Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

3

Static

static

3

bc5e122ddf...2f.exe

windows7-x64

1

bc5e122ddf...2f.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    09/03/2024, 17:17 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bc5e122ddfdceb0d4bf4363b5880552f.exe

  • Size

    192KB

  • MD5

    bc5e122ddfdceb0d4bf4363b5880552f

  • SHA1

    6aeb31eeba0039bc6756916a8901f4e972761f06

  • SHA256

    ef8405b88881c0d5ef6ee3905c1b87671218d8261292944b1da5a3c9e7d198ce

  • SHA512

    c7402a9d70c5c26a3f85710f3eb248569aa721ee330a4a50f60f6da8b9a3272111523c61d614a50bbd99f24038059a3a251833470e97946664848419f044a88e

  • SSDEEP

    3072:12ODtQIWo9QFrQZEW6qn3huAQBY/kfXrHVas/8/6wlZ5SRISHFErw:MODaO+F1gUAEBXTlJwlr

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bc5e122ddfdceb0d4bf4363b5880552f.exe
    "C:\Users\Admin\AppData\Local\Temp\bc5e122ddfdceb0d4bf4363b5880552f.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2396

Network

  • flag-us
    DNS
    one-wedding-film.xyz
    bc5e122ddfdceb0d4bf4363b5880552f.exe
    Remote address:
    8.8.8.8:53
    Request
    one-wedding-film.xyz
    IN A
    Response
  • flag-us
    DNS
    getonlinewoostudio.xyz
    bc5e122ddfdceb0d4bf4363b5880552f.exe
    Remote address:
    8.8.8.8:53
    Request
    getonlinewoostudio.xyz
    IN A
    Response
  • flag-us
    DNS
    w0rkinginstanc3.xyz
    bc5e122ddfdceb0d4bf4363b5880552f.exe
    Remote address:
    8.8.8.8:53
    Request
    w0rkinginstanc3.xyz
    IN A
    Response
  • flag-us
    DNS
    2no.co
    bc5e122ddfdceb0d4bf4363b5880552f.exe
    Remote address:
    8.8.8.8:53
    Request
    2no.co
    IN A
    Response
    2no.co
    IN A
    172.67.149.76
    2no.co
    IN A
    104.21.79.229
  • flag-us
    GET
    https://2no.co/1WTBy7
    bc5e122ddfdceb0d4bf4363b5880552f.exe
    Remote address:
    172.67.149.76:443
    Request
    GET /1WTBy7 HTTP/1.1
    User-Agent: s822
    Host: 2no.co
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Sat, 09 Mar 2024 17:17:32 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    X-Frame-Options: SAMEORIGIN
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pvEgISCmevCDn1z8ev9jT%2Be3i5W1HfSM9upJiV7b7olIvUpXHDklclW364QhXLNOKRkaiT41im0AJ6dcOGD8fkf25tk969NmW8V%2BETBsjseKdgmEY7qWdSw%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 861cb8191b5d52b4-LHR
  • flag-us
    GET
    https://2no.co/1WYBy7
    bc5e122ddfdceb0d4bf4363b5880552f.exe
    Remote address:
    172.67.149.76:443
    Request
    GET /1WYBy7 HTTP/1.1
    Host: 2no.co
    Response
    HTTP/1.1 200 OK
    Date: Sat, 09 Mar 2024 17:17:33 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    memory: 0.4251251220703125
    expires: Sat, 09 Mar 2024 17:17:33 +0000
    strict-transport-security: max-age=604800
    strict-transport-security: max-age=31536000
    content-security-policy: img-src https: data:; upgrade-insecure-requests
    x-frame-options: SAMEORIGIN
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xneNpNQ82NKcq4oeFdTzlHQ%2BeP8JnVnZ2ZxnhYGxoHcQOxVM6XX%2FzX0tAHOmW5qL%2FSKZjW03UIX2eWRfDRFMy4jn5UosEor648LdFWZkB1llmXAhKnkT9uM%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 861cb81a5bc3368f-LHR
    alt-svc: h3=":443"; ma=86400
  • 172.67.149.76:443
    https://2no.co/1WTBy7
    tls, http
    bc5e122ddfdceb0d4bf4363b5880552f.exe
    999 B
     12.3kB
     14
    16

    HTTP Request

    GET https://2no.co/1WTBy7

    HTTP Response

    200
  • 172.67.149.76:443
    https://2no.co/1WYBy7
    tls, http
    bc5e122ddfdceb0d4bf4363b5880552f.exe
    931 B
     14.3kB
     13
    18

    HTTP Request

    GET https://2no.co/1WYBy7

    HTTP Response

    200
  • 8.8.8.8:53
    one-wedding-film.xyz
    dns
    bc5e122ddfdceb0d4bf4363b5880552f.exe
    66 B
     131 B
     1
    1

    DNS Request

    one-wedding-film.xyz

  • 8.8.8.8:53
    getonlinewoostudio.xyz
    dns
    bc5e122ddfdceb0d4bf4363b5880552f.exe
    68 B
     133 B
     1
    1

    DNS Request

    getonlinewoostudio.xyz

  • 8.8.8.8:53
    w0rkinginstanc3.xyz
    dns
    bc5e122ddfdceb0d4bf4363b5880552f.exe
    65 B
     130 B
     1
    1

    DNS Request

    w0rkinginstanc3.xyz

  • 8.8.8.8:53
    2no.co
    dns
    bc5e122ddfdceb0d4bf4363b5880552f.exe
    52 B
     84 B
     1
    1

    DNS Request

    2no.co

    DNS Response

    172.67.149.76
    104.21.79.229

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2396-0-0x00000000003E0000-0x0000000000416000-memory.dmp

    Filesize

    216KB

    Download

  • memory/2396-2-0x000007FEF5AB0000-0x000007FEF649C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2396-1-0x00000000003D0000-0x00000000003D6000-memory.dmp

    Filesize

    24KB

    Download

  • memory/2396-3-0x000000001ACE0000-0x000000001AD60000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2396-4-0x0000000000420000-0x0000000000444000-memory.dmp

    Filesize

    144KB

    Download

  • memory/2396-5-0x0000000000440000-0x0000000000446000-memory.dmp

    Filesize

    24KB

    Download

  • memory/2396-6-0x000007FEF5AB0000-0x000007FEF649C000-memory.dmp

    Filesize

    9.9MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.