Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    87s
  • max time network
    101s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    08/04/2024, 23:10 UTC

General

  • Target

    b2218ce5a194feef051bfc1c2b9ca676a45de719a92ff760e8ab707ddadf25f7.exe

  • Size

    266KB

  • MD5

    6959523ea0b10e21643ce2501ca71e5f

  • SHA1

    4800834e4b9f18c77fb4aa2be523b3b4f74ea399

  • SHA256

    b2218ce5a194feef051bfc1c2b9ca676a45de719a92ff760e8ab707ddadf25f7

  • SHA512

    e9910365523bb0cbd1cd6957e97238783de4e56083967293fee792aed18289fc4952a4a0e4c8c0dc21bd234a4fefb799b8995ce62a118224d4b32c1ae3fcd485

  • SSDEEP

    3072:/NXEGZJWhfNFC4S60+XoLczrVmXspu2aOZrCQ8IVirmBtJjcWTwiNH01ne4PK:FXzKdNY49u8rV3hriGtJjcWjV01net

Score
7/10
upx

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b2218ce5a194feef051bfc1c2b9ca676a45de719a92ff760e8ab707ddadf25f7.exe
    "C:\Users\Admin\AppData\Local\Temp\b2218ce5a194feef051bfc1c2b9ca676a45de719a92ff760e8ab707ddadf25f7.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2644
    • C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe
      "C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe"
      2⤵
      • Executes dropped EXE
      PID:876
    • C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe
      "C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe"
      2⤵
      • Executes dropped EXE
      PID:1480

Network

  • flag-us
    DNS
    www.programworkshop.com
    b2218ce5a194feef051bfc1c2b9ca676a45de719a92ff760e8ab707ddadf25f7.exe
    Remote address:
    8.8.8.8:53
    Request
    www.programworkshop.com
    IN A
    Response
    www.programworkshop.com
    IN A
    161.47.163.214
  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    b2218ce5a194feef051bfc1c2b9ca676a45de719a92ff760e8ab707ddadf25f7.exe
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    214.163.47.161.in-addr.arpa
    b2218ce5a194feef051bfc1c2b9ca676a45de719a92ff760e8ab707ddadf25f7.exe
    Remote address:
    8.8.8.8:53
    Request
    214.163.47.161.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    nexusrules.officeapps.live.com
    b2218ce5a194feef051bfc1c2b9ca676a45de719a92ff760e8ab707ddadf25f7.exe
    Remote address:
    8.8.8.8:53
    Request
    nexusrules.officeapps.live.com
    IN A
    Response
    nexusrules.officeapps.live.com
    IN CNAME
    prod.nexusrules.live.com.akadns.net
    prod.nexusrules.live.com.akadns.net
    IN A
    52.111.229.48
  • flag-us
    DNS
    48.229.111.52.in-addr.arpa
    b2218ce5a194feef051bfc1c2b9ca676a45de719a92ff760e8ab707ddadf25f7.exe
    Remote address:
    8.8.8.8:53
    Request
    48.229.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    GET
    http://www.programworkshop.com/sbrowser/ws/getconfiguration.aspx?agentidentifier=wincsecb&programid=264&environment=production&starturl=ahr0chm6ly9ldgvzdhnvbmxpbmuub3jnl2h0bww1lymvvgvzdexvz2lul0xvz2lulya=&shortcut=0&cmd=download&sc=0cd898db665ede681f83200836a09aa8593fc92a/
    b2218ce5a194feef051bfc1c2b9ca676a45de719a92ff760e8ab707ddadf25f7.exe
    Remote address:
    161.47.163.214:80
    Request
    GET /sbrowser/ws/getconfiguration.aspx?agentidentifier=wincsecb&programid=264&environment=production&starturl=ahr0chm6ly9ldgvzdhnvbmxpbmuub3jnl2h0bww1lymvvgvzdexvz2lul0xvz2lulya=&shortcut=0&cmd=download&sc=0cd898db665ede681f83200836a09aa8593fc92a/ HTTP/1.1
    User-Agent: /DownloadSecureBrowser
    Host: www.programworkshop.com
    Response
    HTTP/1.1 403 Url not valid
    Cache-Control: private
    Content-Type: text/html
    From: ILP01
    p3p: CP="ALL DSP COR CURa ADMo DEVa TAIa CONi OUR DELa STP BUS PHY ONL UNI PUR COM NAV DEM STA"
    Date: Mon, 08 Apr 2024 23:10:48 GMT
    Content-Length: 1233
  • 161.47.163.214:80
    http://www.programworkshop.com/sbrowser/ws/getconfiguration.aspx?agentidentifier=wincsecb&programid=264&environment=production&starturl=ahr0chm6ly9ldgvzdhnvbmxpbmuub3jnl2h0bww1lymvvgvzdexvz2lul0xvz2lulya=&shortcut=0&cmd=download&sc=0cd898db665ede681f83200836a09aa8593fc92a/
    http
    b2218ce5a194feef051bfc1c2b9ca676a45de719a92ff760e8ab707ddadf25f7.exe
    1.0kB
    1.7kB
    8
    5

    HTTP Request

    GET http://www.programworkshop.com/sbrowser/ws/getconfiguration.aspx?agentidentifier=wincsecb&programid=264&environment=production&starturl=ahr0chm6ly9ldgvzdhnvbmxpbmuub3jnl2h0bww1lymvvgvzdexvz2lul0xvz2lulya=&shortcut=0&cmd=download&sc=0cd898db665ede681f83200836a09aa8593fc92a/

    HTTP Response

    403
  • 8.8.8.8:53
    www.programworkshop.com
    dns
    b2218ce5a194feef051bfc1c2b9ca676a45de719a92ff760e8ab707ddadf25f7.exe
    356 B
    610 B
    5
    5

    DNS Request

    www.programworkshop.com

    DNS Response

    161.47.163.214

    DNS Request

    8.8.8.8.in-addr.arpa

    DNS Request

    214.163.47.161.in-addr.arpa

    DNS Request

    nexusrules.officeapps.live.com

    DNS Response

    52.111.229.48

    DNS Request

    48.229.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe

    Filesize

    87KB

    MD5

    368332fca74f48697d842c5f4698ae1d

    SHA1

    0275153a1e62bd0eca0b02168895517ed66aac56

    SHA256

    3a4a5b128c3a042010824fd33b719466b0d9320aa051ca3d5f1690124766ad59

    SHA512

    fd9f1d1a4337e00fef5e9ea10a7fdf553e98df2cf2fdf818b68689a89de3c1d324de389e0c9ef863fef08a3dff8150db173b2203e9e92efaea67865e8d2805b5

  • memory/2644-0-0x00000000008E0000-0x0000000000980000-memory.dmp

    Filesize

    640KB

  • memory/2644-14-0x00000000008E0000-0x0000000000980000-memory.dmp

    Filesize

    640KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.