Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    441s
  • max time network
    1176s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/02/2024, 10:55 UTC

General

  • Target

    $PLUGINSDIR/AccessControl.dll

  • Size

    15KB

  • MD5

    d74bb4447af48da081c7d9b499f3a023

  • SHA1

    dadf6e140e6fd8e49a1851cc144bb022e0adb185

  • SHA256

    5fd5d8aec97cffaad9b7df6371b348d436cf1401e86fab614dc4cb8575428e52

  • SHA512

    9a15de5c6b08914f5e5bbc1c318fb0e84da28a316cf51ccddca8dfb64cd67b7ad06acac307b41d5086a0740055d327007ff890807d6853bb2e767179a3b3d758

  • SSDEEP

    192:0hdGZ2E0hm+Gc7ROMzCPvXWROt086dXHGrEKcDDi0b5ZsgMgiCXyo1Fp01eLLuIt:0hdGZ2E0YWV2908oj21ILud8

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\AccessControl.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1944
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\AccessControl.dll,#1
      2⤵
        PID:4448
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 612
          3⤵
          • Program crash
          PID:2968
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4448 -ip 4448
      1⤵
        PID:4720

      Network

      • flag-us
        DNS
        23.177.190.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        23.177.190.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        193.78.101.95.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        193.78.101.95.in-addr.arpa
        IN PTR
        Response
        193.78.101.95.in-addr.arpa
        IN PTR
        a95-101-78-193deploystaticakamaitechnologiescom
      • flag-us
        DNS
        241.154.82.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        241.154.82.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        g.bing.com
        Remote address:
        8.8.8.8:53
        Request
        g.bing.com
        IN A
        Response
        g.bing.com
        IN CNAME
        g-bing-com.a-0001.a-msedge.net
        g-bing-com.a-0001.a-msedge.net
        IN CNAME
        dual-a-0001.a-msedge.net
        dual-a-0001.a-msedge.net
        IN A
        204.79.197.200
        dual-a-0001.a-msedge.net
        IN A
        13.107.21.200
      • flag-us
        GET
        https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De80ZPKLU1i82DKS1o1D7lUKDVUCUzu36zZqu3h_M5331I5v-FFa5d2irani0xH2BoPShp1NCJkvl9J39NpQ1D_dG-By6mrfVTHw1poYDMzkI0ZuNUxHP7Ma4a_2NtvSIGS0L30IMF9MQ2G5VgqwMT9myvF0SV8zH-p_10NlaDUN0V4bakZ%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJRCUzZDlOUlJKTExYTTY4ViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D95eeda16d8e919771a69bfc2b0daa31f&TIME=20240220T085235Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:AA33CD7D-B08B-86B8-A252-00B8C8367286&deviceId=6896193134260924&muid=AA33CD7DB08B86B8A25200B8C8367286
        Remote address:
        204.79.197.200:443
        Request
        GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De80ZPKLU1i82DKS1o1D7lUKDVUCUzu36zZqu3h_M5331I5v-FFa5d2irani0xH2BoPShp1NCJkvl9J39NpQ1D_dG-By6mrfVTHw1poYDMzkI0ZuNUxHP7Ma4a_2NtvSIGS0L30IMF9MQ2G5VgqwMT9myvF0SV8zH-p_10NlaDUN0V4bakZ%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJRCUzZDlOUlJKTExYTTY4ViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D95eeda16d8e919771a69bfc2b0daa31f&TIME=20240220T085235Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:AA33CD7D-B08B-86B8-A252-00B8C8367286&deviceId=6896193134260924&muid=AA33CD7DB08B86B8A25200B8C8367286 HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        set-cookie: MUID=1D8553E146D36E33368C47CD47336FD5; domain=.bing.com; expires=Mon, 17-Mar-2025 10:56:08 GMT; path=/; SameSite=None; Secure; Priority=High;
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: CDFE46D5521046AB9787C247D6029FD0 Ref B: LON04EDGE1213 Ref C: 2024-02-21T10:56:08Z
        date: Wed, 21 Feb 2024 10:56:08 GMT
      • flag-us
        GET
        https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De80ZPKLU1i82DKS1o1D7lUKDVUCUzu36zZqu3h_M5331I5v-FFa5d2irani0xH2BoPShp1NCJkvl9J39NpQ1D_dG-By6mrfVTHw1poYDMzkI0ZuNUxHP7Ma4a_2NtvSIGS0L30IMF9MQ2G5VgqwMT9myvF0SV8zH-p_10NlaDUN0V4bakZ%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJRCUzZDlOUlJKTExYTTY4ViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D95eeda16d8e919771a69bfc2b0daa31f&TIME=20240220T085235Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:AA33CD7D-B08B-86B8-A252-00B8C8367286&deviceId=6896193134260924&muid=AA33CD7DB08B86B8A25200B8C8367286
        Remote address:
        204.79.197.200:443
        Request
        GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De80ZPKLU1i82DKS1o1D7lUKDVUCUzu36zZqu3h_M5331I5v-FFa5d2irani0xH2BoPShp1NCJkvl9J39NpQ1D_dG-By6mrfVTHw1poYDMzkI0ZuNUxHP7Ma4a_2NtvSIGS0L30IMF9MQ2G5VgqwMT9myvF0SV8zH-p_10NlaDUN0V4bakZ%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJRCUzZDlOUlJKTExYTTY4ViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D95eeda16d8e919771a69bfc2b0daa31f&TIME=20240220T085235Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:AA33CD7D-B08B-86B8-A252-00B8C8367286&deviceId=6896193134260924&muid=AA33CD7DB08B86B8A25200B8C8367286 HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        cookie: MUID=1D8553E146D36E33368C47CD47336FD5; _EDGE_S=SID=10AC7DF9D0426763003A69D5D144669F
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        set-cookie: MSPTC=sSljHNdzR_6EVsMcPqCdUhEujrr4bEEDnVlDpYBG0t8; domain=.bing.com; expires=Mon, 17-Mar-2025 10:56:08 GMT; path=/; Partitioned; secure; SameSite=None
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: A3E8749D037A4D308EF6746DF204B499 Ref B: LON04EDGE1213 Ref C: 2024-02-21T10:56:08Z
        date: Wed, 21 Feb 2024 10:56:08 GMT
      • flag-be
        GET
        https://www.bing.com/aes/c.gif?type=mv&reqver=1.0&rg=97f2124e0d964846aba2f486ff0b959b&tids=15000&med=10&pubId=251978541&TIME=20240220T085235Z&adUnitId=11730597&localId=w:AA33CD7D-B08B-86B8-A252-00B8C8367286&deviceId=6896193134260924
        Remote address:
        88.221.83.235:443
        Request
        GET /aes/c.gif?type=mv&reqver=1.0&rg=97f2124e0d964846aba2f486ff0b959b&tids=15000&med=10&pubId=251978541&TIME=20240220T085235Z&adUnitId=11730597&localId=w:AA33CD7D-B08B-86B8-A252-00B8C8367286&deviceId=6896193134260924 HTTP/2.0
        host: www.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        cookie: MUID=1D8553E146D36E33368C47CD47336FD5
        Response
        HTTP/2.0 200
        cache-control: private,no-store
        pragma: no-cache
        vary: Origin
        p3p: CP=BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: E1993F974CDD40288F8590F99BBBCC18 Ref B: LON212050702037 Ref C: 2024-02-21T10:56:08Z
        content-length: 0
        date: Wed, 21 Feb 2024 10:56:08 GMT
        set-cookie: _EDGE_S=SID=10AC7DF9D0426763003A69D5D144669F; path=/; httponly; domain=bing.com
        set-cookie: MUIDB=1D8553E146D36E33368C47CD47336FD5; path=/; httponly; expires=Mon, 17-Mar-2025 10:56:08 GMT
        alt-svc: h3=":443"; ma=93600
        x-cdn-traceid: 0.e753dd58.1708512968.2910de68
      • flag-us
        DNS
        205.47.74.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        205.47.74.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        41.110.16.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        41.110.16.96.in-addr.arpa
        IN PTR
        Response
        41.110.16.96.in-addr.arpa
        IN PTR
        a96-16-110-41deploystaticakamaitechnologiescom
      • flag-us
        DNS
        200.197.79.204.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        200.197.79.204.in-addr.arpa
        IN PTR
        Response
        200.197.79.204.in-addr.arpa
        IN PTR
        a-0001a-msedgenet
      • flag-us
        DNS
        235.83.221.88.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        235.83.221.88.in-addr.arpa
        IN PTR
        Response
        235.83.221.88.in-addr.arpa
        IN PTR
        a88-221-83-235deploystaticakamaitechnologiescom
      • flag-us
        DNS
        157.123.68.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        157.123.68.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        198.187.3.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        198.187.3.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        217.135.221.88.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        217.135.221.88.in-addr.arpa
        IN PTR
        Response
        217.135.221.88.in-addr.arpa
        IN PTR
        a88-221-135-217deploystaticakamaitechnologiescom
      • flag-us
        DNS
        209.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        209.178.17.96.in-addr.arpa
        IN PTR
        Response
        209.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-209deploystaticakamaitechnologiescom
      • flag-us
        DNS
        21.236.111.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        21.236.111.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        88.16.208.104.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        88.16.208.104.in-addr.arpa
        IN PTR
        Response
      • 204.79.197.200:443
        https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De80ZPKLU1i82DKS1o1D7lUKDVUCUzu36zZqu3h_M5331I5v-FFa5d2irani0xH2BoPShp1NCJkvl9J39NpQ1D_dG-By6mrfVTHw1poYDMzkI0ZuNUxHP7Ma4a_2NtvSIGS0L30IMF9MQ2G5VgqwMT9myvF0SV8zH-p_10NlaDUN0V4bakZ%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJRCUzZDlOUlJKTExYTTY4ViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D95eeda16d8e919771a69bfc2b0daa31f&TIME=20240220T085235Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:AA33CD7D-B08B-86B8-A252-00B8C8367286&deviceId=6896193134260924&muid=AA33CD7DB08B86B8A25200B8C8367286
        tls, http2
        2.5kB
        9.0kB
        20
        18

        HTTP Request

        GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De80ZPKLU1i82DKS1o1D7lUKDVUCUzu36zZqu3h_M5331I5v-FFa5d2irani0xH2BoPShp1NCJkvl9J39NpQ1D_dG-By6mrfVTHw1poYDMzkI0ZuNUxHP7Ma4a_2NtvSIGS0L30IMF9MQ2G5VgqwMT9myvF0SV8zH-p_10NlaDUN0V4bakZ%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJRCUzZDlOUlJKTExYTTY4ViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D95eeda16d8e919771a69bfc2b0daa31f&TIME=20240220T085235Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:AA33CD7D-B08B-86B8-A252-00B8C8367286&deviceId=6896193134260924&muid=AA33CD7DB08B86B8A25200B8C8367286

        HTTP Response

        204

        HTTP Request

        GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De80ZPKLU1i82DKS1o1D7lUKDVUCUzu36zZqu3h_M5331I5v-FFa5d2irani0xH2BoPShp1NCJkvl9J39NpQ1D_dG-By6mrfVTHw1poYDMzkI0ZuNUxHP7Ma4a_2NtvSIGS0L30IMF9MQ2G5VgqwMT9myvF0SV8zH-p_10NlaDUN0V4bakZ%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJRCUzZDlOUlJKTExYTTY4ViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D95eeda16d8e919771a69bfc2b0daa31f&TIME=20240220T085235Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:AA33CD7D-B08B-86B8-A252-00B8C8367286&deviceId=6896193134260924&muid=AA33CD7DB08B86B8A25200B8C8367286

        HTTP Response

        204
      • 88.221.83.235:443
        https://www.bing.com/aes/c.gif?type=mv&reqver=1.0&rg=97f2124e0d964846aba2f486ff0b959b&tids=15000&med=10&pubId=251978541&TIME=20240220T085235Z&adUnitId=11730597&localId=w:AA33CD7D-B08B-86B8-A252-00B8C8367286&deviceId=6896193134260924
        tls, http2
        1.4kB
        5.5kB
        16
        14

        HTTP Request

        GET https://www.bing.com/aes/c.gif?type=mv&reqver=1.0&rg=97f2124e0d964846aba2f486ff0b959b&tids=15000&med=10&pubId=251978541&TIME=20240220T085235Z&adUnitId=11730597&localId=w:AA33CD7D-B08B-86B8-A252-00B8C8367286&deviceId=6896193134260924

        HTTP Response

        200
      • 8.8.8.8:53
        23.177.190.20.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        23.177.190.20.in-addr.arpa

      • 8.8.8.8:53
        193.78.101.95.in-addr.arpa
        dns
        72 B
        137 B
        1
        1

        DNS Request

        193.78.101.95.in-addr.arpa

      • 8.8.8.8:53
        241.154.82.20.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        241.154.82.20.in-addr.arpa

      • 8.8.8.8:53
        g.bing.com
        dns
        56 B
        158 B
        1
        1

        DNS Request

        g.bing.com

        DNS Response

        204.79.197.200
        13.107.21.200

      • 8.8.8.8:53
        205.47.74.20.in-addr.arpa
        dns
        71 B
        157 B
        1
        1

        DNS Request

        205.47.74.20.in-addr.arpa

      • 8.8.8.8:53
        41.110.16.96.in-addr.arpa
        dns
        71 B
        135 B
        1
        1

        DNS Request

        41.110.16.96.in-addr.arpa

      • 8.8.8.8:53
        200.197.79.204.in-addr.arpa
        dns
        73 B
        106 B
        1
        1

        DNS Request

        200.197.79.204.in-addr.arpa

      • 8.8.8.8:53
        235.83.221.88.in-addr.arpa
        dns
        72 B
        137 B
        1
        1

        DNS Request

        235.83.221.88.in-addr.arpa

      • 8.8.8.8:53
        157.123.68.40.in-addr.arpa
        dns
        72 B
        146 B
        1
        1

        DNS Request

        157.123.68.40.in-addr.arpa

      • 8.8.8.8:53
        198.187.3.20.in-addr.arpa
        dns
        71 B
        157 B
        1
        1

        DNS Request

        198.187.3.20.in-addr.arpa

      • 8.8.8.8:53
        217.135.221.88.in-addr.arpa
        dns
        73 B
        139 B
        1
        1

        DNS Request

        217.135.221.88.in-addr.arpa

      • 8.8.8.8:53
        209.178.17.96.in-addr.arpa
        dns
        72 B
        137 B
        1
        1

        DNS Request

        209.178.17.96.in-addr.arpa

      • 8.8.8.8:53
        21.236.111.52.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        21.236.111.52.in-addr.arpa

      • 8.8.8.8:53
        88.16.208.104.in-addr.arpa
        dns
        72 B
        146 B
        1
        1

        DNS Request

        88.16.208.104.in-addr.arpa

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.