Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

8a9cacd789...52.exe

windows7-x64

7

8a9cacd789...52.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    143s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/02/2024, 02:21 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8a9cacd789a6b530c5aefa0a3f5a5952.exe

  • Size

    4.3MB

  • MD5

    8a9cacd789a6b530c5aefa0a3f5a5952

  • SHA1

    18c2d69de57fbd554d5a8e59d8a9c229afc8cadc

  • SHA256

    bbc0d94f0cdd9711f992b83ef5ad8ced87605b2ede666db7536ea6ce34c192a3

  • SHA512

    022a776f5a6bde4dc799ec0b1cc152eab2b31f86b2bc6036528a57c850a3b69f670a85efb0368b9bdf06daf55490205fb10885082cef3ff53330dde3817eff42

  • SSDEEP

    98304:By3taq6A+5u9oVa6TuVBkiF+LPJ5WRIwGhvSbTTN4uMi2Gsc:c3taVzE6s6uBzbIw8UBMi6

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 2 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8a9cacd789a6b530c5aefa0a3f5a5952.exe
    "C:\Users\Admin\AppData\Local\Temp\8a9cacd789a6b530c5aefa0a3f5a5952.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2944
    • C:\Users\Admin\AppData\Local\Temp\8a9cacd789a6b530c5aefa0a3f5a5952.exe
      "C:\Users\Admin\AppData\Local\Temp\8a9cacd789a6b530c5aefa0a3f5a5952.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4936
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c cls && title BlackBong Software 2016-2018
        3⤵
          PID:1404

    Network

    • flag-us
      DNS
      154.239.44.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      154.239.44.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      194.178.17.96.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      194.178.17.96.in-addr.arpa
      IN PTR
      Response
      194.178.17.96.in-addr.arpa
      IN PTR
      a96-17-178-194deploystaticakamaitechnologiescom
    • flag-us
      DNS
      22.160.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      22.160.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      228.249.119.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      228.249.119.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      13.86.106.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      13.86.106.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      183.59.114.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      183.59.114.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      171.39.242.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      171.39.242.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      180.178.17.96.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      180.178.17.96.in-addr.arpa
      IN PTR
      Response
      180.178.17.96.in-addr.arpa
      IN PTR
      a96-17-178-180deploystaticakamaitechnologiescom
    • flag-us
      DNS
      34.197.79.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      34.197.79.40.in-addr.arpa
      IN PTR
      Response
    • 52.142.223.178:80
      46 B
       1
    • 8.8.8.8:53
      154.239.44.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      154.239.44.20.in-addr.arpa

    • 8.8.8.8:53
      194.178.17.96.in-addr.arpa
      dns
      72 B
       137 B
       1
      1

      DNS Request

      194.178.17.96.in-addr.arpa

    • 8.8.8.8:53
      22.160.190.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      22.160.190.20.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
       144 B
       1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      228.249.119.40.in-addr.arpa
      dns
      73 B
       159 B
       1
      1

      DNS Request

      228.249.119.40.in-addr.arpa

    • 8.8.8.8:53
      13.86.106.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      13.86.106.20.in-addr.arpa

    • 8.8.8.8:53
      183.59.114.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      183.59.114.20.in-addr.arpa

    • 8.8.8.8:53
      171.39.242.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      171.39.242.20.in-addr.arpa

    • 8.8.8.8:53
      180.178.17.96.in-addr.arpa
      dns
      72 B
       137 B
       1
      1

      DNS Request

      180.178.17.96.in-addr.arpa

    • 8.8.8.8:53
      34.197.79.40.in-addr.arpa
      dns
      71 B
       145 B
       1
      1

      DNS Request

      34.197.79.40.in-addr.arpa

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\_MEI29442\Crypto.Cipher._AES.pyd
      Filesize

      16KB

      MD5

      c5f603fae071c883cf8ca1400855b713

      SHA1

      fc6fab3bee6aa33354f1dedcb12c207fa42bbc64

      SHA256

      e44e6dd3cbff07038853d694f960d60c3b60e89389217319ffd176a28e16b086

      SHA512

      3a8c3a0c7c8c608d12434d6b4eef6cf63cfce039b4d074c90f71a9b2d19a7c0cd983fa0c72ccbd4d1e9b5f21dd7e1dc7e9433d2937dfc592365e1bd73356489e

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\_MEI29442\main.exe.manifest
      Filesize

      1008B

      MD5

      ad0ec8ca74f71a81b29b4dfa20e30bec

      SHA1

      af5cf20cc503e27cdbceabe0d96591e5840f0e4c

      SHA256

      ce2ef99323bafb9a10a82b643fbed8930bb054ea9d5b06356b9b08c262154b48

      SHA512

      da46bfc845e3d9354de8d7fa10ad204257fa985e4c4ce01ccc96dfeb14c9de536f31fb1f1ee07baa054a27cf638033f0e6fb5c11c25f98a522fb9dac22033de2

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\_MEI29442\python27.dll
      Filesize

      879KB

      MD5

      4953718d73246486612d952e00b2deb9

      SHA1

      c87098ffe58ba2f5c24c9653ea9599da1a65e663

      SHA256

      ec4d398a61fe2ecb956342f5e2845fd811b436c601f9416ba307592a530c8f70

      SHA512

      afd60f911b09ba17e0e458b73293499730e7ff87c204ed23a650bcc04a0773d106256e855ec31996735850b15416e6fa64bf16c08a20cb97ce860f6e915a5e6c

      Download Submit

    • memory/4936-15-0x0000000075590000-0x0000000075841000-memory.dmp

      Filesize

      2.7MB

      Download

    • memory/4936-18-0x0000000010000000-0x000000001000E000-memory.dmp

      Filesize

      56KB

      Download

    • memory/4936-19-0x0000000075590000-0x0000000075841000-memory.dmp

      Filesize

      2.7MB

      Download

    • memory/4936-21-0x0000000075590000-0x0000000075841000-memory.dmp

      Filesize

      2.7MB

      Download

    • memory/4936-22-0x0000000010000000-0x000000001000E000-memory.dmp

      Filesize

      56KB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.