Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

7

1103658c4b...49.exe

windows7-x64

7

1103658c4b...49.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    118s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2023, 06:25 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1103658c4b3bb9dff6c5cfd336888b49.exe

  • Size

    2.5MB

  • MD5

    1103658c4b3bb9dff6c5cfd336888b49

  • SHA1

    8a175095f719aad7f86b2717f395835a6d816580

  • SHA256

    003a8f55631f3e12a5e793827142880a8b1dc64857574176e489b0496eeb53ea

  • SHA512

    4916ad771822cb93b1f4c3ddb9bda5cbb30e6c68e4435a7c0a7c45b81d518b702acb8d0ae8d394b9426a078d1d62d5a748620c55bc3fc1159e27948bc162531c

  • SSDEEP

    49152:G7q0KBwbMxKxPSxf55+PEYMHQau+N74NH5HUyNRcUsCVOzet0:GWjmbMxKaf8EYMwau+4HBUCczz9

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1103658c4b3bb9dff6c5cfd336888b49.exe
    "C:\Users\Admin\AppData\Local\Temp\1103658c4b3bb9dff6c5cfd336888b49.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2224
    • C:\Users\Admin\AppData\Local\Temp\1103658c4b3bb9dff6c5cfd336888b49.exe
      C:\Users\Admin\AppData\Local\Temp\1103658c4b3bb9dff6c5cfd336888b49.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2860

Network

  • flag-us
    DNS
    zipansion.com
    1103658c4b3bb9dff6c5cfd336888b49.exe
    Remote address:
    8.8.8.8:53
    Request
    zipansion.com
    IN A
    Response
    zipansion.com
    IN A
    172.67.144.180
    zipansion.com
    IN A
    104.21.73.114
  • flag-us
    GET
    http://zipansion.com/2pRLi
    1103658c4b3bb9dff6c5cfd336888b49.exe
    Remote address:
    172.67.144.180:80
    Request
    GET /2pRLi HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0
    Host: zipansion.com
    Cache-Control: no-cache
    Response
    HTTP/1.1 301 Moved Permanently
    Date: Sun, 31 Dec 2023 03:21:30 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    set-cookie: FLYSESSID=ege6anqvninkj7f6s1uvedon8j; path=/; HttpOnly; SameSite=Lax
    expires: Thu, 19 Nov 1981 08:52:00 GMT
    cache-control: no-store, no-cache, must-revalidate
    pragma: no-cache
    x-powered-by: adfly
    strict-transport-security: max-age=0
    location: http://yxeepsek.net/-36721UWCO/2pRLi?rndad=1502943035-1703992890
    x-turbo-charged-by: LiteSpeed
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=irm9tRkIZaxkediBP0ibNrN1JfWSkEghKB7RbYsD93J2Y6f2SsMcvBRZ0fjw0YsuNh70IWvHXdRyRmySpGc%2F5BcxcLyUxVG9edCJw%2FcjKjiFcvE0ksm8lRlBxq2zkZ7V"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 83df648a8d0163b7-LHR
    alt-svc: h2=":443"; ma=60
  • flag-us
    DNS
    yxeepsek.net
    1103658c4b3bb9dff6c5cfd336888b49.exe
    Remote address:
    8.8.8.8:53
    Request
    yxeepsek.net
    IN A
    Response
    yxeepsek.net
    IN A
    172.67.194.101
    yxeepsek.net
    IN A
    104.21.20.204
  • flag-us
    GET
    http://yxeepsek.net/-36721UWCO/2pRLi?rndad=1502943035-1703992890
    1103658c4b3bb9dff6c5cfd336888b49.exe
    Remote address:
    172.67.194.101:80
    Request
    GET /-36721UWCO/2pRLi?rndad=1502943035-1703992890 HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0
    Connection: Keep-Alive
    Cache-Control: no-cache
    Host: yxeepsek.net
    Response
    HTTP/1.1 302 Found
    Date: Sun, 31 Dec 2023 03:21:30 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    set-cookie: FLYSESSID=bms8ftgsbtk29g6kesc3d5bq4c; path=/; HttpOnly; SameSite=Lax
    expires: Thu, 19 Nov 1981 08:52:00 GMT
    cache-control: no-cache, no-store, must-revalidate, max-age=0
    pragma: no-cache
    x-powered-by: adfly
    strict-transport-security: max-age=0
    location: /suspended?a=3&u=20186239
    x-turbo-charged-by: LiteSpeed
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LFJjRD%2FngsYZq0BPg%2BVW04%2FNMAZq3%2BPfDqp%2FNULBFxE%2FkrirCOowUhmkkCxylbPE7u1XfsCuUz%2B7i4wm4lE%2BkkGC23ScPli85WGFhbppMrV2JhNKt%2FaCvrNxpT%2BENRc%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 83df648ecb4823bc-LHR
    alt-svc: h2=":443"; ma=60
  • flag-us
    GET
    http://yxeepsek.net/suspended?a=3&u=20186239
    1103658c4b3bb9dff6c5cfd336888b49.exe
    Remote address:
    172.67.194.101:80
    Request
    GET /suspended?a=3&u=20186239 HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0
    Connection: Keep-Alive
    Cache-Control: no-cache
    Host: yxeepsek.net
    Cookie: FLYSESSID=bms8ftgsbtk29g6kesc3d5bq4c
    Response
    HTTP/1.1 200 OK
    Date: Sun, 31 Dec 2023 03:21:31 GMT
    Content-Type: text/html
    Transfer-Encoding: chunked
    Connection: keep-alive
    last-modified: Tue, 10 Nov 2020 09:44:07 GMT
    vary: Accept-Encoding
    x-turbo-charged-by: LiteSpeed
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tYCy2EtHO68T0k8J0iRkqZvS1vYbCn2q1zM0IroKprBWax8C3qxxqddK%2BXBzyZx4i0PPSVWgX8pNb2KfE94sWsuvme95%2BNcvIltOs5T8lfpw3OCBa0MG1NTekGKhDzY%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 83df64907c4d23bc-LHR
    alt-svc: h2=":443"; ma=60
  • 172.67.144.180:80
    http://zipansion.com/2pRLi
    http
    1103658c4b3bb9dff6c5cfd336888b49.exe
    489 B
     2.1kB
     7
    5

    HTTP Request

    GET http://zipansion.com/2pRLi

    HTTP Response

    301
  • 172.67.194.101:80
    http://yxeepsek.net/suspended?a=3&u=20186239
    http
    1103658c4b3bb9dff6c5cfd336888b49.exe
    834 B
     3.3kB
     8
    9

    HTTP Request

    GET http://yxeepsek.net/-36721UWCO/2pRLi?rndad=1502943035-1703992890

    HTTP Response

    302

    HTTP Request

    GET http://yxeepsek.net/suspended?a=3&u=20186239

    HTTP Response

    200
  • 8.8.8.8:53
    zipansion.com
    dns
    1103658c4b3bb9dff6c5cfd336888b49.exe
    59 B
     91 B
     1
    1

    DNS Request

    zipansion.com

    DNS Response

    172.67.144.180
    104.21.73.114

  • 8.8.8.8:53
    yxeepsek.net
    dns
    1103658c4b3bb9dff6c5cfd336888b49.exe
    58 B
     90 B
     1
    1

    DNS Request

    yxeepsek.net

    DNS Response

    172.67.194.101
    104.21.20.204

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\1103658c4b3bb9dff6c5cfd336888b49.exe
    Filesize

    96KB

    MD5

    841e54058e93ec36d8c0805e71abec83

    SHA1

    b5ac151decc6593385748f7e95be688364bf09ef

    SHA256

    24565ac4e9462e1a5933abc3e4e7c774a26b2a64e75e4c00ae2abcb6cd6dcb27

    SHA512

    763e106944830c5116cee8bc0e2407404c0ceb17bc2fa88d5bca4888f4bc0007fcea49c85f08dc9900c38d8fd029f4f3d1ee0670483ad8e8b621170a68cb6933

    Download Submit

  • memory/2224-3-0x0000000001B20000-0x0000000001C53000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/2224-0-0x0000000000400000-0x000000000062A000-memory.dmp

    Filesize

    2.2MB

    Download

  • memory/2224-1-0x0000000000400000-0x00000000008EF000-memory.dmp

    Filesize

    4.9MB

    Download

  • memory/2224-31-0x0000000003730000-0x0000000003C1F000-memory.dmp

    Filesize

    4.9MB

    Download

  • memory/2224-13-0x0000000000400000-0x000000000062A000-memory.dmp

    Filesize

    2.2MB

    Download

  • memory/2224-14-0x0000000003730000-0x0000000003C1F000-memory.dmp

    Filesize

    4.9MB

    Download

  • memory/2860-16-0x0000000000400000-0x000000000062A000-memory.dmp

    Filesize

    2.2MB

    Download

  • memory/2860-20-0x0000000001B20000-0x0000000001C53000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/2860-25-0x0000000003410000-0x000000000363A000-memory.dmp

    Filesize

    2.2MB

    Download

  • memory/2860-23-0x0000000000400000-0x000000000061D000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2860-18-0x0000000000400000-0x00000000008EF000-memory.dmp

    Filesize

    4.9MB

    Download

  • memory/2860-32-0x0000000000400000-0x00000000008EF000-memory.dmp

    Filesize

    4.9MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.