Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

7

a075393594...fd.exe

windows7-x64

3

a075393594...fd.exe

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$TEMP/AnVir.exe

windows7-x64

3

$TEMP/AnVir.exe

windows10-2004-x64

3

AnVir.exe

windows7-x64

3

AnVir.exe

windows10-2004-x64

3

AnvirHook65.dll

windows7-x64

1

AnvirHook65.dll

windows10-2004-x64

1

CoreTemp.exe

windows7-x64

1

CoreTemp.exe

windows10-2004-x64

1

CoreTemp64.exe

windows7-x64

1

CoreTemp64.exe

windows10-2004-x64

1

ROIntegration.dll

windows7-x64

1

ROIntegration.dll

windows10-2004-x64

1

VirusTotalUpload.exe

windows7-x64

1

VirusTotalUpload.exe

windows10-2004-x64

1

reg-organi...up.exe

windows7-x64

7

reg-organi...up.exe

windows10-2004-x64

7

tweaker.exe

windows7-x64

7

tweaker.exe

windows10-2004-x64

7

usbhdd.exe

windows7-x64

7

usbhdd.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/02/2024, 22:07 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    AnVir.exe

  • Size

    5.8MB

  • MD5

    3ce8da2131fc96c8c0cd6df7912b7e0b

  • SHA1

    fbec5803a4f4a5bed388ff690188f7ff390da95f

  • SHA256

    ed69abf519d588d32b4ce8563b42ffaaa9011f694d7c39c70de2271beb2ed90f

  • SHA512

    1a07cb5f4bd6106428bfc2335d6bd67a7a6ad72a12fef840646cdc410544554f809e2113edde806193a5b5f2f39af363816d353dc541451cd8a964ceef09a3d3

  • SSDEEP

    98304:/zTbq7FAtKFVkepYbRM2qAKziinEvYzkAhfZllc1Cnk5dYLyCfIX:7TUA8VXYtMxAKziXYzkAc

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AnVir.exe
    "C:\Users\Admin\AppData\Local\Temp\AnVir.exe"
    1⤵
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:5016

Network

  • flag-us
    DNS
    23.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    23.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    202.178.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    202.178.17.96.in-addr.arpa
    IN PTR
    Response
    202.178.17.96.in-addr.arpa
    IN PTR
    a96-17-178-202deploystaticakamaitechnologiescom
  • flag-us
    DNS
    241.154.82.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.154.82.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
    Response
    g.bing.com
    IN CNAME
    g-bing-com.a-0001.a-msedge.net
    g-bing-com.a-0001.a-msedge.net
    IN CNAME
    dual-a-0001.a-msedge.net
    dual-a-0001.a-msedge.net
    IN A
    204.79.197.200
    dual-a-0001.a-msedge.net
    IN A
    13.107.21.200
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=08efb5d9e3474cbaa59f23ab4d89535d&localId=w:DE85FF22-0C12-E266-9673-0EBC171C1C82&deviceId=6825825694848287&anid=
    Remote address:
    204.79.197.200:443
    Request
    GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=08efb5d9e3474cbaa59f23ab4d89535d&localId=w:DE85FF22-0C12-E266-9673-0EBC171C1C82&deviceId=6825825694848287&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MUID=379FFFB8E9396D2C25ECEB96E8D96CDD; domain=.bing.com; expires=Wed, 19-Mar-2025 22:07:43 GMT; path=/; SameSite=None; Secure; Priority=High;
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: E1499A5AEC064A49805D531D6A99E9EF Ref B: LON04EDGE1205 Ref C: 2024-02-23T22:07:43Z
    date: Fri, 23 Feb 2024 22:07:43 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=08efb5d9e3474cbaa59f23ab4d89535d&localId=w:DE85FF22-0C12-E266-9673-0EBC171C1C82&deviceId=6825825694848287&anid=
    Remote address:
    204.79.197.200:443
    Request
    GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=08efb5d9e3474cbaa59f23ab4d89535d&localId=w:DE85FF22-0C12-E266-9673-0EBC171C1C82&deviceId=6825825694848287&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=379FFFB8E9396D2C25ECEB96E8D96CDD
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MSPTC=xTCXETWqtjXVhcfZZWZ3aIzixmbGRowjFV5wFtn5byQ; domain=.bing.com; expires=Wed, 19-Mar-2025 22:07:43 GMT; path=/; Partitioned; secure; SameSite=None
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 82CD29265A7747F79260006CA2E6C95D Ref B: LON04EDGE1205 Ref C: 2024-02-23T22:07:43Z
    date: Fri, 23 Feb 2024 22:07:43 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=08efb5d9e3474cbaa59f23ab4d89535d&localId=w:DE85FF22-0C12-E266-9673-0EBC171C1C82&deviceId=6825825694848287&anid=
    Remote address:
    204.79.197.200:443
    Request
    GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=08efb5d9e3474cbaa59f23ab4d89535d&localId=w:DE85FF22-0C12-E266-9673-0EBC171C1C82&deviceId=6825825694848287&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=379FFFB8E9396D2C25ECEB96E8D96CDD; MSPTC=xTCXETWqtjXVhcfZZWZ3aIzixmbGRowjFV5wFtn5byQ
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 557563E446A64A5D85C0960043F82BB9 Ref B: LON04EDGE1205 Ref C: 2024-02-23T22:07:43Z
    date: Fri, 23 Feb 2024 22:07:43 GMT
  • flag-us
    DNS
    88.156.103.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.156.103.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    41.110.16.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    41.110.16.96.in-addr.arpa
    IN PTR
    Response
    41.110.16.96.in-addr.arpa
    IN PTR
    a96-16-110-41deploystaticakamaitechnologiescom
  • flag-us
    DNS
    200.197.79.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.197.79.204.in-addr.arpa
    IN PTR
    Response
    200.197.79.204.in-addr.arpa
    IN PTR
    a-0001a-msedgenet
  • flag-us
    DNS
    www.anvir.com
    AnVir.exe
    Remote address:
    8.8.8.8:53
    Request
    www.anvir.com
    IN A
    Response
    www.anvir.com
    IN A
    185.221.152.14
  • flag-ru
    GET
    http://www.anvir.com/version.dat
    AnVir.exe
    Remote address:
    185.221.152.14:80
    Request
    GET /version.dat HTTP/1.1
    Accept: */*
    Content-Type: application/x-www-form-urlencoded
    User-Agent: AnVir Task Manager, 6.5.0
    Host: www.anvir.com
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Fri, 23 Feb 2024 22:07:49 GMT
    Content-Type: application/octet-stream
    Content-Length: 19
    Last-Modified: Fri, 06 Aug 2021 05:36:33 GMT
    Connection: keep-alive
    ETag: "610cca61-13"
    Expires: Sat, 24 Feb 2024 22:07:49 GMT
    Cache-Control: max-age=86400
    Accept-Ranges: bytes
  • flag-us
    DNS
    14.152.221.185.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    14.152.221.185.in-addr.arpa
    IN PTR
    Response
    14.152.221.185.in-addr.arpa
    IN PTR
    anvircom
  • flag-us
    DNS
    50.23.12.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    50.23.12.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    198.187.3.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    198.187.3.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    28.160.77.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    28.160.77.104.in-addr.arpa
    IN PTR
    Response
    28.160.77.104.in-addr.arpa
    IN PTR
    a104-77-160-28deploystaticakamaitechnologiescom
  • flag-us
    DNS
    204.178.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    204.178.17.96.in-addr.arpa
    IN PTR
    Response
    204.178.17.96.in-addr.arpa
    IN PTR
    a96-17-178-204deploystaticakamaitechnologiescom
  • flag-us
    DNS
    204.178.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    204.178.17.96.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    19.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    19.229.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    207.178.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    207.178.17.96.in-addr.arpa
    IN PTR
    Response
    207.178.17.96.in-addr.arpa
    IN PTR
    a96-17-178-207deploystaticakamaitechnologiescom
  • flag-us
    DNS
    105.246.116.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    105.246.116.51.in-addr.arpa
    IN PTR
    Response
  • 204.79.197.200:443
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=08efb5d9e3474cbaa59f23ab4d89535d&localId=w:DE85FF22-0C12-E266-9673-0EBC171C1C82&deviceId=6825825694848287&anid=
    tls, http2
    2.0kB
     9.2kB
     21
    18

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=08efb5d9e3474cbaa59f23ab4d89535d&localId=w:DE85FF22-0C12-E266-9673-0EBC171C1C82&deviceId=6825825694848287&anid=

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=08efb5d9e3474cbaa59f23ab4d89535d&localId=w:DE85FF22-0C12-E266-9673-0EBC171C1C82&deviceId=6825825694848287&anid=

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=08efb5d9e3474cbaa59f23ab4d89535d&localId=w:DE85FF22-0C12-E266-9673-0EBC171C1C82&deviceId=6825825694848287&anid=

    HTTP Response

    204
  • 185.221.152.14:80
    http://www.anvir.com/version.dat
    http
    AnVir.exe
    528 B
     545 B
     7
    5

    HTTP Request

    GET http://www.anvir.com/version.dat

    HTTP Response

    200
  • 8.8.8.8:53
    23.159.190.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    23.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    202.178.17.96.in-addr.arpa
    dns
    72 B
     137 B
     1
    1

    DNS Request

    202.178.17.96.in-addr.arpa

  • 8.8.8.8:53
    241.154.82.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    241.154.82.20.in-addr.arpa

  • 8.8.8.8:53
    g.bing.com
    dns
    56 B
     158 B
     1
    1

    DNS Request

    g.bing.com

    DNS Response

    204.79.197.200
    13.107.21.200

  • 8.8.8.8:53
    88.156.103.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    88.156.103.20.in-addr.arpa

  • 8.8.8.8:53
    41.110.16.96.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    41.110.16.96.in-addr.arpa

  • 8.8.8.8:53
    200.197.79.204.in-addr.arpa
    dns
    73 B
     106 B
     1
    1

    DNS Request

    200.197.79.204.in-addr.arpa

  • 8.8.8.8:53
    www.anvir.com
    dns
    AnVir.exe
    59 B
     75 B
     1
    1

    DNS Request

    www.anvir.com

    DNS Response

    185.221.152.14

  • 8.8.8.8:53
    14.152.221.185.in-addr.arpa
    dns
    73 B
     96 B
     1
    1

    DNS Request

    14.152.221.185.in-addr.arpa

  • 8.8.8.8:53
    50.23.12.20.in-addr.arpa
    dns
    70 B
     156 B
     1
    1

    DNS Request

    50.23.12.20.in-addr.arpa

  • 8.8.8.8:53
    198.187.3.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    198.187.3.20.in-addr.arpa

  • 8.8.8.8:53
    28.160.77.104.in-addr.arpa
    dns
    72 B
     137 B
     1
    1

    DNS Request

    28.160.77.104.in-addr.arpa

  • 8.8.8.8:53
    204.178.17.96.in-addr.arpa
    dns
    144 B
     137 B
     2
    1

    DNS Request

    204.178.17.96.in-addr.arpa

    DNS Request

    204.178.17.96.in-addr.arpa

  • 8.8.8.8:53
    19.229.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    19.229.111.52.in-addr.arpa

  • 8.8.8.8:53
    207.178.17.96.in-addr.arpa
    dns
    72 B
     137 B
     1
    1

    DNS Request

    207.178.17.96.in-addr.arpa

  • 8.8.8.8:53
    105.246.116.51.in-addr.arpa
    dns
    73 B
     159 B
     1
    1

    DNS Request

    105.246.116.51.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/5016-0-0x00000000027E0000-0x00000000027E1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/5016-6-0x00000000027E0000-0x00000000027E1000-memory.dmp

    Filesize

    4KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.