Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

6

Static

static

1

2c51606590...91.exe

windows7-x64

6

2c51606590...91.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    129s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 16:15 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2c51606590ffe643de358ab76c138491.exe

  • Size

    322KB

  • MD5

    2c51606590ffe643de358ab76c138491

  • SHA1

    bad5fbd05fae90443525fd5fb96fc2ccbf976b34

  • SHA256

    1442e00ca4e377d3cfefbd22b794fb809f955019a4a66b7e6963c4674b59afb1

  • SHA512

    7a0a12abc239d31bf3a88317f8b374e5c01e58787c2c68e21997f0010ee1212673cd35512d820d5693c6797f3c0215d69046824af95a269d78e2022306173ec9

  • SSDEEP

    3072:Df/PnM0M3HAf7t2oJLWve4kAyJDTtAIZOpcwYEqgKhJvWXqGXj8saVFZ9UAzsdzT:DXPn2EJLWvidxTtopGgKhQOZ9vjX6e

Score
6/10
discovery

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in Windows directory 1 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan

Processes

  • C:\Users\Admin\AppData\Local\Temp\2c51606590ffe643de358ab76c138491.exe
    "C:\Users\Admin\AppData\Local\Temp\2c51606590ffe643de358ab76c138491.exe"
    1⤵
    • Maps connected drives based on registry
    • Drops file in Windows directory
    • Modifies system certificate store
    PID:2284

Network

  • flag-us
    DNS
    get-bluesee.com
    2c51606590ffe643de358ab76c138491.exe
    Remote address:
    8.8.8.8:53
    Request
    get-bluesee.com
    IN A
    Response
  • flag-us
    DNS
    groupmodel.biz
    2c51606590ffe643de358ab76c138491.exe
    Remote address:
    8.8.8.8:53
    Request
    groupmodel.biz
    IN A
    Response
    groupmodel.biz
    IN A
    3.141.96.53
    groupmodel.biz
    IN A
    3.20.137.44
  • flag-us
    GET
    http://groupmodel.biz/?q=qYMztbK%2BIx2IvWGjlhRkslyF9riWTp7zB6AFRPcZD0b%2FgTrncpQHS%2Bt7eoMvO50hvrVm%2F2b3Pz1RykzZLco2xwA891GwqPD1AzfjZNjWuW80TiNwPYqnj8K4TulozMskyOFXdmcqmEsFqGn9rqp%2BaCBXl0eOXdem1csbomVI4%2BIXZeEW3XU8fr%2FildtMnSOYHdeiIUL7FHeNdFBtQsm6pZQp0F3pFyprgavzZbD7EgqjFwnnMTv2vCF3fPn3KYlbdpBDRdeSNW7a7yygjETJMz8YSeIKPaWw4j22%2FKsDaBsvTYt5vHGizfAsWcTkuRByHzT%2BOvVkYOFJa%2FNJR3ItDBhF2jQDHZR4e5OcJQHFDPxQcm%2FVohETycp6Wa
    2c51606590ffe643de358ab76c138491.exe
    Remote address:
    3.141.96.53:80
    Request
    GET /?q=qYMztbK%2BIx2IvWGjlhRkslyF9riWTp7zB6AFRPcZD0b%2FgTrncpQHS%2Bt7eoMvO50hvrVm%2F2b3Pz1RykzZLco2xwA891GwqPD1AzfjZNjWuW80TiNwPYqnj8K4TulozMskyOFXdmcqmEsFqGn9rqp%2BaCBXl0eOXdem1csbomVI4%2BIXZeEW3XU8fr%2FildtMnSOYHdeiIUL7FHeNdFBtQsm6pZQp0F3pFyprgavzZbD7EgqjFwnnMTv2vCF3fPn3KYlbdpBDRdeSNW7a7yygjETJMz8YSeIKPaWw4j22%2FKsDaBsvTYt5vHGizfAsWcTkuRByHzT%2BOvVkYOFJa%2FNJR3ItDBhF2jQDHZR4e5OcJQHFDPxQcm%2FVohETycp6Wa HTTP/1.1
    Accept: */*
    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
    Host: groupmodel.biz
    Response
    HTTP/1.1 301 Moved Permanently
    location: https://groupmodel.biz/?q=qYMztbK%2BIx2IvWGjlhRkslyF9riWTp7zB6AFRPcZD0b%2FgTrncpQHS%2Bt7eoMvO50hvrVm%2F2b3Pz1RykzZLco2xwA891GwqPD1AzfjZNjWuW80TiNwPYqnj8K4TulozMskyOFXdmcqmEsFqGn9rqp%2BaCBXl0eOXdem1csbomVI4%2BIXZeEW3XU8fr%2FildtMnSOYHdeiIUL7FHeNdFBtQsm6pZQp0F3pFyprgavzZbD7EgqjFwnnMTv2vCF3fPn3KYlbdpBDRdeSNW7a7yygjETJMz8YSeIKPaWw4j22%2FKsDaBsvTYt5vHGizfAsWcTkuRByHzT%2BOvVkYOFJa%2FNJR3ItDBhF2jQDHZR4e5OcJQHFDPxQcm%2FVohETycp6Wa
    transfer-encoding: chunked
    date: Thu, 28 Dec 2023 21:49:51 GMT
  • flag-us
    GET
    https://groupmodel.biz/?q=qYMztbK%2BIx2IvWGjlhRkslyF9riWTp7zB6AFRPcZD0b%2FgTrncpQHS%2Bt7eoMvO50hvrVm%2F2b3Pz1RykzZLco2xwA891GwqPD1AzfjZNjWuW80TiNwPYqnj8K4TulozMskyOFXdmcqmEsFqGn9rqp%2BaCBXl0eOXdem1csbomVI4%2BIXZeEW3XU8fr%2FildtMnSOYHdeiIUL7FHeNdFBtQsm6pZQp0F3pFyprgavzZbD7EgqjFwnnMTv2vCF3fPn3KYlbdpBDRdeSNW7a7yygjETJMz8YSeIKPaWw4j22%2FKsDaBsvTYt5vHGizfAsWcTkuRByHzT%2BOvVkYOFJa%2FNJR3ItDBhF2jQDHZR4e5OcJQHFDPxQcm%2FVohETycp6Wa
    2c51606590ffe643de358ab76c138491.exe
    Remote address:
    3.141.96.53:443
    Request
    GET /?q=qYMztbK%2BIx2IvWGjlhRkslyF9riWTp7zB6AFRPcZD0b%2FgTrncpQHS%2Bt7eoMvO50hvrVm%2F2b3Pz1RykzZLco2xwA891GwqPD1AzfjZNjWuW80TiNwPYqnj8K4TulozMskyOFXdmcqmEsFqGn9rqp%2BaCBXl0eOXdem1csbomVI4%2BIXZeEW3XU8fr%2FildtMnSOYHdeiIUL7FHeNdFBtQsm6pZQp0F3pFyprgavzZbD7EgqjFwnnMTv2vCF3fPn3KYlbdpBDRdeSNW7a7yygjETJMz8YSeIKPaWw4j22%2FKsDaBsvTYt5vHGizfAsWcTkuRByHzT%2BOvVkYOFJa%2FNJR3ItDBhF2jQDHZR4e5OcJQHFDPxQcm%2FVohETycp6Wa HTTP/1.1
    Accept: */*
    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
    Connection: Keep-Alive
    Host: groupmodel.biz
  • flag-us
    DNS
    allmodel-pro.com
    2c51606590ffe643de358ab76c138491.exe
    Remote address:
    8.8.8.8:53
    Request
    allmodel-pro.com
    IN A
    Response
  • flag-us
    DNS
    allmodel-pro.com
    2c51606590ffe643de358ab76c138491.exe
    Remote address:
    8.8.8.8:53
    Request
    allmodel-pro.com
    IN A
  • flag-us
    DNS
    apps.identrust.com
    2c51606590ffe643de358ab76c138491.exe
    Remote address:
    8.8.8.8:53
    Request
    apps.identrust.com
    IN A
    Response
    apps.identrust.com
    IN CNAME
    identrust.edgesuite.net
    identrust.edgesuite.net
    IN CNAME
    a1952.dscq.akamai.net
    a1952.dscq.akamai.net
    IN A
    96.17.179.184
    a1952.dscq.akamai.net
    IN A
    96.17.179.205
  • flag-us
    DNS
    apps.identrust.com
    2c51606590ffe643de358ab76c138491.exe
    Remote address:
    8.8.8.8:53
    Request
    apps.identrust.com
    IN A
  • flag-gb
    GET
    http://apps.identrust.com/roots/dstrootcax3.p7c
    2c51606590ffe643de358ab76c138491.exe
    Remote address:
    96.17.179.184:80
    Request
    GET /roots/dstrootcax3.p7c HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: apps.identrust.com
    Response
    HTTP/1.1 200 OK
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: SAMEORIGIN
    X-Content-Type-Options: nosniff
    X-Robots-Tag: noindex
    Referrer-Policy: same-origin
    Last-Modified: Fri, 13 Oct 2023 16:28:31 GMT
    ETag: "37d-6079b8c0929c0"
    Accept-Ranges: bytes
    Content-Length: 893
    X-Content-Type-Options: nosniff
    X-Frame-Options: sameorigin
    Content-Type: application/pkcs7-mime
    Cache-Control: max-age=3600
    Expires: Thu, 28 Dec 2023 22:50:44 GMT
    Date: Thu, 28 Dec 2023 21:50:44 GMT
    Connection: keep-alive
  • flag-us
    DNS
    center-ring.link
    2c51606590ffe643de358ab76c138491.exe
    Remote address:
    8.8.8.8:53
    Request
    center-ring.link
    IN A
    Response
    center-ring.link
    IN A
    72.14.185.43
    center-ring.link
    IN A
    72.14.178.174
    center-ring.link
    IN A
    198.58.118.167
    center-ring.link
    IN A
    45.33.2.79
    center-ring.link
    IN A
    173.255.194.134
    center-ring.link
    IN A
    45.33.20.235
    center-ring.link
    IN A
    45.33.18.44
    center-ring.link
    IN A
    45.79.19.196
    center-ring.link
    IN A
    45.33.23.183
    center-ring.link
    IN A
    96.126.123.244
    center-ring.link
    IN A
    45.56.79.23
    center-ring.link
    IN A
    45.33.30.197
  • flag-us
    GET
    http://center-ring.link/?q=qYMztbK%2BIx2IvWGjlhRkslyF9riWTp7zB6AFRPcZD0b%2FgTrncpQHS%2Bt7eoMvO50hvrVm%2F2b3Pz1RykzZLco2xwA891GwqPD1AzfjZNjWuW80TiNwPYqnj8K4TulozMskyOFXdmcqmEsFqGn9rqp%2BaCBXl0eOXdem1csbomVI4%2BIXZeEW3XU8fr%2FildtMnSOYHdeiIUL7FHeNdFBtQsm6pZQp0F3pFyprgavzZbD7EgqjFwnnMTv2vCF3fPn3KYlbdpBDRdeSNW7a7yygjETJMz8YSeIKPaWw4j22%2FKsDaBsvTYt5vHGizfAsWcTkuRByHzT%2BOvVkYOFJa%2FNJR3ItDBhF2jQDHZR4e5OcJQHFDPxQcm%2FVohETycp6Wa
    2c51606590ffe643de358ab76c138491.exe
    Remote address:
    72.14.185.43:80
    Request
    GET /?q=qYMztbK%2BIx2IvWGjlhRkslyF9riWTp7zB6AFRPcZD0b%2FgTrncpQHS%2Bt7eoMvO50hvrVm%2F2b3Pz1RykzZLco2xwA891GwqPD1AzfjZNjWuW80TiNwPYqnj8K4TulozMskyOFXdmcqmEsFqGn9rqp%2BaCBXl0eOXdem1csbomVI4%2BIXZeEW3XU8fr%2FildtMnSOYHdeiIUL7FHeNdFBtQsm6pZQp0F3pFyprgavzZbD7EgqjFwnnMTv2vCF3fPn3KYlbdpBDRdeSNW7a7yygjETJMz8YSeIKPaWw4j22%2FKsDaBsvTYt5vHGizfAsWcTkuRByHzT%2BOvVkYOFJa%2FNJR3ItDBhF2jQDHZR4e5OcJQHFDPxQcm%2FVohETycp6Wa HTTP/1.1
    Accept: */*
    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
    Host: center-ring.link
    Response
    HTTP/1.1 200 OK
    server: openresty/1.13.6.1
    date: Thu, 28 Dec 2023 21:50:51 GMT
    content-type: text/html
    transfer-encoding: chunked
    connection: close
  • 3.141.96.53:80
    http://groupmodel.biz/?q=qYMztbK%2BIx2IvWGjlhRkslyF9riWTp7zB6AFRPcZD0b%2FgTrncpQHS%2Bt7eoMvO50hvrVm%2F2b3Pz1RykzZLco2xwA891GwqPD1AzfjZNjWuW80TiNwPYqnj8K4TulozMskyOFXdmcqmEsFqGn9rqp%2BaCBXl0eOXdem1csbomVI4%2BIXZeEW3XU8fr%2FildtMnSOYHdeiIUL7FHeNdFBtQsm6pZQp0F3pFyprgavzZbD7EgqjFwnnMTv2vCF3fPn3KYlbdpBDRdeSNW7a7yygjETJMz8YSeIKPaWw4j22%2FKsDaBsvTYt5vHGizfAsWcTkuRByHzT%2BOvVkYOFJa%2FNJR3ItDBhF2jQDHZR4e5OcJQHFDPxQcm%2FVohETycp6Wa
    http
    2c51606590ffe643de358ab76c138491.exe
    1.3kB
     746 B
     6
    5

    HTTP Request

    GET http://groupmodel.biz/?q=qYMztbK%2BIx2IvWGjlhRkslyF9riWTp7zB6AFRPcZD0b%2FgTrncpQHS%2Bt7eoMvO50hvrVm%2F2b3Pz1RykzZLco2xwA891GwqPD1AzfjZNjWuW80TiNwPYqnj8K4TulozMskyOFXdmcqmEsFqGn9rqp%2BaCBXl0eOXdem1csbomVI4%2BIXZeEW3XU8fr%2FildtMnSOYHdeiIUL7FHeNdFBtQsm6pZQp0F3pFyprgavzZbD7EgqjFwnnMTv2vCF3fPn3KYlbdpBDRdeSNW7a7yygjETJMz8YSeIKPaWw4j22%2FKsDaBsvTYt5vHGizfAsWcTkuRByHzT%2BOvVkYOFJa%2FNJR3ItDBhF2jQDHZR4e5OcJQHFDPxQcm%2FVohETycp6Wa

    HTTP Response

    301
  • 3.141.96.53:443
    https://groupmodel.biz/?q=qYMztbK%2BIx2IvWGjlhRkslyF9riWTp7zB6AFRPcZD0b%2FgTrncpQHS%2Bt7eoMvO50hvrVm%2F2b3Pz1RykzZLco2xwA891GwqPD1AzfjZNjWuW80TiNwPYqnj8K4TulozMskyOFXdmcqmEsFqGn9rqp%2BaCBXl0eOXdem1csbomVI4%2BIXZeEW3XU8fr%2FildtMnSOYHdeiIUL7FHeNdFBtQsm6pZQp0F3pFyprgavzZbD7EgqjFwnnMTv2vCF3fPn3KYlbdpBDRdeSNW7a7yygjETJMz8YSeIKPaWw4j22%2FKsDaBsvTYt5vHGizfAsWcTkuRByHzT%2BOvVkYOFJa%2FNJR3ItDBhF2jQDHZR4e5OcJQHFDPxQcm%2FVohETycp6Wa
    tls, http
    2c51606590ffe643de358ab76c138491.exe
    1.7kB
     6.5kB
     17
    12

    HTTP Request

    GET https://groupmodel.biz/?q=qYMztbK%2BIx2IvWGjlhRkslyF9riWTp7zB6AFRPcZD0b%2FgTrncpQHS%2Bt7eoMvO50hvrVm%2F2b3Pz1RykzZLco2xwA891GwqPD1AzfjZNjWuW80TiNwPYqnj8K4TulozMskyOFXdmcqmEsFqGn9rqp%2BaCBXl0eOXdem1csbomVI4%2BIXZeEW3XU8fr%2FildtMnSOYHdeiIUL7FHeNdFBtQsm6pZQp0F3pFyprgavzZbD7EgqjFwnnMTv2vCF3fPn3KYlbdpBDRdeSNW7a7yygjETJMz8YSeIKPaWw4j22%2FKsDaBsvTYt5vHGizfAsWcTkuRByHzT%2BOvVkYOFJa%2FNJR3ItDBhF2jQDHZR4e5OcJQHFDPxQcm%2FVohETycp6Wa
  • 96.17.179.184:80
    http://apps.identrust.com/roots/dstrootcax3.p7c
    http
    2c51606590ffe643de358ab76c138491.exe
    369 B
     1.6kB
     5
    4

    HTTP Request

    GET http://apps.identrust.com/roots/dstrootcax3.p7c

    HTTP Response

    200
  • 72.14.185.43:80
    http://center-ring.link/?q=qYMztbK%2BIx2IvWGjlhRkslyF9riWTp7zB6AFRPcZD0b%2FgTrncpQHS%2Bt7eoMvO50hvrVm%2F2b3Pz1RykzZLco2xwA891GwqPD1AzfjZNjWuW80TiNwPYqnj8K4TulozMskyOFXdmcqmEsFqGn9rqp%2BaCBXl0eOXdem1csbomVI4%2BIXZeEW3XU8fr%2FildtMnSOYHdeiIUL7FHeNdFBtQsm6pZQp0F3pFyprgavzZbD7EgqjFwnnMTv2vCF3fPn3KYlbdpBDRdeSNW7a7yygjETJMz8YSeIKPaWw4j22%2FKsDaBsvTYt5vHGizfAsWcTkuRByHzT%2BOvVkYOFJa%2FNJR3ItDBhF2jQDHZR4e5OcJQHFDPxQcm%2FVohETycp6Wa
    http
    2c51606590ffe643de358ab76c138491.exe
    1.5kB
     1.6kB
     9
    5

    HTTP Request

    GET http://center-ring.link/?q=qYMztbK%2BIx2IvWGjlhRkslyF9riWTp7zB6AFRPcZD0b%2FgTrncpQHS%2Bt7eoMvO50hvrVm%2F2b3Pz1RykzZLco2xwA891GwqPD1AzfjZNjWuW80TiNwPYqnj8K4TulozMskyOFXdmcqmEsFqGn9rqp%2BaCBXl0eOXdem1csbomVI4%2BIXZeEW3XU8fr%2FildtMnSOYHdeiIUL7FHeNdFBtQsm6pZQp0F3pFyprgavzZbD7EgqjFwnnMTv2vCF3fPn3KYlbdpBDRdeSNW7a7yygjETJMz8YSeIKPaWw4j22%2FKsDaBsvTYt5vHGizfAsWcTkuRByHzT%2BOvVkYOFJa%2FNJR3ItDBhF2jQDHZR4e5OcJQHFDPxQcm%2FVohETycp6Wa

    HTTP Response

    200
  • 8.8.8.8:53
    get-bluesee.com
    dns
    2c51606590ffe643de358ab76c138491.exe
    61 B
     134 B
     1
    1

    DNS Request

    get-bluesee.com

  • 8.8.8.8:53
    groupmodel.biz
    dns
    2c51606590ffe643de358ab76c138491.exe
    60 B
     159 B
     1
    1

    DNS Request

    groupmodel.biz

    DNS Response

    3.141.96.53
    3.20.137.44

  • 8.8.8.8:53
    allmodel-pro.com
    dns
    2c51606590ffe643de358ab76c138491.exe
    124 B
     135 B
     2
    1

    DNS Request

    allmodel-pro.com

    DNS Request

    allmodel-pro.com

  • 8.8.8.8:53
    apps.identrust.com
    dns
    2c51606590ffe643de358ab76c138491.exe
    128 B
     165 B
     2
    1

    DNS Request

    apps.identrust.com

    DNS Request

    apps.identrust.com

    DNS Response

    96.17.179.184
    96.17.179.205

  • 8.8.8.8:53
    center-ring.link
    dns
    2c51606590ffe643de358ab76c138491.exe
    62 B
     254 B
     1
    1

    DNS Request

    center-ring.link

    DNS Response

    72.14.185.43
    72.14.178.174
    198.58.118.167
    45.33.2.79
    173.255.194.134
    45.33.20.235
    45.33.18.44
    45.79.19.196
    45.33.23.183
    96.126.123.244
    45.56.79.23
    45.33.30.197

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    682658aecaf9159acea30acf9f33ac38

    SHA1

    bcb4230e238628446fe678c17c0655326a36f08f

    SHA256

    5d40a8ba590b7ea8fb6b41e89b16b995c95df1f8170ebc3b248032c02a993947

    SHA512

    241e1631250b00be3712bb6d7e562348b6e3942d18cae5d05515cacc5e7ab68a0e57f9a6080909c1d4db91c34c5261856f05d2e6968312067c9659a610b3dbcb

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\CabFCB8.tmp
    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Tar2F3.tmp
    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

    Download Submit

  • memory/2284-0-0x0000000000780000-0x00000000007C0000-memory.dmp

    Filesize

    256KB

    Download

  • memory/2284-2-0x0000000000730000-0x000000000075F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/2284-9-0x00000000001D0000-0x00000000001F7000-memory.dmp

    Filesize

    156KB

    Download

  • memory/2284-21-0x0000000000780000-0x00000000007C0000-memory.dmp

    Filesize

    256KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.