Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
14/03/2024, 06:58 UTC
Static task
static1
Behavioral task
behavioral1
Sample
c7fbd8a7e3dced63f501d3a996432aff.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
c7fbd8a7e3dced63f501d3a996432aff.exe
Resource
win10v2004-20240226-en
General
-
Target
c7fbd8a7e3dced63f501d3a996432aff.exe
-
Size
215KB
-
MD5
c7fbd8a7e3dced63f501d3a996432aff
-
SHA1
fe8aa8464abc7abad70e4c11e8a0331e690fc9cc
-
SHA256
15362396dca6de2483084f98d87a58a3b751ff924abc78322a41cadd5d0c26eb
-
SHA512
6715304fb502563990e49b68afbda21c4ba9403b2ed0346a0be8b2d21b6a4d8d0cc862e5e716fff84d1fba87b1ffc408d13500e274de0f6c327ce1ceec68e260
-
SSDEEP
3072:6RWJf6mKPJFUBew79uE/+dSNF9N5ZRVj9c3Fnm/GAC82GLKcy2hRBUWLXH:6RM6xHUBsdSRP7VjilQGI2mZTUWLX
Malware Config
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\GetInShape.job c7fbd8a7e3dced63f501d3a996432aff.exe
Processes
Network
-
Remote address:8.8.8.8:53Requestfull-set.linkIN AResponsefull-set.linkIN A45.33.18.44full-set.linkIN A72.14.178.174full-set.linkIN A45.56.79.23full-set.linkIN A45.33.23.183full-set.linkIN A173.255.194.134full-set.linkIN A45.33.20.235full-set.linkIN A45.33.30.197full-set.linkIN A198.58.118.167full-set.linkIN A45.33.2.79full-set.linkIN A72.14.185.43full-set.linkIN A96.126.123.244full-set.linkIN A45.79.19.196
-
Remote address:8.8.8.8:53Requestallmodel-pro.comIN AResponseallmodel-pro.comIN A204.11.56.48
-
GEThttp://full-set.link/?q=N5ZH6N0Am65%2FRIu2LFjPBFKaSftnBfzjXlfzdTPx%2BQBlLyvIW0fhuT%2FcpmGRMSXHT6KNPuW4kRug1cF0YQLd%2BIN7P6tlmgml4F5kF9R6JAUKUnbG2NIi2RW8EKoIQRHvgO7u1Cn44txaeCHe%2FdR01iITCJVOpmv9VN54d8dr5EymONFrVyKenOri3cwIG%2BweCLbU506wd0AUFJk24qUsJ%2F4zFYVG%2F5CWlieP%2BGepEjsFzqh5cQDpF0YfmFteRqaTb5KZ9iG7Wo1KbGMFu2GqNileCtKEc7fbd8a7e3dced63f501d3a996432aff.exeRemote address:45.33.18.44:80RequestGET /?q=N5ZH6N0Am65%2FRIu2LFjPBFKaSftnBfzjXlfzdTPx%2BQBlLyvIW0fhuT%2FcpmGRMSXHT6KNPuW4kRug1cF0YQLd%2BIN7P6tlmgml4F5kF9R6JAUKUnbG2NIi2RW8EKoIQRHvgO7u1Cn44txaeCHe%2FdR01iITCJVOpmv9VN54d8dr5EymONFrVyKenOri3cwIG%2BweCLbU506wd0AUFJk24qUsJ%2F4zFYVG%2F5CWlieP%2BGepEjsFzqh5cQDpF0YfmFteRqaTb5KZ9iG7Wo1KbGMFu2GqNileCtKE HTTP/1.1
Accept: */*
User-Agent: Python-urllib/2.7
Host: full-set.link
ResponseHTTP/1.1 200 OK
date: Thu, 14 Mar 2024 06:58:40 GMT
content-type: application/octet-stream
content-length: 108
content-type: text/html
connection: close
-
45.33.18.44:80http://full-set.link/?q=N5ZH6N0Am65%2FRIu2LFjPBFKaSftnBfzjXlfzdTPx%2BQBlLyvIW0fhuT%2FcpmGRMSXHT6KNPuW4kRug1cF0YQLd%2BIN7P6tlmgml4F5kF9R6JAUKUnbG2NIi2RW8EKoIQRHvgO7u1Cn44txaeCHe%2FdR01iITCJVOpmv9VN54d8dr5EymONFrVyKenOri3cwIG%2BweCLbU506wd0AUFJk24qUsJ%2F4zFYVG%2F5CWlieP%2BGepEjsFzqh5cQDpF0YfmFteRqaTb5KZ9iG7Wo1KbGMFu2GqNileCtKEhttpc7fbd8a7e3dced63f501d3a996432aff.exe618 B 469 B 5 4
HTTP Request
GET http://full-set.link/?q=N5ZH6N0Am65%2FRIu2LFjPBFKaSftnBfzjXlfzdTPx%2BQBlLyvIW0fhuT%2FcpmGRMSXHT6KNPuW4kRug1cF0YQLd%2BIN7P6tlmgml4F5kF9R6JAUKUnbG2NIi2RW8EKoIQRHvgO7u1Cn44txaeCHe%2FdR01iITCJVOpmv9VN54d8dr5EymONFrVyKenOri3cwIG%2BweCLbU506wd0AUFJk24qUsJ%2F4zFYVG%2F5CWlieP%2BGepEjsFzqh5cQDpF0YfmFteRqaTb5KZ9iG7Wo1KbGMFu2GqNileCtKEHTTP Response
200 -
52 B 1
-
59 B 251 B 1 1
DNS Request
full-set.link
DNS Response
45.33.18.4472.14.178.17445.56.79.2345.33.23.183173.255.194.13445.33.20.23545.33.30.197198.58.118.16745.33.2.7972.14.185.4396.126.123.24445.79.19.196
-
62 B 78 B 1 1
DNS Request
allmodel-pro.com
DNS Response
204.11.56.48