Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

ABO.exe

windows7-x64

8

ABO.exe

windows10-2004-x64

8

ABO.exe

windows7-x64

8

ABO.exe

windows10-2004-x64

10

Adobe.exe

windows7-x64

8

Adobe.exe

windows10-2004-x64

10

CGserver.exe

windows7-x64

10

CGserver.exe

windows10-2004-x64

10

COON.exe

windows7-x64

10

COON.exe

windows10-2004-x64

8

FFA.exe

windows7-x64

10

FFA.exe

windows10-2004-x64

8

FIle Rustyz bot.exe

windows7-x64

8

FIle Rustyz bot.exe

windows10-2004-x64

8

FrostBot v1.exe

windows7-x64

10

FrostBot v1.exe

windows10-2004-x64

10

Google.exe

windows7-x64

10

Google.exe

windows10-2004-x64

10

MORPH_9359...79.exe

windows7-x64

3

MORPH_9359...79.exe

windows10-2004-x64

3

Mycrypt.exe

windows7-x64

8

Mycrypt.exe

windows10-2004-x64

10

PortChecker.exe

windows7-x64

8

PortChecker.exe

windows10-2004-x64

10

R.exe

windows7-x64

10

R.exe

windows10-2004-x64

10

RSBOT.exe

windows7-x64

RSBOT.exe

windows10-2004-x64

Rustyz.exe

windows7-x64

8

Rustyz.exe

windows10-2004-x64

10

Rustyzzbot.exe

windows7-x64

8

Rustyzzbot.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    4s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    09/01/2024, 07:05 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    PortChecker.exe

  • Size

    128KB

  • MD5

    f9e1db23e7a2293a089963351994208d

  • SHA1

    dd60e6052959bf6787e035ce4122f4b9f461ce14

  • SHA256

    27a739ca787fa265624d3ab8a5311a0e0f7d39c79c3c5365aff25159b0bb8dd4

  • SHA512

    7058767d13fc57534f437b6c077d70ced53a0a8f53a03259dc3cc513ab07809c04303db649ba368b67bddee854f78c8570aa46d5f468720caa26696a8d70bc8e

  • SSDEEP

    1536:KENNZHJxxl+LxcZDWAy3OgHEtIyAq3Hoa35ecoNVkSQLVz4ZkNfG:pNHHgKZ4Et5lTRoNO5VEZkNe

Score
8/10
evasion

Malware Config

Signatures

  • Modifies Windows Firewall 1 TTPs 1 IoCs
    evasion
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PortChecker.exe
    "C:\Users\Admin\AppData\Local\Temp\PortChecker.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1888
    • C:\Users\Admin\AppData\Roaming\smss.exe
      /d C:\Users\Admin\AppData\Local\Temp\PortChecker.exe
      2⤵
        PID:2512
      • C:\Windows\SysWOW64\netsh.exe
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\smss.exe" CityScape Enable
        2⤵
        • Modifies Windows Firewall
        PID:2516

    Network

    • flag-us
      DNS
      www.maxmind.com
      PortChecker.exe
      Remote address:
      8.8.8.8:53
      Request
      www.maxmind.com
      IN A
      Response
      www.maxmind.com
      IN A
      104.18.145.235
      www.maxmind.com
      IN A
      104.18.146.235
    • flag-us
      GET
      http://www.maxmind.com/app/locate_my_ip
      PortChecker.exe
      Remote address:
      104.18.145.235:80
      Request
      GET /app/locate_my_ip HTTP/1.1
      Accept: */*
      Accept-Encoding: gzip, deflate
      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
      Host: www.maxmind.com
      Connection: Keep-Alive
      Response
      HTTP/1.1 301 Moved Permanently
      Date: Tue, 09 Jan 2024 08:36:48 GMT
      Transfer-Encoding: chunked
      Connection: keep-alive
      Cache-Control: max-age=3600
      Expires: Tue, 09 Jan 2024 09:36:48 GMT
      Location: https://www.maxmind.com/app/locate_my_ip
      Vary: Accept-Encoding
      Server: cloudflare
      CF-RAY: 842b5acd8d84dcff-LHR
    • flag-us
      GET
      http://www.maxmind.com/en/locate_my_ip
      PortChecker.exe
      Remote address:
      104.18.145.235:80
      Request
      GET /en/locate_my_ip HTTP/1.1
      Accept: */*
      Accept-Encoding: gzip, deflate
      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
      Connection: Keep-Alive
      Host: www.maxmind.com
      Response
      HTTP/1.1 301 Moved Permanently
      Date: Tue, 09 Jan 2024 08:37:02 GMT
      Transfer-Encoding: chunked
      Connection: keep-alive
      Cache-Control: max-age=3600
      Expires: Tue, 09 Jan 2024 09:37:02 GMT
      Location: https://www.maxmind.com/en/locate_my_ip
      Vary: Accept-Encoding
      Server: cloudflare
      CF-RAY: 842b5b20c862dcff-LHR
    • flag-us
      GET
      https://www.maxmind.com/app/locate_my_ip
      PortChecker.exe
      Remote address:
      104.18.145.235:443
      Request
      GET /app/locate_my_ip HTTP/1.1
      Accept: */*
      Accept-Encoding: gzip, deflate
      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
      Connection: Keep-Alive
      Host: www.maxmind.com
      Response
      HTTP/1.1 301 Moved Permanently
      Date: Tue, 09 Jan 2024 08:37:02 GMT
      Content-Type: text/html
      Content-Length: 162
      Connection: keep-alive
      location: http://www.maxmind.com/en/locate_my_ip
      CF-Cache-Status: DYNAMIC
      Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
      Server: cloudflare
      CF-RAY: 842b5b1f6a9506b2-LHR
    • flag-us
      GET
      https://www.maxmind.com/en/locate_my_ip
      PortChecker.exe
      Remote address:
      104.18.145.235:443
      Request
      GET /en/locate_my_ip HTTP/1.1
      Accept: */*
      Accept-Encoding: gzip, deflate
      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
      Connection: Keep-Alive
      Host: www.maxmind.com
      Response
      HTTP/1.1 301 Moved Permanently
      Date: Tue, 09 Jan 2024 08:37:02 GMT
      Content-Length: 0
      Connection: keep-alive
      cache-control: no-cache, no-store
      content-security-policy: base-uri 'self'; connect-src 'self' minfraud.maxmind.com static.maxmind.com status.maxmind.com *.mmapiws.com *.googleapis.com *.doubleclick.net https://api.hubspot.com https://forms.hscollectedforms.net https://forms-na1.hsforms.com https://forms.hsforms.com https://geoip.maxmind.com; default-src 'self'; font-src 'self' fonts.maxmind.com static.maxmind.com fonts.gstatic.com; form-action 'self' *.paypal.com https://forms.hsforms.com; frame-ancestors 'self'; frame-src 'self' *.paypal.com https://app.hubspot.com https://forms.hsforms.com www.youtube.com; img-src 'self' data: static.maxmind.com https:; object-src 'none'; script-src 'self' device.maxmind.com static.maxmind.com *.googleapis.com www.googletagmanager.com www.youtube.com https://js.hsforms.net https://js.hs-scripts.com https://js.hs-analytics.net https://js.hscollectedforms.net https://js.hs-banner.com https://js.usemessages.com 'unsafe-inline'; style-src 'self' static.maxmind.com *.googleapis.com
      content-security-policy: block-all-mixed-content; script-src 'sha256-mIN6atpCFE6wi11ouke1PkFs7z1RJWEbnR96xANQEQ0=' 'nonce-1zpQOInLT3G6Rh2m3/4PJA==' 'strict-dynamic'; style-src 'nonce-1zpQOInLT3G6Rh2m3/4PJA=='
      expires: 0
      feature-policy: accelerometer 'none'; autoplay 'none'; camera 'none'; encrypted-media 'none'; fullscreen 'none'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; midi 'none'; payment 'none'; picture-in-picture 'none'; usb 'none'; sync-xhr 'none'
      location: /en/locate-my-ip-address
      permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), bluetooth=(), browsing-topics=(), camera=(), ch-ua=(), ch-ua-arch=(), ch-ua-bitness=(), ch-ua-full-version=(), ch-ua-full-version-list=(), ch-ua-mobile=(), ch-ua-model=(), ch-ua-platform=(), ch-ua-platform-version=(), ch-ua-wow64=(), clipboard-read=(), clipboard-write=(self), conversion-measurement=(), cross-origin-isolated=(), display-capture=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), focus-without-user-activation=(), fullscreen=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), join-ad-interest-group=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(self), run-ad-auction=(), screen-wake-lock=(), serial=(), shared-autofill=(), speaker-selection=(), sync-script=(), sync-xhr=(), trust-token-redemption=(), unload=(), usb=(), vertical-scroll=(), web-share=(), window-placement=(), xr-spatial-tracking=()
      pragma: no-cache
      referrer-policy: strict-origin-when-cross-origin
      strict-transport-security: max-age=31536000; includeSubDomains; preload
      x-content-type-options: nosniff
      x-frame-options: SAMEORIGIN
      x-xss-protection: 1; mode=block
      CF-Cache-Status: HIT
      Age: 7
      Vary: Accept-Encoding
      Server: cloudflare
      CF-RAY: 842b5b212bdb06b2-LHR
    • flag-us
      GET
      https://www.maxmind.com/en/locate-my-ip-address
      PortChecker.exe
      Remote address:
      104.18.145.235:443
      Request
      GET /en/locate-my-ip-address HTTP/1.1
      Accept: */*
      Accept-Encoding: gzip, deflate
      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
      Connection: Keep-Alive
      Host: www.maxmind.com
      Response
      HTTP/1.1 200 OK
      Date: Tue, 09 Jan 2024 08:37:02 GMT
      Content-Type: text/html;charset=UTF-8
      Content-Length: 6856
      Connection: keep-alive
      cache-control: no-cache, no-store
      content-encoding: gzip
      content-security-policy: base-uri 'self'; connect-src 'self' minfraud.maxmind.com static.maxmind.com status.maxmind.com *.mmapiws.com *.googleapis.com *.doubleclick.net https://api.hubspot.com https://forms.hscollectedforms.net https://forms-na1.hsforms.com https://forms.hsforms.com https://geoip.maxmind.com; default-src 'self'; font-src 'self' fonts.maxmind.com static.maxmind.com fonts.gstatic.com; form-action 'self' *.paypal.com https://forms.hsforms.com; frame-ancestors 'self'; frame-src 'self' *.paypal.com https://app.hubspot.com https://forms.hsforms.com www.youtube.com; img-src 'self' data: static.maxmind.com https:; object-src 'none'; script-src 'self' device.maxmind.com static.maxmind.com *.googleapis.com www.googletagmanager.com www.youtube.com https://js.hsforms.net https://js.hs-scripts.com https://js.hs-analytics.net https://js.hscollectedforms.net https://js.hs-banner.com https://js.usemessages.com 'unsafe-inline'; style-src 'self' static.maxmind.com *.googleapis.com
      content-security-policy: block-all-mixed-content; script-src 'sha256-mIN6atpCFE6wi11ouke1PkFs7z1RJWEbnR96xANQEQ0=' 'nonce-8buEoHbjRmqp4sAabyEo1w==' 'strict-dynamic'; style-src 'nonce-8buEoHbjRmqp4sAabyEo1w=='
      expires: 0
      feature-policy: accelerometer 'none'; autoplay 'none'; camera 'none'; encrypted-media 'none'; fullscreen 'none'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; midi 'none'; payment 'none'; picture-in-picture 'none'; usb 'none'; sync-xhr 'none'
      permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), bluetooth=(), browsing-topics=(), camera=(), ch-ua=(), ch-ua-arch=(), ch-ua-bitness=(), ch-ua-full-version=(), ch-ua-full-version-list=(), ch-ua-mobile=(), ch-ua-model=(), ch-ua-platform=(), ch-ua-platform-version=(), ch-ua-wow64=(), clipboard-read=(), clipboard-write=(self), conversion-measurement=(), cross-origin-isolated=(), display-capture=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), focus-without-user-activation=(), fullscreen=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), join-ad-interest-group=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(self), run-ad-auction=(), screen-wake-lock=(), serial=(), shared-autofill=(), speaker-selection=(), sync-script=(), sync-xhr=(), trust-token-redemption=(), unload=(), usb=(), vertical-scroll=(), web-share=(), window-placement=(), xr-spatial-tracking=()
      pragma: no-cache
      referrer-policy: strict-origin-when-cross-origin
      set-cookie: mm_session=532112fba30d181cb271b4464e694e47a5ef985f--b06942f650d3682ad9b6e007546de5d40d3c4eae3a1fb9ac8522a61a5fa0d1a0; Path=/; HttpOnly; Secure; SameSite=Lax
      strict-transport-security: max-age=31536000; includeSubDomains; preload
      vary: Accept-Encoding
      x-content-type-options: nosniff
      x-frame-options: SAMEORIGIN
      x-xss-protection: 1; mode=block
      CF-Cache-Status: BYPASS
      Accept-Ranges: bytes
      Server: cloudflare
      CF-RAY: 842b5b218c3106b2-LHR
    • flag-us
      DNS
      fearrusty.no-ip.info
      Remote address:
      8.8.8.8:53
      Request
      fearrusty.no-ip.info
      IN A
      Response
    • 104.18.145.235:80
      http://www.maxmind.com/en/locate_my_ip
      http
      PortChecker.exe
      1.8kB
       1.5kB
       10
      6

      HTTP Request

      GET http://www.maxmind.com/app/locate_my_ip

      HTTP Response

      301

      HTTP Request

      GET http://www.maxmind.com/en/locate_my_ip

      HTTP Response

      301
    • 104.18.145.235:443
      https://www.maxmind.com/en/locate-my-ip-address
      tls, http
      PortChecker.exe
      2.2kB
       19.0kB
       19
      28

      HTTP Request

      GET https://www.maxmind.com/app/locate_my_ip

      HTTP Response

      301

      HTTP Request

      GET https://www.maxmind.com/en/locate_my_ip

      HTTP Response

      301

      HTTP Request

      GET https://www.maxmind.com/en/locate-my-ip-address

      HTTP Response

      200
    • 8.8.8.8:53
      www.maxmind.com
      dns
      PortChecker.exe
      61 B
       93 B
       1
      1

      DNS Request

      www.maxmind.com

      DNS Response

      104.18.145.235
      104.18.146.235

    • 8.8.8.8:53
      fearrusty.no-ip.info
      dns
      66 B
       126 B
       1
      1

      DNS Request

      fearrusty.no-ip.info

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.