Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

3

Static

static

1

cpvp.zip

windows7-x64

1

cpvp.zip

windows10-2004-x64

1

cpvp/DIM-1...ids.gz

windows7-x64

3

cpvp/DIM-1...ids.gz

windows10-2004-x64

3

raids.dat

windows7-x64

3

raids.dat

windows10-2004-x64

3

cpvp/DIM1/...end.gz

windows7-x64

3

cpvp/DIM1/...end.gz

windows10-2004-x64

3

raids_end.dat

windows7-x64

3

raids_end.dat

windows10-2004-x64

3

cpvp/DIM1/...-1.mca

windows7-x64

3

cpvp/DIM1/...-1.mca

windows10-2004-x64

3

cpvp/DIM1/....0.mca

windows7-x64

3

cpvp/DIM1/....0.mca

windows10-2004-x64

3

cpvp/DIM1/...-1.mca

windows7-x64

3

cpvp/DIM1/...-1.mca

windows10-2004-x64

3

cpvp/DIM1/....0.mca

windows7-x64

3

cpvp/DIM1/....0.mca

windows10-2004-x64

3

cpvp/advan...0.json

windows7-x64

3

cpvp/advan...0.json

windows10-2004-x64

3

cpvp/advan...0.json

windows7-x64

3

cpvp/advan...0.json

windows10-2004-x64

3

cpvp/data/...try.gz

windows7-x64

3

cpvp/data/...try.gz

windows10-2004-x64

3

fabricDyna...ry.dat

windows7-x64

3

fabricDyna...ry.dat

windows10-2004-x64

3

cpvp/data/raids.gz

windows7-x64

3

cpvp/data/raids.gz

windows10-2004-x64

3

raids.dat

windows7-x64

3

raids.dat

windows10-2004-x64

3

cpvp/entit...-1.mca

windows7-x64

3

cpvp/entit...-1.mca

windows10-2004-x64

3

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/04/2024, 16:20 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cpvp/data/raids.gz

  • Size

    90B

  • MD5

    5dfbca3b8751f2b51d05acaab58adc89

  • SHA1

    e725afaadf305697db598757c4ed35ed2dc4fb27

  • SHA256

    3f7e8c84e1d0dfbc638f80f6efa74e3a96dd992cb836d1e3794961b47a72d3b9

  • SHA512

    39fd6031e35d0ccd0ee07f955b680ce20acfd8ba55eb378f3fb376debf7eb826db5cc32408c9bbd722766f2018ef6cec66528da57438c9fdb26af23d6e033244

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\cpvp\data\raids.gz
    1⤵
    • Modifies registry class
    PID:2860
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1792

Network

  • flag-us
    DNS
    17.53.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    17.53.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    241.154.82.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.154.82.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    205.47.74.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    205.47.74.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    21.114.53.23.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    21.114.53.23.in-addr.arpa
    IN PTR
    Response
    21.114.53.23.in-addr.arpa
    IN PTR
    a23-53-114-21deploystaticakamaitechnologiescom
  • flag-us
    DNS
    50.23.12.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    50.23.12.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    15.164.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    15.164.165.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    31.121.18.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    31.121.18.2.in-addr.arpa
    IN PTR
    Response
    31.121.18.2.in-addr.arpa
    IN PTR
    a2-18-121-31deploystaticakamaitechnologiescom
  • flag-us
    DNS
    22.236.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    22.236.111.52.in-addr.arpa
    IN PTR
    Response
No results found
  • 8.8.8.8:53
    17.53.126.40.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    17.53.126.40.in-addr.arpa

  • 8.8.8.8:53
    241.154.82.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    241.154.82.20.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    205.47.74.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    205.47.74.20.in-addr.arpa

  • 8.8.8.8:53
    21.114.53.23.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    21.114.53.23.in-addr.arpa

  • 8.8.8.8:53
    50.23.12.20.in-addr.arpa
    dns
    70 B
     156 B
     1
    1

    DNS Request

    50.23.12.20.in-addr.arpa

  • 8.8.8.8:53
    15.164.165.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    15.164.165.52.in-addr.arpa

  • 8.8.8.8:53
    31.121.18.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    31.121.18.2.in-addr.arpa

  • 8.8.8.8:53
    22.236.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    22.236.111.52.in-addr.arpa

  • 8.8.8.8:53

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.