Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
22/09/2021, 14:12
210922-rh4yasfecj 10Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14/04/2024, 14:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe
Resource
win10-20240404-en
windows10-1703-x64
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe
-
Size
434KB
-
MD5
abac8b5fb6a305939c7ac38ea06666bd
-
SHA1
b42bbb582a8bbf08e865e5181dba0f67c659763e
-
SHA256
d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee
-
SHA512
287e06f2ba0a071fb4cb0a62f127cd38c47225d0808fb685773eeb132bb9d7de06a401bab7d86714785cee04b27c40e93eeae7ade2eab1f5d200188b477671da
-
SSDEEP
12288:rXPcLcbGfVylwG/ZDCK/ScBXo8TsyMkKMY8m7WOK95OTTsx/SA/WegYfdNbrqnuw:rXh6XcBXo8TsL8Y8m4OTTySA/DrfdNbS
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3964 GetX64BTIT.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 api.ipify.org 6 api.ipify.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4028 wrote to memory of 3964 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 91 PID 4028 wrote to memory of 3964 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 91 PID 4028 wrote to memory of 4792 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 78 PID 4028 wrote to memory of 3460 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 79 PID 4028 wrote to memory of 3936 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 80 PID 4028 wrote to memory of 4116 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 81 PID 4028 wrote to memory of 2760 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 82 PID 4028 wrote to memory of 912 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 84 PID 4028 wrote to memory of 4420 4028 d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe 85 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100 PID 4792 wrote to memory of 4392 4792 msedge.exe 100
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window1⤵
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff88d9a2e98,0x7ff88d9a2ea4,0x7ff88d9a2eb02⤵PID:3460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3080 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:22⤵PID:3936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3124 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:32⤵PID:4116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3096 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:82⤵PID:2760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5332 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:12⤵PID:912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=5552 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:12⤵PID:4420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3688 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:82⤵PID:4392
-
-
C:\Users\Admin\AppData\Local\Temp\d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe"C:\Users\Admin\AppData\Local\Temp\d7a6495589f3f791fe1a074c64922c17979229a79e5f0a57046254d9fd712eee.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"2⤵
- Executes dropped EXE
PID:3964
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
Filesize
28B
MD519eb4a67a8dc35e6f6cefdefa02dc756
SHA168382fa2660fcf8cd203932461d96fe8cb608d22
SHA2563501cf2bf5b5338d00bac7b4acfda42253fd1afac5b162ad37e2a278590f9a22
SHA512751ed493d6df6cc36ef3aff132b223e8096ff243538debf4944a050e10176ca7cec92f9bab658c1c6c596343ea01f64853f19330266849955bc1db345474166b