Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

3

Static

static

3

4f581f3ca6...0e.exe

windows7-x64

3

4f581f3ca6...0e.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/01/2024, 02:31 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4f581f3ca6c10f5f38934fcab13fd00e.exe

  • Size

    2.3MB

  • MD5

    4f581f3ca6c10f5f38934fcab13fd00e

  • SHA1

    9534c9c0015bbde23099d6dfecc68548c3ddd542

  • SHA256

    7fbaaa99ba2dcbb7a2241df2bae801c9b8ba43a560558a859f3c40ed8f9c2d80

  • SHA512

    83e0418fa6f4a631acbbbf6f19b56dc033936a8fa1be6c653404e7513203f19f7a31a60fe9b2355b55252fff276b5825fc087d2d2c091135098fe74def078644

  • SSDEEP

    49152:CN+9G24TecKw+rx1F1FyX9soeLFPQJ0MEjIJYWgAy9K53X:I+A24qaQx1FmXDUPQmME0WrTYX

Score
3/10

Malware Config

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\4f581f3ca6c10f5f38934fcab13fd00e.exe
    "C:\Users\Admin\AppData\Local\Temp\4f581f3ca6c10f5f38934fcab13fd00e.exe"
    1⤵
      PID:4504

    Network

    • flag-us
      DNS
      64.159.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      64.159.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      190.178.17.96.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      190.178.17.96.in-addr.arpa
      IN PTR
      Response
      190.178.17.96.in-addr.arpa
      IN PTR
      a96-17-178-190deploystaticakamaitechnologiescom
    • flag-us
      DNS
      190.178.17.96.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      190.178.17.96.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      190.178.17.96.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      190.178.17.96.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      190.178.17.96.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      190.178.17.96.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      9.228.82.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      9.228.82.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      9.228.82.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      9.228.82.20.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      9.228.82.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      9.228.82.20.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      158.240.127.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      158.240.127.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      158.240.127.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      158.240.127.40.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      158.240.127.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      158.240.127.40.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      58.99.105.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      58.99.105.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      58.99.105.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      58.99.105.20.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      2.136.104.51.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      2.136.104.51.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      2.136.104.51.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      2.136.104.51.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      208.194.73.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      208.194.73.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      86.23.85.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      86.23.85.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      86.23.85.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      86.23.85.13.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      41.110.16.96.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      41.110.16.96.in-addr.arpa
      IN PTR
      Response
      41.110.16.96.in-addr.arpa
      IN PTR
      a96-16-110-41deploystaticakamaitechnologiescom
    • flag-us
      DNS
      56.126.166.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      56.126.166.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      185.13.222.173.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      185.13.222.173.in-addr.arpa
      IN PTR
      Response
      185.13.222.173.in-addr.arpa
      IN PTR
      a173-222-13-185deploystaticakamaitechnologiescom
    • flag-us
      DNS
      119.110.54.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      119.110.54.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      176.178.17.96.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      176.178.17.96.in-addr.arpa
      IN PTR
      Response
      176.178.17.96.in-addr.arpa
      IN PTR
      a96-17-178-176deploystaticakamaitechnologiescom
    • flag-us
      DNS
      217.135.221.88.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      217.135.221.88.in-addr.arpa
      IN PTR
      Response
      217.135.221.88.in-addr.arpa
      IN PTR
      a88-221-135-217deploystaticakamaitechnologiescom
    • flag-us
      DNS
      218.135.221.88.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      218.135.221.88.in-addr.arpa
      IN PTR
      Response
      218.135.221.88.in-addr.arpa
      IN PTR
      a88-221-135-218deploystaticakamaitechnologiescom
    • flag-us
      DNS
      218.135.221.88.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      218.135.221.88.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      218.135.221.88.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      218.135.221.88.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      187.178.17.96.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      187.178.17.96.in-addr.arpa
      IN PTR
      Response
      187.178.17.96.in-addr.arpa
      IN PTR
      a96-17-178-187deploystaticakamaitechnologiescom
    • flag-us
      DNS
      55.36.223.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      55.36.223.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      55.36.223.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      55.36.223.20.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      240.221.184.93.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      240.221.184.93.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      240.221.184.93.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      240.221.184.93.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      211.178.17.96.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      211.178.17.96.in-addr.arpa
      IN PTR
      Response
      211.178.17.96.in-addr.arpa
      IN PTR
      a96-17-178-211deploystaticakamaitechnologiescom
    • flag-us
      DNS
      211.178.17.96.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      211.178.17.96.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      211.178.17.96.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      211.178.17.96.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      Remote address:
      8.8.8.8:53
      Response
      arc.msn.com
      IN CNAME
      arc.trafficmanager.net
      arc.trafficmanager.net
      IN CNAME
      iris-de-prod-azsc-v2-frc-b.francecentral.cloudapp.azure.com
      iris-de-prod-azsc-v2-frc-b.francecentral.cloudapp.azure.com
      IN A
      20.74.47.205
    • flag-us
      DNS
      Remote address:
      8.8.8.8:53
      Response
      arc.msn.com
      IN CNAME
      arc.trafficmanager.net
      arc.trafficmanager.net
      IN CNAME
      iris-de-prod-azsc-v2-neu.northeurope.cloudapp.azure.com
      iris-de-prod-azsc-v2-neu.northeurope.cloudapp.azure.com
      IN A
      20.223.35.26
    • flag-us
      DNS
      205.47.74.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      205.47.74.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      205.47.74.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      205.47.74.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      23.236.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      23.236.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      23.236.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      23.236.111.52.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      206.23.85.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      206.23.85.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      206.23.85.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      206.23.85.13.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      174.178.17.96.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      174.178.17.96.in-addr.arpa
      IN PTR
      Response
      174.178.17.96.in-addr.arpa
      IN PTR
      a96-17-178-174deploystaticakamaitechnologiescom
    • flag-us
      DNS
      174.178.17.96.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      174.178.17.96.in-addr.arpa
      IN PTR
      Response
      174.178.17.96.in-addr.arpa
      IN PTR
      a96-17-178-174deploystaticakamaitechnologiescom
    • flag-us
      DNS
      72.135.221.88.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      72.135.221.88.in-addr.arpa
      IN PTR
      Response
      72.135.221.88.in-addr.arpa
      IN PTR
      a88-221-135-72deploystaticakamaitechnologiescom
    • flag-us
      DNS
      72.135.221.88.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      72.135.221.88.in-addr.arpa
      IN PTR
      Response
      72.135.221.88.in-addr.arpa
      IN PTR
      a88-221-135-72deploystaticakamaitechnologiescom
    • flag-us
      DNS
      79.121.231.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      79.121.231.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      79.121.231.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      79.121.231.20.in-addr.arpa
      IN PTR
    • 204.79.197.200:443
      tls
      671 B
       1.1kB
       8
      6
    • 204.79.197.200:443
      tls
      49.3kB
       1.4MB
       1022
      1013
    • 204.79.197.200:443
      tls
      671 B
       1.1kB
       8
      6
    • 204.79.197.200:443
      tls
      671 B
       1.1kB
       8
      6
    • 204.79.197.200:443
      tls
      671 B
       1.1kB
       8
      6
    • 96.17.178.176:80
    • 8.8.8.8:53
      64.159.190.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      64.159.190.20.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
       144 B
       1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      190.178.17.96.in-addr.arpa
      dns
      288 B
       137 B
       4
      1

      DNS Request

      190.178.17.96.in-addr.arpa

      DNS Request

      190.178.17.96.in-addr.arpa

      DNS Request

      190.178.17.96.in-addr.arpa

      DNS Request

      190.178.17.96.in-addr.arpa

    • 8.8.8.8:53
      9.228.82.20.in-addr.arpa
      dns
      210 B
       156 B
       3
      1

      DNS Request

      9.228.82.20.in-addr.arpa

      DNS Request

      9.228.82.20.in-addr.arpa

      DNS Request

      9.228.82.20.in-addr.arpa

    • 8.8.8.8:53
      158.240.127.40.in-addr.arpa
      dns
      219 B
       147 B
       3
      1

      DNS Request

      158.240.127.40.in-addr.arpa

      DNS Request

      158.240.127.40.in-addr.arpa

      DNS Request

      158.240.127.40.in-addr.arpa

    • 8.8.8.8:53
      58.99.105.20.in-addr.arpa
      dns
      142 B
       157 B
       2
      1

      DNS Request

      58.99.105.20.in-addr.arpa

      DNS Request

      58.99.105.20.in-addr.arpa

    • 8.8.8.8:53
      2.136.104.51.in-addr.arpa
      dns
      142 B
       157 B
       2
      1

      DNS Request

      2.136.104.51.in-addr.arpa

      DNS Request

      2.136.104.51.in-addr.arpa

    • 8.8.8.8:53
      208.194.73.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      208.194.73.20.in-addr.arpa

    • 8.8.8.8:53
      86.23.85.13.in-addr.arpa
      dns
      140 B
       144 B
       2
      1

      DNS Request

      86.23.85.13.in-addr.arpa

      DNS Request

      86.23.85.13.in-addr.arpa

    • 8.8.8.8:53
      41.110.16.96.in-addr.arpa
      dns
      71 B
       135 B
       1
      1

      DNS Request

      41.110.16.96.in-addr.arpa

    • 8.8.8.8:53
      56.126.166.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      56.126.166.20.in-addr.arpa

    • 8.8.8.8:53
      185.13.222.173.in-addr.arpa
      dns
      73 B
       139 B
       1
      1

      DNS Request

      185.13.222.173.in-addr.arpa

    • 8.8.8.8:53
      119.110.54.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      119.110.54.20.in-addr.arpa

    • 8.8.8.8:53
      176.178.17.96.in-addr.arpa
      dns
      72 B
       137 B
       1
      1

      DNS Request

      176.178.17.96.in-addr.arpa

    • 8.8.8.8:53
      217.135.221.88.in-addr.arpa
      dns
      73 B
       139 B
       1
      1

      DNS Request

      217.135.221.88.in-addr.arpa

    • 8.8.8.8:53
      218.135.221.88.in-addr.arpa
      dns
      219 B
       139 B
       3
      1

      DNS Request

      218.135.221.88.in-addr.arpa

      DNS Request

      218.135.221.88.in-addr.arpa

      DNS Request

      218.135.221.88.in-addr.arpa

    • 8.8.8.8:53
      187.178.17.96.in-addr.arpa
      dns
      72 B
       137 B
       1
      1

      DNS Request

      187.178.17.96.in-addr.arpa

    • 8.8.8.8:53
      55.36.223.20.in-addr.arpa
      dns
      142 B
       157 B
       2
      1

      DNS Request

      55.36.223.20.in-addr.arpa

      DNS Request

      55.36.223.20.in-addr.arpa

    • 8.8.8.8:53
      240.221.184.93.in-addr.arpa
      dns
      146 B
       144 B
       2
      1

      DNS Request

      240.221.184.93.in-addr.arpa

      DNS Request

      240.221.184.93.in-addr.arpa

    • 8.8.8.8:53
      211.178.17.96.in-addr.arpa
      dns
      216 B
       137 B
       3
      1

      DNS Request

      211.178.17.96.in-addr.arpa

      DNS Request

      211.178.17.96.in-addr.arpa

      DNS Request

      211.178.17.96.in-addr.arpa

    • 8.8.8.8:53
      dns
      354 B
       2

      DNS Response

      20.74.47.205

      DNS Response

      20.223.35.26

    • 8.8.8.8:53
    • 8.8.8.8:53
      205.47.74.20.in-addr.arpa
      dns
      142 B
       314 B
       2
      2

      DNS Request

      205.47.74.20.in-addr.arpa

      DNS Request

      205.47.74.20.in-addr.arpa

    • 8.8.8.8:53
      23.236.111.52.in-addr.arpa
      dns
      144 B
       158 B
       2
      1

      DNS Request

      23.236.111.52.in-addr.arpa

      DNS Request

      23.236.111.52.in-addr.arpa

    • 8.8.8.8:53
      206.23.85.13.in-addr.arpa
      dns
      142 B
       145 B
       2
      1

      DNS Request

      206.23.85.13.in-addr.arpa

      DNS Request

      206.23.85.13.in-addr.arpa

    • 8.8.8.8:53
      174.178.17.96.in-addr.arpa
      dns
      144 B
       274 B
       2
      2

      DNS Request

      174.178.17.96.in-addr.arpa

      DNS Request

      174.178.17.96.in-addr.arpa

    • 8.8.8.8:53
      72.135.221.88.in-addr.arpa
      dns
      144 B
       274 B
       2
      2

      DNS Request

      72.135.221.88.in-addr.arpa

      DNS Request

      72.135.221.88.in-addr.arpa

    • 8.8.8.8:53
      79.121.231.20.in-addr.arpa
      dns
      144 B
       158 B
       2
      1

      DNS Request

      79.121.231.20.in-addr.arpa

      DNS Request

      79.121.231.20.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.