Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

3b6ff77ca9...79.exe

windows7-x64

7

3b6ff77ca9...79.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/01/2024, 00:19 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3b6ff77ca9f34d2b5698850a2ae87579.exe

  • Size

    1000KB

  • MD5

    3b6ff77ca9f34d2b5698850a2ae87579

  • SHA1

    0d688afab468176b7695f818e5d12d0d569823e7

  • SHA256

    749bbdcb1d0b278bbd608ac3d104896c30a4bb40298c178d78f459521e2d5df5

  • SHA512

    607751a7c8752f57c2dc6389c5ec2531a76c09b3470ac1c0beccf036330442a8d374b5caf830918f421a672332f95272cd8e98bb12786c087bc2dca19504823c

  • SSDEEP

    24576:Iuj8UCHXpe6Y30etBRTq1B+5vMiqt0gj2ed:TdCHQketBRTgqOL

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3b6ff77ca9f34d2b5698850a2ae87579.exe
    "C:\Users\Admin\AppData\Local\Temp\3b6ff77ca9f34d2b5698850a2ae87579.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3096
    • C:\Users\Admin\AppData\Local\Temp\3b6ff77ca9f34d2b5698850a2ae87579.exe
      C:\Users\Admin\AppData\Local\Temp\3b6ff77ca9f34d2b5698850a2ae87579.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:2340
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\3b6ff77ca9f34d2b5698850a2ae87579.exe" /TN Google_Trk_Updater /F
        3⤵
        • Creates scheduled task(s)
        PID:2488

Network

  • flag-us
    DNS
    www.hDhe8xE3wR.com
    3b6ff77ca9f34d2b5698850a2ae87579.exe
    Remote address:
    8.8.8.8:53
    Request
    www.hDhe8xE3wR.com
    IN A
    Response
  • flag-us
    DNS
    w.google.com
    3b6ff77ca9f34d2b5698850a2ae87579.exe
    Remote address:
    8.8.8.8:53
    Request
    w.google.com
    IN A
    Response
    w.google.com
    IN CNAME
    www3.l.google.com
    www3.l.google.com
    IN A
    142.250.200.46
  • flag-gb
    GET
    http://w.google.com/
    3b6ff77ca9f34d2b5698850a2ae87579.exe
    Remote address:
    142.250.200.46:80
    Request
    GET / HTTP/1.1
    Cache-Control: no-cache
    Connection: Keep-Alive
    Pragma: no-cache
    Accept: */*, ???@, ??????????????
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0
    Host: w.google.com
    Response
    HTTP/1.1 404 Not Found
    Content-Type: text/html; charset=UTF-8
    Referrer-Policy: no-referrer
    Content-Length: 1561
    Date: Wed, 10 Jan 2024 23:57:47 GMT
  • flag-us
    DNS
    pastebin.com
    3b6ff77ca9f34d2b5698850a2ae87579.exe
    Remote address:
    8.8.8.8:53
    Request
    pastebin.com
    IN A
    Response
    pastebin.com
    IN A
    172.67.34.170
    pastebin.com
    IN A
    104.20.67.143
    pastebin.com
    IN A
    104.20.68.143
  • flag-us
    GET
    http://pastebin.com/raw/ubFNTPjt
    3b6ff77ca9f34d2b5698850a2ae87579.exe
    Remote address:
    172.67.34.170:80
    Request
    GET /raw/ubFNTPjt HTTP/1.1
    Cache-Control: no-cache
    Connection: Keep-Alive
    Pragma: no-cache
    Accept: */*, ???@, ??????????????
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0
    Host: pastebin.com
    Response
    HTTP/1.1 301 Moved Permanently
    Date: Wed, 10 Jan 2024 23:57:51 GMT
    Transfer-Encoding: chunked
    Connection: keep-alive
    Cache-Control: max-age=3600
    Expires: Thu, 11 Jan 2024 00:57:51 GMT
    Location: https://pastebin.com/raw/ubFNTPjt
    Server: cloudflare
    CF-RAY: 8438dd5bacbd24d8-LHR
  • flag-us
    DNS
    69.31.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    69.31.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    2.136.104.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    2.136.104.51.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    46.200.250.142.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    46.200.250.142.in-addr.arpa
    IN PTR
    Response
    46.200.250.142.in-addr.arpa
    IN PTR
    lhr48s30-in-f141e100net
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    194.178.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    194.178.17.96.in-addr.arpa
    IN PTR
    Response
    194.178.17.96.in-addr.arpa
    IN PTR
    a96-17-178-194deploystaticakamaitechnologiescom
  • flag-us
    DNS
    43.58.199.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    43.58.199.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    170.34.67.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    170.34.67.172.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    241.154.82.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.154.82.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    GET
    https://pastebin.com/raw/ubFNTPjt
    3b6ff77ca9f34d2b5698850a2ae87579.exe
    Remote address:
    172.67.34.170:443
    Request
    GET /raw/ubFNTPjt HTTP/1.1
    Cache-Control: no-cache
    Connection: Keep-Alive
    Pragma: no-cache
    Accept: */*, ???@, ??????????????
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0
    Host: pastebin.com
    Response
    HTTP/1.1 404 Not Found
    Date: Wed, 10 Jan 2024 23:57:52 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    x-frame-options: DENY
    x-frame-options: DENY
    x-content-type-options: nosniff
    x-content-type-options: nosniff
    x-xss-protection: 1;mode=block
    x-xss-protection: 1;mode=block
    cache-control: public, max-age=1801
    CF-Cache-Status: HIT
    Age: 888
    Server: cloudflare
    CF-RAY: 8438dd634ee2459c-LHR
  • flag-us
    DNS
    86.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    86.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    18.134.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.134.221.88.in-addr.arpa
    IN PTR
    Response
    18.134.221.88.in-addr.arpa
    IN PTR
    a88-221-134-18deploystaticakamaitechnologiescom
  • flag-us
    DNS
    174.178.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    174.178.17.96.in-addr.arpa
    IN PTR
    Response
    174.178.17.96.in-addr.arpa
    IN PTR
    a96-17-178-174deploystaticakamaitechnologiescom
  • flag-us
    DNS
    211.135.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    211.135.221.88.in-addr.arpa
    IN PTR
    Response
    211.135.221.88.in-addr.arpa
    IN PTR
    a88-221-135-211deploystaticakamaitechnologiescom
  • flag-us
    DNS
    211.135.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    211.135.221.88.in-addr.arpa
    IN PTR
    Response
    211.135.221.88.in-addr.arpa
    IN PTR
    a88-221-135-211deploystaticakamaitechnologiescom
  • flag-us
    DNS
    217.135.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    217.135.221.88.in-addr.arpa
    IN PTR
    Response
    217.135.221.88.in-addr.arpa
    IN PTR
    a88-221-135-217deploystaticakamaitechnologiescom
  • flag-us
    DNS
    217.135.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    217.135.221.88.in-addr.arpa
    IN PTR
    Response
    217.135.221.88.in-addr.arpa
    IN PTR
    a88-221-135-217deploystaticakamaitechnologiescom
  • flag-us
    DNS
    240.221.184.93.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    240.221.184.93.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    240.221.184.93.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    240.221.184.93.in-addr.arpa
    IN PTR
  • 142.250.200.46:80
    http://w.google.com/
    http
    3b6ff77ca9f34d2b5698850a2ae87579.exe
    462 B
     1.9kB
     5
    4

    HTTP Request

    GET http://w.google.com/

    HTTP Response

    404
  • 172.67.34.170:80
    http://pastebin.com/raw/ubFNTPjt
    http
    3b6ff77ca9f34d2b5698850a2ae87579.exe
    862 B
     476 B
     8
    4

    HTTP Request

    GET http://pastebin.com/raw/ubFNTPjt

    HTTP Response

    301
  • 172.67.34.170:443
    https://pastebin.com/raw/ubFNTPjt
    tls, http
    3b6ff77ca9f34d2b5698850a2ae87579.exe
    953 B
     4.6kB
     9
    8

    HTTP Request

    GET https://pastebin.com/raw/ubFNTPjt

    HTTP Response

    404
  • 93.184.221.240:80
    552 B
     26.4kB
     12
    20
  • 96.16.110.41:443
  • 51.124.78.146:443
  • 51.124.78.146:443
  • 2.17.5.100:80
    46 B
     1
  • 2.17.5.100:80
    46 B
     1
  • 20.54.110.119:443
  • 88.221.135.211:80
  • 88.221.135.211:80
  • 88.221.135.211:80
  • 88.221.135.211:80
  • 88.221.135.211:80
  • 88.221.135.211:80
  • 88.221.135.211:80
  • 88.221.135.211:80
  • 88.221.135.211:80
  • 88.221.135.211:80
  • 88.221.135.211:80
  • 93.184.221.240:80
    92 B
     40 B
     2
    1
  • 88.221.135.211:80
  • 88.221.135.211:80
  • 88.221.135.211:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 52.111.243.29:443
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 204.79.197.200:443
  • 204.79.197.200:443
  • 204.79.197.200:443
  • 204.79.197.200:443
    10.6kB
     311.4kB
     225
    225
  • 204.79.197.200:443
  • 192.229.221.95:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 88.221.134.18:80
  • 88.221.134.18:80
  • 88.221.134.18:80
  • 88.221.134.18:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 88.221.134.32:80
  • 88.221.134.32:80
  • 96.17.178.174:80
  • 88.221.134.18:80
  • 88.221.134.18:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 96.17.178.174:80
  • 8.8.8.8:53
    www.hDhe8xE3wR.com
    dns
    3b6ff77ca9f34d2b5698850a2ae87579.exe
    64 B
     137 B
     1
    1

    DNS Request

    www.hDhe8xE3wR.com

  • 8.8.8.8:53
    w.google.com
    dns
    3b6ff77ca9f34d2b5698850a2ae87579.exe
    58 B
     95 B
     1
    1

    DNS Request

    w.google.com

    DNS Response

    142.250.200.46

  • 8.8.8.8:53
    pastebin.com
    dns
    3b6ff77ca9f34d2b5698850a2ae87579.exe
    58 B
     106 B
     1
    1

    DNS Request

    pastebin.com

    DNS Response

    172.67.34.170
    104.20.67.143
    104.20.68.143

  • 8.8.8.8:53
    69.31.126.40.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    69.31.126.40.in-addr.arpa

  • 8.8.8.8:53
    2.136.104.51.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    2.136.104.51.in-addr.arpa

  • 8.8.8.8:53
    46.200.250.142.in-addr.arpa
    dns
    73 B
     112 B
     1
    1

    DNS Request

    46.200.250.142.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    194.178.17.96.in-addr.arpa
    dns
    72 B
     137 B
     1
    1

    DNS Request

    194.178.17.96.in-addr.arpa

  • 8.8.8.8:53
    43.58.199.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    43.58.199.20.in-addr.arpa

  • 8.8.8.8:53
    170.34.67.172.in-addr.arpa
    dns
    72 B
     134 B
     1
    1

    DNS Request

    170.34.67.172.in-addr.arpa

  • 8.8.8.8:53
    241.154.82.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    241.154.82.20.in-addr.arpa

  • 8.8.8.8:53
    86.23.85.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    86.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    18.134.221.88.in-addr.arpa
    dns
    72 B
     137 B
     1
    1

    DNS Request

    18.134.221.88.in-addr.arpa

  • 8.8.8.8:53
    174.178.17.96.in-addr.arpa
    dns
    72 B
     137 B
     1
    1

    DNS Request

    174.178.17.96.in-addr.arpa

  • 8.8.8.8:53
    211.135.221.88.in-addr.arpa
    dns
    146 B
     278 B
     2
    2

    DNS Request

    211.135.221.88.in-addr.arpa

    DNS Request

    211.135.221.88.in-addr.arpa

  • 8.8.8.8:53
    217.135.221.88.in-addr.arpa
    dns
    146 B
     278 B
     2
    2

    DNS Request

    217.135.221.88.in-addr.arpa

    DNS Request

    217.135.221.88.in-addr.arpa

  • 8.8.8.8:53
    240.221.184.93.in-addr.arpa
    dns
    146 B
     2

    DNS Request

    240.221.184.93.in-addr.arpa

    DNS Request

    240.221.184.93.in-addr.arpa

  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53
  • 8.8.8.8:53

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2340-14-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

    Download

  • memory/2340-21-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

    Download

  • memory/2340-20-0x0000000004F70000-0x0000000004FEE000-memory.dmp

    Filesize

    504KB

    Download

  • memory/2340-15-0x0000000001560000-0x00000000015E3000-memory.dmp

    Filesize

    524KB

    Download

  • memory/2340-27-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

    Download

  • memory/3096-1-0x00000000015E0000-0x0000000001663000-memory.dmp

    Filesize

    524KB

    Download

  • memory/3096-2-0x0000000000400000-0x000000000047E000-memory.dmp

    Filesize

    504KB

    Download

  • memory/3096-11-0x0000000000400000-0x000000000047E000-memory.dmp

    Filesize

    504KB

    Download

  • memory/3096-0-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.