Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

Release.zip

windows11-21h2-x64

6

plugins/Chat.dll

windows11-21h2-x64

1

plugins/Fi...er.dll

windows11-21h2-x64

1

plugins/Fun.dll

windows11-21h2-x64

1

plugins/Hvnc.dll

windows11-21h2-x64

1

plugins/InfoGrab.dll

windows11-21h2-x64

1

plugins/KeyLogger.dll

windows11-21h2-x64

1

plugins/Ke...ne.dll

windows11-21h2-x64

1

plugins/Li...ne.dll

windows11-21h2-x64

1

plugins/Pr...er.dll

windows11-21h2-x64

1

plugins/Re...er.dll

windows11-21h2-x64

1

plugins/Re...xy.dll

windows11-21h2-x64

1

plugins/Sc...ol.dll

windows11-21h2-x64

1

plugins/Shell.dll

windows11-21h2-x64

1

plugins/Startup.dll

windows11-21h2-x64

1

plugins/Sy...er.dll

windows11-21h2-x64

1

plugins/Uacbypass.dll

windows11-21h2-x64

1

plugins/WebCam.dll

windows11-21h2-x64

1

stub/xeno ...nt.exe

windows11-21h2-x64

10

xeno rat server.exe

windows11-21h2-x64

1

Analysis

  • max time kernel
    149s
  • max time network
    282s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240412-en
  • resource tags

    arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    15/04/2024, 14:12 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    plugins/LiveMicrophone.dll

  • Size

    494KB

  • MD5

    afb916213f3419be21a061b782793c6e

  • SHA1

    6625e390d96820483db6fc9efba739456a0f2fe1

  • SHA256

    77a9318b937fbc733f5a53c12ce1cbc57aa49504840da6e33f34a1750879a8f5

  • SHA512

    253ca98f2a6b351f2a28f38a18a34ecb7583dee5895fac871cdc0f08dce51a04fec9e684d0a459b147ae6588c67c7c841b6bb32f510c529ddcc3460e45ab9d98

  • SSDEEP

    6144:S7E2hItIqKU1zPf7sQwd4h4dY2S/rfWTEFB44PjrKkpArI9ZQf9yZ86DyXLmqwH5:SjHUlxd2STf44PjrKWYmVn6D0

Score
1/10

Malware Config

Signatures

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\plugins\LiveMicrophone.dll,#1
    1⤵
      PID:2852

    Network

    • flag-us
      DNS
      91.90.14.23.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      91.90.14.23.in-addr.arpa
      IN PTR
      Response
      91.90.14.23.in-addr.arpa
      IN PTR
      a23-14-90-91deploystaticakamaitechnologiescom
    • flag-us
      DNS
      ris.api.iris.microsoft.com
      Remote address:
      8.8.8.8:53
      Request
      ris.api.iris.microsoft.com
      IN A
      Response
      ris.api.iris.microsoft.com
      IN CNAME
      ris-prod.trafficmanager.net
      ris-prod.trafficmanager.net
      IN CNAME
      asf-ris-prod-neu-azsc.northeurope.cloudapp.azure.com
      asf-ris-prod-neu-azsc.northeurope.cloudapp.azure.com
      IN A
      20.234.120.54
    • flag-us
      DNS
      88.156.103.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      88.156.103.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      arc.msn.com
      Remote address:
      8.8.8.8:53
      Request
      arc.msn.com
      IN A
      Response
      arc.msn.com
      IN CNAME
      arc.trafficmanager.net
      arc.trafficmanager.net
      IN CNAME
      iris-de-prod-azsc-v2-weu-b.westeurope.cloudapp.azure.com
      iris-de-prod-azsc-v2-weu-b.westeurope.cloudapp.azure.com
      IN A
      20.31.169.57
    • flag-us
      DNS
      nexusrules.officeapps.live.com
      Remote address:
      8.8.8.8:53
      Request
      nexusrules.officeapps.live.com
      IN A
      Response
      nexusrules.officeapps.live.com
      IN CNAME
      prod.nexusrules.live.com.akadns.net
      prod.nexusrules.live.com.akadns.net
      IN A
      52.111.227.14
    • flag-us
      DNS
      self.events.data.microsoft.com
      Remote address:
      8.8.8.8:53
      Request
      self.events.data.microsoft.com
      IN A
      Response
      self.events.data.microsoft.com
      IN CNAME
      self-events-data.trafficmanager.net
      self-events-data.trafficmanager.net
      IN CNAME
      onedscolprdneu00.northeurope.cloudapp.azure.com
      onedscolprdneu00.northeurope.cloudapp.azure.com
      IN A
      13.69.239.72
    • flag-us
      DNS
      43.58.199.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      43.58.199.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      arc.msn.com
      Remote address:
      8.8.8.8:53
      Request
      arc.msn.com
      IN A
      Response
      arc.msn.com
      IN CNAME
      arc.trafficmanager.net
      arc.trafficmanager.net
      IN CNAME
      iris-de-prod-azsc-v2-weu.westeurope.cloudapp.azure.com
      iris-de-prod-azsc-v2-weu.westeurope.cloudapp.azure.com
      IN A
      20.103.156.88
    • flag-us
      DNS
      ocsp.digicert.com
      Remote address:
      8.8.8.8:53
      Request
      ocsp.digicert.com
      IN A
      Response
      ocsp.digicert.com
      IN CNAME
      ocsp.edge.digicert.com
      ocsp.edge.digicert.com
      IN CNAME
      fp2e7a.wpc.2be4.phicdn.net
      fp2e7a.wpc.2be4.phicdn.net
      IN CNAME
      fp2e7a.wpc.phicdn.net
      fp2e7a.wpc.phicdn.net
      IN A
      192.229.221.95
    • flag-us
      DNS
      200.197.79.204.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      200.197.79.204.in-addr.arpa
      IN PTR
      Response
      200.197.79.204.in-addr.arpa
      IN PTR
      a-0001a-msedgenet
    • flag-us
      DNS
      ctldl.windowsupdate.com
      Remote address:
      8.8.8.8:53
      Request
      ctldl.windowsupdate.com
      IN A
      Response
      ctldl.windowsupdate.com
      IN CNAME
      wu-bg-shim.trafficmanager.net
      wu-bg-shim.trafficmanager.net
      IN CNAME
      bg.microsoft.map.fastly.net
      bg.microsoft.map.fastly.net
      IN A
      199.232.210.172
      bg.microsoft.map.fastly.net
      IN A
      199.232.214.172
    • flag-us
      DNS
      ris.api.iris.microsoft.com
      Remote address:
      8.8.8.8:53
      Request
      ris.api.iris.microsoft.com
      IN A
      Response
      ris.api.iris.microsoft.com
      IN CNAME
      ris-prod.trafficmanager.net
      ris-prod.trafficmanager.net
      IN CNAME
      asf-ris-prod-neu-azsc.northeurope.cloudapp.azure.com
      asf-ris-prod-neu-azsc.northeurope.cloudapp.azure.com
      IN A
      20.234.120.54
    • flag-us
      DNS
      14.227.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      14.227.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      72.239.69.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      72.239.69.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239371372356_1N2G93XRLJ1Y5GWC9&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
      Remote address:
      204.79.197.200:443
      Request
      GET /th?id=OADD2.10239371372356_1N2G93XRLJ1Y5GWC9&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.22000
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 381531
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: BC982B90EB814E42BDA1A31A92D84E2B Ref B: LON04EDGE1009 Ref C: 2024-04-15T14:13:18Z
      date: Mon, 15 Apr 2024 14:13:18 GMT
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239361657999_1QENB5XTJJHIMEFHM&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
      Remote address:
      204.79.197.200:443
      Request
      GET /th?id=OADD2.10239361657999_1QENB5XTJJHIMEFHM&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.22000
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 370093
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 3E3FF704EE7B4CD8A48B46098CB147E0 Ref B: LON04EDGE1009 Ref C: 2024-04-15T14:13:18Z
      date: Mon, 15 Apr 2024 14:13:18 GMT
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239371372355_1WLRVFTZ079W9XPFC&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
      Remote address:
      204.79.197.200:443
      Request
      GET /th?id=OADD2.10239371372355_1WLRVFTZ079W9XPFC&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.22000
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 329579
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 0F202DC603B34161BBE9455659BCDF0B Ref B: LON04EDGE1009 Ref C: 2024-04-15T14:13:18Z
      date: Mon, 15 Apr 2024 14:13:18 GMT
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239361657998_1WSPJ5GR18GJY2UEV&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
      Remote address:
      204.79.197.200:443
      Request
      GET /th?id=OADD2.10239361657998_1WSPJ5GR18GJY2UEV&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.22000
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 350536
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: FD1F658AA3B94C518AB887DDB87B1C8C Ref B: LON04EDGE1009 Ref C: 2024-04-15T14:13:18Z
      date: Mon, 15 Apr 2024 14:13:18 GMT
    • 204.79.197.200:443
      tse1.mm.bing.net
      tls, http2
      1.3kB
       8.1kB
       16
      14
    • 204.79.197.200:443
      https://tse1.mm.bing.net/th?id=OADD2.10239361657998_1WSPJ5GR18GJY2UEV&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
      tls, http2
      58.2kB
       1.5MB
       1088
      1085

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239371372356_1N2G93XRLJ1Y5GWC9&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239361657999_1QENB5XTJJHIMEFHM&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239371372355_1WLRVFTZ079W9XPFC&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239361657998_1WSPJ5GR18GJY2UEV&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

      HTTP Response

      200

      HTTP Response

      200

      HTTP Response

      200

      HTTP Response

      200
    • 204.79.197.200:443
      tse1.mm.bing.net
      tls, http2
      1.3kB
       8.1kB
       16
      13
    • 204.79.197.200:443
      tse1.mm.bing.net
      tls, http2
      1.3kB
       8.1kB
       16
      14
    • 8.8.8.8:53
      91.90.14.23.in-addr.arpa
      dns
      496 B
       1.1kB
       7
      7

      DNS Request

      91.90.14.23.in-addr.arpa

      DNS Request

      ris.api.iris.microsoft.com

      DNS Response

      20.234.120.54

      DNS Request

      88.156.103.20.in-addr.arpa

      DNS Request

      95.221.229.192.in-addr.arpa

      DNS Request

      arc.msn.com

      DNS Response

      20.31.169.57

      DNS Request

      nexusrules.officeapps.live.com

      DNS Response

      52.111.227.14

      DNS Request

      self.events.data.microsoft.com

      DNS Response

      13.69.239.72

    • 8.8.8.8:53
      43.58.199.20.in-addr.arpa
      dns
      548 B
       1.3kB
       8
      8

      DNS Request

      43.58.199.20.in-addr.arpa

      DNS Request

      arc.msn.com

      DNS Response

      20.103.156.88

      DNS Request

      ocsp.digicert.com

      DNS Response

      192.229.221.95

      DNS Request

      200.197.79.204.in-addr.arpa

      DNS Request

      ctldl.windowsupdate.com

      DNS Response

      199.232.210.172
      199.232.214.172

      DNS Request

      ris.api.iris.microsoft.com

      DNS Response

      20.234.120.54

      DNS Request

      14.227.111.52.in-addr.arpa

      DNS Request

      72.239.69.13.in-addr.arpa

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.