Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19/01/2024, 12:31 UTC
Static task
static1
Behavioral task
behavioral1
Sample
67a2245688599b39c5c3aa1c85a416e2.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
67a2245688599b39c5c3aa1c85a416e2.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Install.dll
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Install.dll
Resource
win10v2004-20231215-en
General
-
Target
67a2245688599b39c5c3aa1c85a416e2.exe
-
Size
137KB
-
MD5
67a2245688599b39c5c3aa1c85a416e2
-
SHA1
25ea9bb14334f308c7cfefc21290c2e639a760fd
-
SHA256
f01f295a2087e626a77c32d79e339ba916163456b0861d40c02405bb65d6ea18
-
SHA512
538f791d39ae7ec2198422c822175ad0764f253237e3e275003a1cea0faf1822b1b849db6d30d2e7cd6aebebf76720c45755436ca9ac5aa6f3a11ce8fcddd566
-
SSDEEP
3072:wmeDmBqskJRVQ45OCPWRB0KOQKgu7hd0aMJGacttYVcdrT:w8AUdRS3QK1tiOWa1T
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
Processes
Network
-
Remote address:8.8.8.8:53Request58.55.71.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request194.178.17.96.in-addr.arpaIN PTRResponse194.178.17.96.in-addr.arpaIN PTRa96-17-178-194deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request133.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request149.220.183.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request28.118.140.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request86.23.85.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request86.23.85.13.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request56.126.166.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request217.135.221.88.in-addr.arpaIN PTRResponse217.135.221.88.in-addr.arpaIN PTRa88-221-135-217deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request79.121.231.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request187.178.17.96.in-addr.arpaIN PTRResponse187.178.17.96.in-addr.arpaIN PTRa96-17-178-187deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request16.173.189.20.in-addr.arpaIN PTRResponse
-
70 B 144 B 1 1
DNS Request
58.55.71.13.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
194.178.17.96.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
133.32.126.40.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
149.220.183.52.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
28.118.140.52.in-addr.arpa
-
140 B 144 B 2 1
DNS Request
86.23.85.13.in-addr.arpa
DNS Request
86.23.85.13.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
56.126.166.20.in-addr.arpa
-
73 B 139 B 1 1
DNS Request
217.135.221.88.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
79.121.231.20.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
187.178.17.96.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
16.173.189.20.in-addr.arpa