Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
97s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 06:52 UTC
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0ce609ce5809abf9a779936d7024af54.exe
Resource
win7-20231215-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
0ce609ce5809abf9a779936d7024af54.exe
Resource
win10v2004-20231222-en
0 signatures
150 seconds
General
-
Target
0ce609ce5809abf9a779936d7024af54.exe
-
Size
75KB
-
MD5
0ce609ce5809abf9a779936d7024af54
-
SHA1
8fa781a02182d4e19c52d64776d9c3e43595f22a
-
SHA256
e877d027fb2e1b87224d058d3e6d950fa36dc01c77d1d011a6c337abbe971a46
-
SHA512
e119e490a2435bde18df8f48a4778f0eb5d30f9b2c68d6176aba5b90b9b35dfaf935a753f35c7975b251e1900d62a71085095e4a5ecea0e2b3caf680080c06fa
-
SSDEEP
1536:lapZjPhVrGeNZREbfYUBL8tcQf2gPNk84O6msYoTj6mr5iV5EP:lmLffEbVBL85PRo36mr5iV5EP
Score
1/10
Malware Config
Signatures
Processes
Network
-
Remote address:8.8.8.8:53Requesthp.xiazhai8.netIN AResponse
-
Remote address:8.8.8.8:53Requestneirong.funshion.comIN AResponseneirong.funshion.comIN CNAMEneirong.funshion.com.scc.topgslb.comneirong.funshion.com.scc.topgslb.comIN CNAMEsal.topgslb.comsal.topgslb.comIN A183.239.106.42sal.topgslb.comIN A183.239.106.47sal.topgslb.comIN A183.239.106.48
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Request21.177.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestg.bing.comIN AResponseg.bing.comIN CNAMEg-bing-com.a-0001.a-msedge.netg-bing-com.a-0001.a-msedge.netIN CNAMEdual-a-0001.a-msedge.netdual-a-0001.a-msedge.netIN A204.79.197.200dual-a-0001.a-msedge.netIN A13.107.21.200
-
Remote address:8.8.8.8:53Requestg.bing.comIN A
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=0d9f9b2b391a421e818a60a7de3f5048&localId=w:8DF2633F-10BE-C247-8B12-9A64CE5AE8FE&deviceId=6896190589629886&anid=Remote address:204.79.197.200:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=0d9f9b2b391a421e818a60a7de3f5048&localId=w:8DF2633F-10BE-C247-8B12-9A64CE5AE8FE&deviceId=6896190589629886&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=0626F0C9AFD06E323D31E33BAEF76FB6; domain=.bing.com; expires=Sat, 18-Jan-2025 18:38:19 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 9A00E4C7DF9245A4BA21697D88345193 Ref B: LON04EDGE0620 Ref C: 2023-12-25T18:38:19Z
date: Mon, 25 Dec 2023 18:38:19 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=0d9f9b2b391a421e818a60a7de3f5048&localId=w:8DF2633F-10BE-C247-8B12-9A64CE5AE8FE&deviceId=6896190589629886&anid=Remote address:204.79.197.200:443RequestGET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=0d9f9b2b391a421e818a60a7de3f5048&localId=w:8DF2633F-10BE-C247-8B12-9A64CE5AE8FE&deviceId=6896190589629886&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=0626F0C9AFD06E323D31E33BAEF76FB6
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MSPTC=dMMnZ-8jtrIFufpBczkwkf4P8B9fQabFvVFSJcbUG74; domain=.bing.com; expires=Sat, 18-Jan-2025 18:38:20 GMT; path=/; Partitioned; secure; SameSite=None
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: A4FF59EFDFBA4740BEB1A975012B0854 Ref B: LON04EDGE0620 Ref C: 2023-12-25T18:38:20Z
date: Mon, 25 Dec 2023 18:38:19 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=0d9f9b2b391a421e818a60a7de3f5048&localId=w:8DF2633F-10BE-C247-8B12-9A64CE5AE8FE&deviceId=6896190589629886&anid=Remote address:204.79.197.200:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=0d9f9b2b391a421e818a60a7de3f5048&localId=w:8DF2633F-10BE-C247-8B12-9A64CE5AE8FE&deviceId=6896190589629886&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=0626F0C9AFD06E323D31E33BAEF76FB6; MSPTC=dMMnZ-8jtrIFufpBczkwkf4P8B9fQabFvVFSJcbUG74
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 57FE1572299D4A03BD21112E2F50FC09 Ref B: LON04EDGE0620 Ref C: 2023-12-25T18:38:20Z
date: Mon, 25 Dec 2023 18:38:19 GMT
-
Remote address:8.8.8.8:53Request155.178.17.96.in-addr.arpaIN PTRResponse155.178.17.96.in-addr.arpaIN PTRa96-17-178-155deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request241.154.82.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request195.233.44.23.in-addr.arpaIN PTRResponse195.233.44.23.in-addr.arpaIN PTRa23-44-233-195deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request86.23.85.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request56.126.166.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request56.126.166.20.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request134.71.91.104.in-addr.arpaIN PTRResponse134.71.91.104.in-addr.arpaIN PTRa104-91-71-134deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Requestskype.tom.comIN AResponse
-
Remote address:8.8.8.8:53Requestwww.gongfusky.comIN AResponse
-
Remote address:8.8.8.8:53Request143.179.17.96.in-addr.arpaIN PTRResponse143.179.17.96.in-addr.arpaIN PTRa96-17-179-143deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Requestdownload.uusee.comIN AResponsedownload.uusee.comIN A117.78.42.51
-
Remote address:8.8.8.8:53Request19.229.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request235.137.73.23.in-addr.arpaIN PTRResponse235.137.73.23.in-addr.arpaIN PTRa23-73-137-235deploystaticakamaitechnologiescom
-
260 B 5
-
204.79.197.200:443https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=0d9f9b2b391a421e818a60a7de3f5048&localId=w:8DF2633F-10BE-C247-8B12-9A64CE5AE8FE&deviceId=6896190589629886&anid=tls, http22.0kB 9.4kB 22 19
HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=0d9f9b2b391a421e818a60a7de3f5048&localId=w:8DF2633F-10BE-C247-8B12-9A64CE5AE8FE&deviceId=6896190589629886&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=0d9f9b2b391a421e818a60a7de3f5048&localId=w:8DF2633F-10BE-C247-8B12-9A64CE5AE8FE&deviceId=6896190589629886&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=0d9f9b2b391a421e818a60a7de3f5048&localId=w:8DF2633F-10BE-C247-8B12-9A64CE5AE8FE&deviceId=6896190589629886&anid=HTTP Response
204 -
260 B 5
-
260 B 5
-
260 B 5
-
61 B 134 B 1 1
DNS Request
hp.xiazhai8.net
-
66 B 179 B 1 1
DNS Request
neirong.funshion.com
DNS Response
183.239.106.42183.239.106.47183.239.106.48
-
66 B 90 B 1 1
DNS Request
8.8.8.8.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
21.177.190.20.in-addr.arpa
-
112 B 158 B 2 1
DNS Request
g.bing.com
DNS Request
g.bing.com
DNS Response
204.79.197.20013.107.21.200
-
72 B 137 B 1 1
DNS Request
155.178.17.96.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
241.154.82.20.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
195.233.44.23.in-addr.arpa
-
146 B 144 B 2 1
DNS Request
95.221.229.192.in-addr.arpa
DNS Request
95.221.229.192.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
86.23.85.13.in-addr.arpa
-
144 B 158 B 2 1
DNS Request
56.126.166.20.in-addr.arpa
DNS Request
56.126.166.20.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
134.71.91.104.in-addr.arpa
-
59 B 132 B 1 1
DNS Request
skype.tom.com
-
63 B 136 B 1 1
DNS Request
www.gongfusky.com
-
72 B 137 B 1 1
DNS Request
143.179.17.96.in-addr.arpa
-
64 B 80 B 1 1
DNS Request
download.uusee.com
DNS Response
117.78.42.51
-
72 B 158 B 1 1
DNS Request
19.229.111.52.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
235.137.73.23.in-addr.arpa