Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

6

Static

static

1

5236bdd1ae...97.exe

windows7-x64

6

5236bdd1ae...97.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    117s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    11/01/2024, 01:52 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5236bdd1aedd71808a243671b1f94597.exe

  • Size

    257KB

  • MD5

    5236bdd1aedd71808a243671b1f94597

  • SHA1

    aac89faa47361d5169f2cfbf42bfe8d8a6bd1138

  • SHA256

    11260a84a209af726a80658754d43c4c548569f4dd555d548b51e422dcfdd34d

  • SHA512

    54b89d5523f76aadcd8defc1a9c830a22e36adb5e62ee98f2d99832c12c77c9beb31232a6e85b935f1adf87a1576705240e31b7110a7cc72398cb97323cc2cf4

  • SSDEEP

    6144:bgpO8rFWNDCLNKWOKvktNRnSsvJQIO6IZyP7pFB8JlB1RN:mB5KWOKvktbSsGt6IZyP1FmJlB1RN

Score
6/10
discovery

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in Windows directory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5236bdd1aedd71808a243671b1f94597.exe
    "C:\Users\Admin\AppData\Local\Temp\5236bdd1aedd71808a243671b1f94597.exe"
    1⤵
    • Maps connected drives based on registry
    • Drops file in Windows directory
    PID:3064

Network

  • flag-us
    DNS
    parentmodel.biz
    5236bdd1aedd71808a243671b1f94597.exe
    Remote address:
    8.8.8.8:53
    Request
    parentmodel.biz
    IN A
    Response
  • flag-us
    DNS
    parentmodel.biz
    5236bdd1aedd71808a243671b1f94597.exe
    Remote address:
    8.8.8.8:53
    Request
    parentmodel.biz
    IN A
  • flag-us
    DNS
    allmodel-pro.com
    5236bdd1aedd71808a243671b1f94597.exe
    Remote address:
    8.8.8.8:53
    Request
    allmodel-pro.com
    IN A
    Response
  • flag-us
    DNS
    allmodel-pro.com
    5236bdd1aedd71808a243671b1f94597.exe
    Remote address:
    8.8.8.8:53
    Request
    allmodel-pro.com
    IN A
  • flag-us
    DNS
    moodmodel.biz
    5236bdd1aedd71808a243671b1f94597.exe
    Remote address:
    8.8.8.8:53
    Request
    moodmodel.biz
    IN A
    Response
  • flag-us
    DNS
    get-multiple.link
    5236bdd1aedd71808a243671b1f94597.exe
    Remote address:
    8.8.8.8:53
    Request
    get-multiple.link
    IN A
    Response
  • flag-us
    DNS
    get-multiple.link
    5236bdd1aedd71808a243671b1f94597.exe
    Remote address:
    8.8.8.8:53
    Request
    get-multiple.link
    IN A
  • flag-us
    DNS
    get-multiple.link
    5236bdd1aedd71808a243671b1f94597.exe
    Remote address:
    8.8.8.8:53
    Request
    get-multiple.link
    IN A
No results found
  • 8.8.8.8:53
    parentmodel.biz
    dns
    5236bdd1aedd71808a243671b1f94597.exe
    122 B
     123 B
     2
    1

    DNS Request

    parentmodel.biz

    DNS Request

    parentmodel.biz

  • 8.8.8.8:53
    allmodel-pro.com
    dns
    5236bdd1aedd71808a243671b1f94597.exe
    124 B
     135 B
     2
    1

    DNS Request

    allmodel-pro.com

    DNS Request

    allmodel-pro.com

  • 8.8.8.8:53
    moodmodel.biz
    dns
    5236bdd1aedd71808a243671b1f94597.exe
    59 B
     121 B
     1
    1

    DNS Request

    moodmodel.biz

  • 8.8.8.8:53
    get-multiple.link
    dns
    5236bdd1aedd71808a243671b1f94597.exe
    189 B
     136 B
     3
    1

    DNS Request

    get-multiple.link

    DNS Request

    get-multiple.link

    DNS Request

    get-multiple.link

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3064-0-0x0000000000020000-0x0000000000021000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3064-4-0x0000000000090000-0x0000000000091000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3064-3-0x0000000000080000-0x0000000000081000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3064-2-0x00000000000E0000-0x0000000000109000-memory.dmp

    Filesize

    164KB

    Download

  • memory/3064-1-0x0000000000030000-0x0000000000031000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3064-5-0x00000000001B0000-0x00000000001DF000-memory.dmp

    Filesize

    188KB

    Download

  • memory/3064-9-0x00000000000E0000-0x0000000000109000-memory.dmp

    Filesize

    164KB

    Download

  • memory/3064-14-0x0000000001170000-0x0000000001197000-memory.dmp

    Filesize

    156KB

    Download

  • memory/3064-18-0x00000000000E0000-0x0000000000109000-memory.dmp

    Filesize

    164KB

    Download

  • memory/3064-23-0x00000000000E0000-0x0000000000109000-memory.dmp

    Filesize

    164KB

    Download

  • memory/3064-25-0x00000000000E0000-0x0000000000109000-memory.dmp

    Filesize

    164KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.