Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

Install.Sf...64.exe

windows11-21h2-x64

7

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...gs.dll

windows11-21h2-x64

3

$PLUGINSDI...ec.dll

windows11-21h2-x64

3

sfvip_all....20.dll

windows11-21h2-x64

1

sfvip_all....es.dll

windows11-21h2-x64

1

sfvip_all....ni.dll

windows11-21h2-x64

1

sfvip_all....bc.dll

windows11-21h2-x64

1

sfvip_all....fb.dll

windows11-21h2-x64

1

sfvip_all....tr.dll

windows11-21h2-x64

1

sfvip_all....cb.dll

windows11-21h2-x64

1

sfvip_all....sh.dll

windows11-21h2-x64

1

sfvip_all....cb.dll

windows11-21h2-x64

1

sfvip_all....fb.dll

windows11-21h2-x64

1

sfvip_all....2s.dll

windows11-21h2-x64

1

sfvip_all....D5.dll

windows11-21h2-x64

1

sfvip_all....A1.dll

windows11-21h2-x64

1

sfvip_all....24.dll

windows11-21h2-x64

1

sfvip_all....56.dll

windows11-21h2-x64

1

sfvip_all....84.dll

windows11-21h2-x64

1

sfvip_all....12.dll

windows11-21h2-x64

1

sfvip_all....ul.dll

windows11-21h2-x64

1

sfvip_all....le.dll

windows11-21h2-x64

1

sfvip_all....ak.dll

windows11-21h2-x64

1

sfvip_all....pt.dll

windows11-21h2-x64

1

sfvip_all...._c.dll

windows11-21h2-x64

1

sfvip_all....or.dll

windows11-21h2-x64

1

sfvip_all....ll.exe

windows11-21h2-x64

1

sfvip_all....io.dll

windows11-21h2-x64

1

sfvip_all....li.dll

windows11-21h2-x64

1

sfvip_all....z2.dll

windows11-21h2-x64

1

sfvip_all....it.vbs

windows11-21h2-x64

1

Resubmissions

06/03/2024, 18:08 UTC

240306-wrcydsef75 7

06/03/2024, 18:04 UTC

240306-wnjxjafd4y 7

Analysis

  • max time kernel
    1485s
  • max time network
    1496s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    06/03/2024, 18:04 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    sfvip_all.dist/Cryptodome/Hash/_SHA512.dll

  • Size

    26KB

  • MD5

    f028511cd5f2f925fd5a979152466cb4

  • SHA1

    38b8b44089b390e1f3aa952c950bdbe2cb69fba5

  • SHA256

    0fb591416cc9520c6d9c398e1edf4b7da412f80114f80628f84e9d4d37a64f69

  • SHA512

    97c06a4dcee7f05268d0a47f88424e28b063807ffbd94dabdcc3bf773ad933a549934916eb7339506624e97829aa5dc13321ade31d528e8424ffdcf8c8407d4f

  • SSDEEP

    384:LFYLXRqEnMgj969GUnLa+1WT1aA7qHofg5JptfIS320DXCElrgjhig:5YLB9Mgj0e+1WT1aAeIfMzx320DXR+j

Score
1/10

Malware Config

Signatures

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\sfvip_all.dist\Cryptodome\Hash\_SHA512.dll,#1
    1⤵
      PID:2020

    Network

    • flag-us
      DNS
      14.179.17.96.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      14.179.17.96.in-addr.arpa
      IN PTR
      Response
      14.179.17.96.in-addr.arpa
      IN PTR
      a96-17-179-14deploystaticakamaitechnologiescom
    • flag-us
      DNS
      19.134.221.88.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      19.134.221.88.in-addr.arpa
      IN PTR
      Response
      19.134.221.88.in-addr.arpa
      IN PTR
      a88-221-134-19deploystaticakamaitechnologiescom
    • flag-us
      DNS
      login.live.com
      Remote address:
      8.8.8.8:53
      Request
      login.live.com
      IN A
      Response
      login.live.com
      IN CNAME
      login.msa.msidentity.com
      login.msa.msidentity.com
      IN CNAME
      www.tm.lg.prod.aadmsa.akadns.net
      www.tm.lg.prod.aadmsa.akadns.net
      IN CNAME
      prdv4a.aadg.msidentity.com
      prdv4a.aadg.msidentity.com
      IN CNAME
      www.tm.v4.a.prd.aadg.akadns.net
      www.tm.v4.a.prd.aadg.akadns.net
      IN A
      40.126.53.19
      www.tm.v4.a.prd.aadg.akadns.net
      IN A
      20.190.181.0
      www.tm.v4.a.prd.aadg.akadns.net
      IN A
      20.190.181.2
      www.tm.v4.a.prd.aadg.akadns.net
      IN A
      20.190.181.4
      www.tm.v4.a.prd.aadg.akadns.net
      IN A
      20.190.181.5
      www.tm.v4.a.prd.aadg.akadns.net
      IN A
      40.126.53.18
      www.tm.v4.a.prd.aadg.akadns.net
      IN A
      20.190.181.1
      www.tm.v4.a.prd.aadg.akadns.net
      IN A
      20.190.181.3
    • flag-us
      DNS
      arc.msn.com
      Remote address:
      8.8.8.8:53
      Request
      arc.msn.com
      IN A
      Response
      arc.msn.com
      IN CNAME
      arc.trafficmanager.net
      arc.trafficmanager.net
      IN CNAME
      iris-de-prod-azsc-v2-weu-b.westeurope.cloudapp.azure.com
      iris-de-prod-azsc-v2-weu-b.westeurope.cloudapp.azure.com
      IN A
      20.31.169.57
    • flag-us
      DNS
      19.53.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      19.53.126.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      57.169.31.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      57.169.31.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      arc.msn.com
      Remote address:
      8.8.8.8:53
      Request
      arc.msn.com
      IN A
      Response
      arc.msn.com
      IN CNAME
      arc.trafficmanager.net
      arc.trafficmanager.net
      IN CNAME
      iris-de-prod-azsc-v2-frc.francecentral.cloudapp.azure.com
      iris-de-prod-azsc-v2-frc.francecentral.cloudapp.azure.com
      IN A
      20.199.58.43
    • flag-us
      DNS
      ris.api.iris.microsoft.com
      Remote address:
      8.8.8.8:53
      Request
      ris.api.iris.microsoft.com
      IN A
      Response
      ris.api.iris.microsoft.com
      IN CNAME
      ris-prod.trafficmanager.net
      ris-prod.trafficmanager.net
      IN CNAME
      asf-ris-prod-neu-azsc.northeurope.cloudapp.azure.com
      asf-ris-prod-neu-azsc.northeurope.cloudapp.azure.com
      IN A
      20.234.120.54
    • flag-us
      DNS
      ris.api.iris.microsoft.com
      Remote address:
      8.8.8.8:53
      Request
      ris.api.iris.microsoft.com
      IN A
    • flag-us
      DNS
      tse1.mm.bing.net
      Remote address:
      8.8.8.8:53
      Request
      tse1.mm.bing.net
      IN A
      Response
      tse1.mm.bing.net
      IN CNAME
      mm-mm.bing.net.trafficmanager.net
      mm-mm.bing.net.trafficmanager.net
      IN CNAME
      dual-a-0001.a-msedge.net
      dual-a-0001.a-msedge.net
      IN A
      204.79.197.200
      dual-a-0001.a-msedge.net
      IN A
      13.107.21.200
    • flag-us
      DNS
      43.58.199.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      43.58.199.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      54.120.234.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      54.120.234.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      200.197.79.204.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      200.197.79.204.in-addr.arpa
      IN PTR
      Response
      200.197.79.204.in-addr.arpa
      IN PTR
      a-0001a-msedgenet
    • flag-us
      DNS
      arc.msn.com
      Remote address:
      8.8.8.8:53
      Request
      arc.msn.com
      IN A
      Response
      arc.msn.com
      IN CNAME
      arc.trafficmanager.net
      arc.trafficmanager.net
      IN CNAME
      iris-de-prod-azsc-v2-neu.northeurope.cloudapp.azure.com
      iris-de-prod-azsc-v2-neu.northeurope.cloudapp.azure.com
      IN A
      20.223.35.26
    • flag-us
      DNS
      ris.api.iris.microsoft.com
      Remote address:
      8.8.8.8:53
      Request
      ris.api.iris.microsoft.com
      IN A
      Response
      ris.api.iris.microsoft.com
      IN CNAME
      ris-prod.trafficmanager.net
      ris-prod.trafficmanager.net
      IN CNAME
      asf-ris-prod-neu-azsc.northeurope.cloudapp.azure.com
      asf-ris-prod-neu-azsc.northeurope.cloudapp.azure.com
      IN A
      20.234.120.54
    • flag-us
      DNS
      26.35.223.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      26.35.223.20.in-addr.arpa
      IN PTR
      Response
    • 204.79.197.200:443
      tse1.mm.bing.net
      tls
      2.7kB
       8.5kB
       21
      17
    • 204.79.197.200:443
      tse1.mm.bing.net
      tls
      2.6kB
       891 B
       16
      10
    • 204.79.197.200:443
      tse1.mm.bing.net
      tls
      2.9kB
       8.5kB
       22
      16
    • 204.79.197.200:443
      tse1.mm.bing.net
      tls
      2.9kB
       8.5kB
       22
      16
    • 204.79.197.200:443
      tse1.mm.bing.net
      tls
      77.9kB
       2.1MB
       1512
      1506
    • 8.8.8.8:53
      14.179.17.96.in-addr.arpa
      dns
      603 B
       1.5kB
       9
      8

      DNS Request

      14.179.17.96.in-addr.arpa

      DNS Request

      19.134.221.88.in-addr.arpa

      DNS Request

      login.live.com

      DNS Response

      40.126.53.19
      20.190.181.0
      20.190.181.2
      20.190.181.4
      20.190.181.5
      40.126.53.18
      20.190.181.1
      20.190.181.3

      DNS Request

      arc.msn.com

      DNS Response

      20.31.169.57

      DNS Request

      19.53.126.40.in-addr.arpa

      DNS Request

      57.169.31.20.in-addr.arpa

      DNS Request

      arc.msn.com

      DNS Response

      20.199.58.43

      DNS Request

      ris.api.iris.microsoft.com

      DNS Request

      ris.api.iris.microsoft.com

      DNS Response

      20.234.120.54

    • 8.8.8.8:53
      tse1.mm.bing.net
      dns
      478 B
       1.1kB
       7
      7

      DNS Request

      tse1.mm.bing.net

      DNS Response

      204.79.197.200
      13.107.21.200

      DNS Request

      43.58.199.20.in-addr.arpa

      DNS Request

      54.120.234.20.in-addr.arpa

      DNS Request

      200.197.79.204.in-addr.arpa

      DNS Request

      arc.msn.com

      DNS Response

      20.223.35.26

      DNS Request

      ris.api.iris.microsoft.com

      DNS Response

      20.234.120.54

      DNS Request

      26.35.223.20.in-addr.arpa

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.