    srv5500.com
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    srv5500.com
    IN A
    Response
  • flag-us
    DNS
    host5500.net
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    host5500.net
    IN A
    Response
  • flag-us
    DNS
    host5500.net
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    host5500.net
    IN A
  • flag-us
    DNS
    host5500.net
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    host5500.net
    IN A
  • flag-us
    DNS
    host5500.net
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    host5500.net
    IN A
  • flag-us
    DNS
    srv5500.com
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    srv5500.com
    IN A
    Response
  • flag-us
    DNS
    srv5500.com
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    srv5500.com
    IN A
  • flag-us
    DNS
    srv5500.com
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    srv5500.com
    IN A
  • flag-us
    DNS
    41.110.16.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    41.110.16.96.in-addr.arpa
    IN PTR
    Response
    41.110.16.96.in-addr.arpa
    IN PTR
    a96-16-110-41deploystaticakamaitechnologiescom
  • flag-us
    DNS
    41.110.16.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    41.110.16.96.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    host5500.net
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    host5500.net
    IN A
    Response
  • flag-us
    DNS
    srv5500.com
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    srv5500.com
    IN A
    Response
  • flag-us
    DNS
    host5500.net
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    host5500.net
    IN A
    Response
  • flag-us
    DNS
    host5500.net
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    host5500.net
    IN A
  • flag-us
    DNS
    171.39.242.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    171.39.242.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    171.39.242.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    171.39.242.20.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    171.39.242.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    171.39.242.20.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    171.39.242.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    171.39.242.20.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    srv5500.com
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    srv5500.com
    IN A
    Response
  • flag-us
    DNS
    host5500.net
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    host5500.net
    IN A
    Response
  • flag-us
    DNS
    host5500.net
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    host5500.net
    IN A
  • flag-us
    DNS
    host5500.net
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    host5500.net
    IN A
  • flag-us
    DNS
    srv5500.com
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    srv5500.com
    IN A
    Response
  • flag-us
    DNS
    host5500.net
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    host5500.net
    IN A
    Response
  • flag-us
    DNS
    host5500.net
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    host5500.net
    IN A
  • flag-us
    DNS
    217.135.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    217.135.221.88.in-addr.arpa
    IN PTR
    Response
    217.135.221.88.in-addr.arpa
    IN PTR
    a88-221-135-217deploystaticakamaitechnologiescom
  • flag-us
    DNS
    217.135.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    217.135.221.88.in-addr.arpa
    IN PTR
    Response
    217.135.221.88.in-addr.arpa
    IN PTR
    a88-221-135-217deploystaticakamaitechnologiescom
  • flag-us
    DNS
    srv5500.com
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    srv5500.com
    IN A
    Response
  • flag-us
    DNS
    srv5500.com
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    srv5500.com
    IN A
  • flag-us
    DNS
    88.156.103.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.156.103.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    88.156.103.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.156.103.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    host5500.net
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    host5500.net
    IN A
    Response
  • flag-us
    DNS
    host5500.net
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    host5500.net
    IN A
    Response
  • flag-us
    DNS
    srv5500.com
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    srv5500.com
    IN A
    Response
  • flag-us
    DNS
    srv5500.com
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    srv5500.com
    IN A
    Response
  • flag-us
    DNS
    host5500.net
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    host5500.net
    IN A
    Response
  • flag-us
    DNS
    host5500.net
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    host5500.net
    IN A
    Response
  • flag-us
    DNS
    22.236.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    22.236.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    22.236.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    22.236.111.52.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    srv5500.com
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    srv5500.com
    IN A
    Response
  • flag-us
    DNS
    srv5500.com
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    srv5500.com
    IN A
    Response
  • flag-us
    DNS
    host5500.net
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    host5500.net
    IN A
    Response
  • flag-us
    DNS
    host5500.net
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    host5500.net
    IN A
    Response
  • flag-us
    DNS
    srv5500.com
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    srv5500.com
    IN A
    Response
  • flag-us
    DNS
    srv5500.com
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    srv5500.com
    IN A
    Response
  • flag-us
    DNS
    host5500.net
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    host5500.net
    IN A
    Response
  • flag-us
    DNS
    host5500.net
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    host5500.net
    IN A
    Response
  • flag-us
    DNS
    srv5500.com
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    srv5500.com
    IN A
    Response
  • flag-us
    DNS
    srv5500.com
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    srv5500.com
    IN A
    Response
  • flag-us
    DNS
    host5500.net
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    host5500.net
    IN A
    Response
  • flag-us
    DNS
    host5500.net
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    host5500.net
    IN A
    Response
  • flag-us
    DNS
    srv5500.com
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    srv5500.com
    IN A
    Response
  • flag-us
    DNS
    srv5500.com
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    srv5500.com
    IN A
    Response
  • flag-us
    DNS
    host5500.net
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    host5500.net
    IN A
    Response
  • flag-us
    DNS
    host5500.net
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    host5500.net
    IN A
  • flag-us
    DNS
    srv5500.com
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    srv5500.com
    IN A
    Response
  • flag-us
    DNS
    srv5500.com
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    srv5500.com
    IN A
    Response
  • flag-us
    DNS
    host5500.net
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    host5500.net
    IN A
    Response
  • flag-us
    DNS
    host5500.net
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    host5500.net
    IN A
    Response
  • flag-us
    DNS
    104.241.123.92.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    104.241.123.92.in-addr.arpa
    IN PTR
    Response
    104.241.123.92.in-addr.arpa
    IN PTR
    a92-123-241-104deploystaticakamaitechnologiescom
  • flag-us
    DNS
    104.241.123.92.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    104.241.123.92.in-addr.arpa
    IN PTR
    Response
    104.241.123.92.in-addr.arpa
    IN PTR
    a92-123-241-104deploystaticakamaitechnologiescom
  • flag-us
    DNS
    srv5500.com
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    srv5500.com
    IN A
    Response
  • flag-us
    DNS
    srv5500.com
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    srv5500.com
    IN A
    Response
  • flag-us
    DNS
    119.110.54.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    119.110.54.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    119.110.54.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    119.110.54.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    host5500.net
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    host5500.net
    IN A
    Response
  • flag-us
    DNS
    host5500.net
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    host5500.net
    IN A
    Response
  • flag-us
    DNS
    srv5500.com
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    srv5500.com
    IN A
    Response
  • flag-us
    DNS
    srv5500.com
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    srv5500.com
    IN A
    Response
  • flag-us
    DNS
    host5500.net
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    host5500.net
    IN A
    Response
  • flag-us
    DNS
    host5500.net
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    host5500.net
    IN A
    Response
  • flag-us
    DNS
    srv5500.com
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    srv5500.com
    IN A
    Response
  • flag-us
    DNS
    srv5500.com
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    srv5500.com
    IN A
    Response
  • flag-us
    DNS
    host5500.net
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    host5500.net
    IN A
    Response
  • flag-us
    DNS
    host5500.net
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    host5500.net
    IN A
  • flag-us
    DNS
    srv5500.com
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    srv5500.com
    IN A
    Response
  • flag-us
    DNS
    srv5500.com
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    srv5500.com
    IN A
    Response
  • flag-us
    DNS
    host5500.net
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    host5500.net
    IN A
    Response
  • flag-us
    DNS
    host5500.net
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    host5500.net
    IN A
    Response
  • flag-us
    DNS
    89.65.42.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    89.65.42.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    89.65.42.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    89.65.42.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    srv5500.com
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    srv5500.com
    IN A
    Response
  • flag-us
    DNS
    srv5500.com
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    srv5500.com
    IN A
    Response
  • flag-us
    DNS
    host5500.net
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    host5500.net
    IN A
    Response
  • flag-us
    DNS
    host5500.net
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    host5500.net
    IN A
    Response
  • flag-us
    DNS
    srv5500.com
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    srv5500.com
    IN A
    Response
  • flag-us
    DNS
    srv5500.com
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    srv5500.com
    IN A
  • flag-us
    DNS
    host5500.net
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    host5500.net
    IN A
    Response
  • flag-us
    DNS
    host5500.net
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    host5500.net
    IN A
    Response
  • flag-us
    DNS
    srv5500.com
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    srv5500.com
    IN A
    Response
  • flag-us
    DNS
    srv5500.com
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    srv5500.com
    IN A
    Response
  • flag-us
    DNS
    host5500.net
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    host5500.net
    IN A
    Response
  • flag-us
    DNS
    host5500.net
    winsvn.exe
    Remote address:
    8.8.8.8:53
    Request
    host5500.net
    IN A
    Response
  • 204.79.197.200:443
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ee171670f85e4071ac6dabbc1984d2bd&localId=w:5CCFAF18-3F96-093A-F0B7-3C3E79A9C582&deviceId=6966554353444491&anid=
    tls, http2
    2.5kB
     9.6kB
     23
    20

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ee171670f85e4071ac6dabbc1984d2bd&localId=w:5CCFAF18-3F96-093A-F0B7-3C3E79A9C582&deviceId=6966554353444491&anid=

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=ee171670f85e4071ac6dabbc1984d2bd&localId=w:5CCFAF18-3F96-093A-F0B7-3C3E79A9C582&deviceId=6966554353444491&anid=

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ee171670f85e4071ac6dabbc1984d2bd&localId=w:5CCFAF18-3F96-093A-F0B7-3C3E79A9C582&deviceId=6966554353444491&anid=

    HTTP Response

    204
  • 88.221.134.18:80
  • 8.8.8.8:53
    178.223.142.52.in-addr.arpa
    dns
    146 B
     147 B
     2
    1

    DNS Request

    178.223.142.52.in-addr.arpa

    DNS Request

    178.223.142.52.in-addr.arpa

  • 8.8.8.8:53
    2.181.190.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    2.181.190.20.in-addr.arpa

  • 8.8.8.8:53
    2.136.104.51.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    2.136.104.51.in-addr.arpa

  • 8.8.8.8:53
    g.bing.com
    dns
    112 B
     158 B
     2
    1

    DNS Request

    g.bing.com

    DNS Request

    g.bing.com

    DNS Response

    204.79.197.200
    13.107.21.200

  • 8.8.8.8:53
    146.177.190.20.in-addr.arpa
    dns
    146 B
     159 B
     2
    1

    DNS Request

    146.177.190.20.in-addr.arpa

    DNS Request

    146.177.190.20.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    146 B
     144 B
     2
    1

    DNS Request

    95.221.229.192.in-addr.arpa

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    146.78.124.51.in-addr.arpa
    dns
    216 B
     158 B
     3
    1

    DNS Request

    146.78.124.51.in-addr.arpa

    DNS Request

    146.78.124.51.in-addr.arpa

    DNS Request

    146.78.124.51.in-addr.arpa

  • 8.8.8.8:53
    200.197.79.204.in-addr.arpa
    dns
    73 B
     106 B
     1
    1

    DNS Request

    200.197.79.204.in-addr.arpa

  • 8.8.8.8:53
    241.154.82.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    241.154.82.20.in-addr.arpa

  • 8.8.8.8:53
    host5500.net
    dns
    winsvn.exe
    174 B
     131 B
     3
    1

    DNS Request

    host5500.net

    DNS Request

    host5500.net

    DNS Request

    host5500.net

  • 8.8.8.8:53
    183.59.114.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    183.59.114.20.in-addr.arpa

  • 8.8.8.8:53
    srv5500.com
    dns
    winsvn.exe
    57 B
     130 B
     1
    1

    DNS Request

    srv5500.com

  • 8.8.8.8:53
    host5500.net
    dns
    winsvn.exe
    232 B
     131 B
     4
    1

    DNS Request

    host5500.net

    DNS Request

    host5500.net

    DNS Request

    host5500.net

    DNS Request

    host5500.net

  • 8.8.8.8:53
    srv5500.com
    dns
    winsvn.exe
    171 B
     130 B
     3
    1

    DNS Request

    srv5500.com

    DNS Request

    srv5500.com

    DNS Request

    srv5500.com

  • 8.8.8.8:53
    41.110.16.96.in-addr.arpa
    dns
    142 B
     135 B
     2
    1

    DNS Request

    41.110.16.96.in-addr.arpa

    DNS Request

    41.110.16.96.in-addr.arpa

  • 8.8.8.8:53
    host5500.net
    dns
    winsvn.exe
    58 B
     131 B
     1
    1

    DNS Request

    host5500.net

  • 8.8.8.8:53
    srv5500.com
    dns
    winsvn.exe
    57 B
     130 B
     1
    1

    DNS Request

    srv5500.com

  • 8.8.8.8:53
    host5500.net
    dns
    winsvn.exe
    116 B
     131 B
     2
    1

    DNS Request

    host5500.net

    DNS Request

    host5500.net

  • 8.8.8.8:53
    171.39.242.20.in-addr.arpa
    dns
    288 B
     158 B
     4
    1

    DNS Request

    171.39.242.20.in-addr.arpa

    DNS Request

    171.39.242.20.in-addr.arpa

    DNS Request

    171.39.242.20.in-addr.arpa

    DNS Request

    171.39.242.20.in-addr.arpa

  • 8.8.8.8:53
    srv5500.com
    dns
    winsvn.exe
    57 B
     130 B
     1
    1

    DNS Request

    srv5500.com

  • 8.8.8.8:53
    host5500.net
    dns
    winsvn.exe
    174 B
     131 B
     3
    1

    DNS Request

    host5500.net

    DNS Request

    host5500.net

    DNS Request

    host5500.net

  • 8.8.8.8:53
    srv5500.com
    dns
    winsvn.exe
    57 B
     130 B
     1
    1

    DNS Request

    srv5500.com

  • 8.8.8.8:53
    host5500.net
    dns
    winsvn.exe
    116 B
     131 B
     2
    1

    DNS Request

    host5500.net

    DNS Request

    host5500.net

  • 8.8.8.8:53
    217.135.221.88.in-addr.arpa
    dns
    146 B
     278 B
     2
    2

    DNS Request

    217.135.221.88.in-addr.arpa

    DNS Request

    217.135.221.88.in-addr.arpa

  • 8.8.8.8:53
    srv5500.com
    dns
    winsvn.exe
    114 B
     130 B
     2
    1

    DNS Request

    srv5500.com

    DNS Request

    srv5500.com

  • 8.8.8.8:53
    88.156.103.20.in-addr.arpa
    dns
    144 B
     316 B
     2
    2

    DNS Request

    88.156.103.20.in-addr.arpa

    DNS Request

    88.156.103.20.in-addr.arpa

  • 8.8.8.8:53
    host5500.net
    dns
    winsvn.exe
    116 B
     262 B
     2
    2

    DNS Request

    host5500.net

    DNS Request

    host5500.net

  • 8.8.8.8:53
    srv5500.com
    dns
    winsvn.exe
    114 B
     260 B
     2
    2

    DNS Request

    srv5500.com

    DNS Request

    srv5500.com

  • 8.8.8.8:53
    host5500.net
    dns
    winsvn.exe
    116 B
     262 B
     2
    2

    DNS Request

    host5500.net

    DNS Request

    host5500.net

  • 8.8.8.8:53
    22.236.111.52.in-addr.arpa
    dns
    144 B
     158 B
     2
    1

    DNS Request

    22.236.111.52.in-addr.arpa

    DNS Request

    22.236.111.52.in-addr.arpa

  • 8.8.8.8:53
    srv5500.com
    dns
    winsvn.exe
    114 B
     260 B
     2
    2

    DNS Request

    srv5500.com

    DNS Request

    srv5500.com

  • 8.8.8.8:53
    host5500.net
    dns
    winsvn.exe
    116 B
     262 B
     2
    2

    DNS Request

    host5500.net

    DNS Request

    host5500.net

  • 8.8.8.8:53
    srv5500.com
    dns
    winsvn.exe
    114 B
     260 B
     2
    2

    DNS Request

    srv5500.com

    DNS Request

    srv5500.com

  • 8.8.8.8:53
    host5500.net
    dns
    winsvn.exe
    116 B
     262 B
     2
    2

    DNS Request

    host5500.net

    DNS Request

    host5500.net

  • 8.8.8.8:53
    srv5500.com
    dns
    winsvn.exe
    114 B
     260 B
     2
    2

    DNS Request

    srv5500.com

    DNS Request

    srv5500.com

  • 8.8.8.8:53
    host5500.net
    dns
    winsvn.exe
    116 B
     262 B
     2
    2

    DNS Request

    host5500.net

    DNS Request

    host5500.net

  • 8.8.8.8:53
    srv5500.com
    dns
    winsvn.exe
    114 B
     260 B
     2
    2

    DNS Request

    srv5500.com

    DNS Request

    srv5500.com

  • 8.8.8.8:53
    host5500.net
    dns
    winsvn.exe
    116 B
     131 B
     2
    1

    DNS Request

    host5500.net

    DNS Request

    host5500.net

  • 8.8.8.8:53
    srv5500.com
    dns
    winsvn.exe
    114 B
     260 B
     2
    2

    DNS Request

    srv5500.com

    DNS Request

    srv5500.com

  • 8.8.8.8:53
    host5500.net
    dns
    winsvn.exe
    116 B
     262 B
     2
    2

    DNS Request

    host5500.net

    DNS Request

    host5500.net

  • 8.8.8.8:53
    104.241.123.92.in-addr.arpa
    dns
    146 B
     278 B
     2
    2

    DNS Request

    104.241.123.92.in-addr.arpa

    DNS Request

    104.241.123.92.in-addr.arpa

  • 8.8.8.8:53
    srv5500.com
    dns
    winsvn.exe
    114 B
     260 B
     2
    2

    DNS Request

    srv5500.com

    DNS Request

    srv5500.com

  • 8.8.8.8:53
    119.110.54.20.in-addr.arpa
    dns
    144 B
     316 B
     2
    2

    DNS Request

    119.110.54.20.in-addr.arpa

    DNS Request

    119.110.54.20.in-addr.arpa

  • 8.8.8.8:53
    host5500.net
    dns
    winsvn.exe
    116 B
     262 B
     2
    2

    DNS Request

    host5500.net

    DNS Request

    host5500.net

  • 8.8.8.8:53
    srv5500.com
    dns
    winsvn.exe
    114 B
     260 B
     2
    2

    DNS Request

    srv5500.com

    DNS Request

    srv5500.com

  • 8.8.8.8:53
    host5500.net
    dns
    winsvn.exe
    116 B
     262 B
     2
    2

    DNS Request

    host5500.net

    DNS Request

    host5500.net

  • 8.8.8.8:53
    srv5500.com
    dns
    winsvn.exe
    114 B
     260 B
     2
    2

    DNS Request

    srv5500.com

    DNS Request

    srv5500.com

  • 8.8.8.8:53
    host5500.net
    dns
    winsvn.exe
    116 B
     131 B
     2
    1

    DNS Request

    host5500.net

    DNS Request

    host5500.net

  • 8.8.8.8:53
    srv5500.com
    dns
    winsvn.exe
    114 B
     260 B
     2
    2

    DNS Request

    srv5500.com

    DNS Request

    srv5500.com

  • 8.8.8.8:53
    host5500.net
    dns
    winsvn.exe
    116 B
     262 B
     2
    2

    DNS Request

    host5500.net

    DNS Request

    host5500.net

  • 8.8.8.8:53
    89.65.42.20.in-addr.arpa
    dns
    140 B
     312 B
     2
    2

    DNS Request

    89.65.42.20.in-addr.arpa

    DNS Request

    89.65.42.20.in-addr.arpa

  • 8.8.8.8:53
    srv5500.com
    dns
    winsvn.exe
    114 B
     260 B
     2
    2

    DNS Request

    srv5500.com

    DNS Request

    srv5500.com

  • 8.8.8.8:53
    host5500.net
    dns
    winsvn.exe
    116 B
     262 B
     2
    2

    DNS Request

    host5500.net

    DNS Request

    host5500.net

  • 8.8.8.8:53
    srv5500.com
    dns
    winsvn.exe
    114 B
     130 B
     2
    1

    DNS Request

    srv5500.com

    DNS Request

    srv5500.com

  • 8.8.8.8:53
    host5500.net
    dns
    winsvn.exe
    116 B
     262 B
     2
    2

    DNS Request

    host5500.net

    DNS Request

    host5500.net

  • 8.8.8.8:53
    srv5500.com
    dns
    winsvn.exe
    114 B
     260 B
     2
    2

    DNS Request

    srv5500.com

    DNS Request

    srv5500.com

  • 8.8.8.8:53
    host5500.net
    dns
    winsvn.exe
    116 B
     262 B
     2
    2

    DNS Request

    host5500.net

    DNS Request

    host5500.net

  • 8.8.8.8:53
  • 8.8.8.8:53

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\Microsoft-Driver-1-82-3875-8725-4265\winsvn.exe
    Filesize

    475KB

    MD5

    0bac6e23671f8f591d3329f527369d9b

    SHA1

    adf0579b98b0bcb62e3e853ed260d0c8adb39969

    SHA256

    b2f0e158b12a041a617b6287fafdeba7b91994db225b73a6002dc6b544d4c0ed

    SHA512

    f85fa63e907d469475347bb3d665289a3e8666cf75733fe2483d0362a7e3619fc3a1894e5d5f3125a7a7ba5550eebb265f76f49606ac24c426311fb2f0976f82

    Download Submit

  • C:\Users\Admin\Microsoft-Driver-1-82-3875-8725-4265\winsvn.exe
    Filesize

    464KB

    MD5

    d3e6a592e79c2dc17475455038ffe243

    SHA1

    a432833d9db23720fedd7348774ff605489c3a82

    SHA256

    f37ef6025737ea8db9a98809515d12f29566c284c6085763a920a050e6a64f3e

    SHA512

    61f9b681ba6a7f7886612bec6a240cc6a826c66777b574934a535add2506bf3993c99a640d7460ba59c7b7323f1f2d430486482ca8ff44bf96f2abc90595b7ee

    Download Submit

  • memory/844-0-0x0000000000400000-0x0000000000480000-memory.dmp

    Filesize

    512KB

    Download

  • memory/844-3-0x0000000000400000-0x0000000000480000-memory.dmp

    Filesize

    512KB

    Download

  • memory/1640-66-0x0000000000400000-0x0000000000480000-memory.dmp

    Filesize

    512KB

    Download

  • memory/1640-72-0x0000000000400000-0x0000000000480000-memory.dmp

    Filesize

    512KB

    Download

  • memory/1740-1-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

    Download

  • memory/1740-4-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

    Download

  • memory/1740-5-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

    Download

  • memory/2804-73-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

    Download

  • memory/2804-74-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.