Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

02/02/2024, 15:59 UTC

240202-te4t8scbdp 10

02/02/2024, 15:54 UTC

240202-tcesbscahk 10

Analysis

  • max time kernel
    942s
  • max time network
    953s
  • platform
    windows10-1703_x64
  • resource
    win10-20231215-en
  • resource tags

    arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
  • submitted
    02/02/2024, 15:54 UTC

General

  • Target

    SMS sender 2023/SMS sender 2023/ServerCertificate.p12

  • Size

    4KB

  • MD5

    418f1581b100eb66e1967268a9f7555a

  • SHA1

    6e8e56b742169584aecbecb522b42bc7a23d3d88

  • SHA256

    dedaf20b5caeb58a343c5fc0ca54fdc2756c3aec015c00891458db5848588881

  • SHA512

    04ba029524ea957a887597dd9182978f3ee4631dc577df77bcaedf74f67ae3c249a4cfb5994b8da7b14e60f33e9b1dafcff10e9e03527257297988a128791dc7

  • SSDEEP

    96:RbDsMOTjWjKgdW17VuZe9nQPSusBxpyXSHA91LBj:dYrjPgdWPKkHnyXSg9Hj

Score
1/10

Malware Config

Signatures

Processes

  • C:\Windows\system32\rundll32.exe
    C:\Windows\system32\rundll32.exe cryptext.dll,CryptExtOpenPFX "C:\Users\Admin\AppData\Local\Temp\SMS sender 2023\SMS sender 2023\ServerCertificate.p12"
    1⤵
      PID:512

    Network

    • flag-us
      DNS
      178.223.142.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      178.223.142.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      57.110.18.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      57.110.18.2.in-addr.arpa
      IN PTR
      Response
      57.110.18.2.in-addr.arpa
      IN PTR
      a2-18-110-57deploystaticakamaitechnologiescom
    • flag-us
      DNS
      14.227.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      14.227.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      24.73.42.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      24.73.42.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      210.178.17.96.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      210.178.17.96.in-addr.arpa
      IN PTR
      Response
      210.178.17.96.in-addr.arpa
      IN PTR
      a96-17-178-210deploystaticakamaitechnologiescom
    • flag-us
      DNS
      81.171.91.138.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      81.171.91.138.in-addr.arpa
      IN PTR
      Response
    No results found
    • 8.8.8.8:53
      178.223.142.52.in-addr.arpa
      dns
      73 B
      147 B
      1
      1

      DNS Request

      178.223.142.52.in-addr.arpa

    • 8.8.8.8:53
      57.110.18.2.in-addr.arpa
      dns
      70 B
      133 B
      1
      1

      DNS Request

      57.110.18.2.in-addr.arpa

    • 8.8.8.8:53
      14.227.111.52.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      14.227.111.52.in-addr.arpa

    • 8.8.8.8:53
      24.73.42.20.in-addr.arpa
      dns
      70 B
      156 B
      1
      1

      DNS Request

      24.73.42.20.in-addr.arpa

    • 8.8.8.8:53
      210.178.17.96.in-addr.arpa
      dns
      72 B
      137 B
      1
      1

      DNS Request

      210.178.17.96.in-addr.arpa

    • 8.8.8.8:53
      81.171.91.138.in-addr.arpa
      dns
      72 B
      146 B
      1
      1

      DNS Request

      81.171.91.138.in-addr.arpa

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.