Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

5

Static

static

5

1f2d86094d...b8.exe

windows7-x64

5

1f2d86094d...b8.exe

windows10-2004-x64

5

Analysis

  • max time kernel
    122s
  • max time network
    135s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2023, 22:57 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1f2d86094d2dee83912ad1da56e5dab8.exe

  • Size

    886KB

  • MD5

    1f2d86094d2dee83912ad1da56e5dab8

  • SHA1

    00d2373d7ba174fa55044ea75ba35afc55dc9d1d

  • SHA256

    6e9397dea8f93407c3d153610ddb3cc102bf0cbb7feaa5636d85f9a54a428382

  • SHA512

    2df737f009d8c770b949fe2d7ca3a3c4d98c8a072df49471e505687b58db8a6858b123702e370ec0a31f3f6a305fdf0cc0573602dfa93086679a71706dce111e

  • SSDEEP

    24576:FRmJkcoQricOIQxiZY1WNW+TmmAuDeFUGHC:KJZoQrbTFZY1WNW+TjXaC

Score
5/10

Malware Config

Signatures

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of FindShellTrayWindow 20 IoCs
  • Suspicious use of SendNotifyMessage 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1f2d86094d2dee83912ad1da56e5dab8.exe
    "C:\Users\Admin\AppData\Local\Temp\1f2d86094d2dee83912ad1da56e5dab8.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2124

Network

  • flag-us
    DNS
    www.speedtest.net
    1f2d86094d2dee83912ad1da56e5dab8.exe
    Remote address:
    8.8.8.8:53
    Request
    www.speedtest.net
    IN A
    Response
    www.speedtest.net
    IN CNAME
    www.speedtest.net.cdn.cloudflare.net
    www.speedtest.net.cdn.cloudflare.net
    IN A
    104.18.202.232
    www.speedtest.net.cdn.cloudflare.net
    IN A
    104.18.203.232
  • flag-us
    DNS
    www.basabots.com
    1f2d86094d2dee83912ad1da56e5dab8.exe
    Remote address:
    8.8.8.8:53
    Request
    www.basabots.com
    IN A
    Response
    www.basabots.com
    IN CNAME
    basabots.com
    basabots.com
    IN A
    137.184.227.62
  • 137.184.227.62:80
    www.basabots.com
    1f2d86094d2dee83912ad1da56e5dab8.exe
    152 B
     80 B
     3
    2
  • 8.8.8.8:53
    www.speedtest.net
    dns
    1f2d86094d2dee83912ad1da56e5dab8.exe
    63 B
     142 B
     1
    1

    DNS Request

    www.speedtest.net

    DNS Response

    104.18.202.232
    104.18.203.232

  • 8.8.8.8:53
    www.basabots.com
    dns
    1f2d86094d2dee83912ad1da56e5dab8.exe
    62 B
     92 B
     1
    1

    DNS Request

    www.basabots.com

    DNS Response

    137.184.227.62

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2124-0-0x0000000000400000-0x00000000004B0000-memory.dmp

    Filesize

    704KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.