Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    92s
  • max time network
    93s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/05/2024, 00:36 UTC

General

  • Target

    87b2cb7d6ced62304a077275bec229b6ecbb0b4f2858a5a8bdd18c0ba74aeab9.exe

  • Size

    5.5MB

  • MD5

    0441a0212c03479aa575e57a55bce133

  • SHA1

    899216e609c7120ffb61fb8bf76e99bc9adc772c

  • SHA256

    87b2cb7d6ced62304a077275bec229b6ecbb0b4f2858a5a8bdd18c0ba74aeab9

  • SHA512

    407c52f8ede74690d505e88dd4ba2170a985a3402975dd9362327d9b0ed1a96b06c1035868371e1683a6c8b7011b87475b526c680097d2057ebcb71570b7a1be

  • SSDEEP

    98304:oseHlHdc5b9dXLVi2xIb7S1fw7pXyZ7oz0R5uz0rbJagkW7kOLIx1qxz8hjFrZBz:Bem17h10XvwPhagz7q2wNPQ00Y

Score
8/10

Malware Config

Signatures

  • Sets file execution options in registry 2 TTPs 6 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Modifies registry class 14 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\87b2cb7d6ced62304a077275bec229b6ecbb0b4f2858a5a8bdd18c0ba74aeab9.exe
    "C:\Users\Admin\AppData\Local\Temp\87b2cb7d6ced62304a077275bec229b6ecbb0b4f2858a5a8bdd18c0ba74aeab9.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3740
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe
      2⤵
        PID:376
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\123.bat
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4672
        • C:\Windows\SysWOW64\reg.exe
          reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
          3⤵
          • Sets file execution options in registry
          PID:2164
        • C:\Windows\SysWOW64\reg.exe
          reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
          3⤵
          • Sets file execution options in registry
          PID:3292
        • C:\Windows\SysWOW64\reg.exe
          reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
          3⤵
          • Sets file execution options in registry
          PID:4908
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c assoc .txt = exefile
        2⤵
        • Modifies registry class
        PID:3484
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c ftype comfile=C:\Users\Admin\AppData\Local\Temp\87b2cb7d6ced62304a077275bec229b6ecbb0b4f2858a5a8bdd18c0ba74aeab9.exe
        2⤵
        • Modifies system executable filetype association
        • Modifies registry class
        PID:1956
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c ftype zipfile=C:\Users\Admin\AppData\Local\Temp\87b2cb7d6ced62304a077275bec229b6ecbb0b4f2858a5a8bdd18c0ba74aeab9.exe
        2⤵
        • Modifies registry class
        PID:1976
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c ftype jpgfile=C:\Users\Admin\AppData\Local\Temp\87b2cb7d6ced62304a077275bec229b6ecbb0b4f2858a5a8bdd18c0ba74aeab9.exe
        2⤵
        • Modifies registry class
        PID:1740
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c ftype txtfile=C:\Users\Admin\AppData\Local\Temp\87b2cb7d6ced62304a077275bec229b6ecbb0b4f2858a5a8bdd18c0ba74aeab9.exe
        2⤵
        • Modifies registry class
        PID:4100

    Network

    • flag-us
      DNS
      74.32.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      74.32.126.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      43.58.199.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      43.58.199.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      172.210.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.210.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-nl
      GET
      https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90
      Remote address:
      23.62.61.97:443
      Request
      GET /th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/2.0
      host: www.bing.com
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-type: image/png
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QWthbWFp"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      content-length: 1107
      date: Sun, 12 May 2024 00:36:59 GMT
      alt-svc: h3=":443"; ma=93600
      x-cdn-traceid: 0.5d3d3e17.1715474219.8983a6e
    • flag-us
      DNS
      97.61.62.23.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      97.61.62.23.in-addr.arpa
      IN PTR
      Response
      97.61.62.23.in-addr.arpa
      IN PTR
      a23-62-61-97deploystaticakamaitechnologiescom
    • flag-us
      DNS
      77.190.18.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      77.190.18.2.in-addr.arpa
      IN PTR
      Response
      77.190.18.2.in-addr.arpa
      IN PTR
      a2-18-190-77deploystaticakamaitechnologiescom
    • flag-us
      DNS
      183.59.114.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      183.59.114.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      56.126.166.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      56.126.166.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      79.190.18.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      79.190.18.2.in-addr.arpa
      IN PTR
      Response
      79.190.18.2.in-addr.arpa
      IN PTR
      a2-18-190-79deploystaticakamaitechnologiescom
    • 23.62.61.97:443
      https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90
      tls, http2
      1.4kB
      6.3kB
      16
      11

      HTTP Request

      GET https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90

      HTTP Response

      200
    • 8.8.8.8:53
      74.32.126.40.in-addr.arpa
      dns
      71 B
      157 B
      1
      1

      DNS Request

      74.32.126.40.in-addr.arpa

    • 8.8.8.8:53
      43.58.199.20.in-addr.arpa
      dns
      71 B
      157 B
      1
      1

      DNS Request

      43.58.199.20.in-addr.arpa

    • 8.8.8.8:53
      172.210.232.199.in-addr.arpa
      dns
      74 B
      128 B
      1
      1

      DNS Request

      172.210.232.199.in-addr.arpa

    • 8.8.8.8:53
      97.61.62.23.in-addr.arpa
      dns
      70 B
      133 B
      1
      1

      DNS Request

      97.61.62.23.in-addr.arpa

    • 8.8.8.8:53
      77.190.18.2.in-addr.arpa
      dns
      70 B
      133 B
      1
      1

      DNS Request

      77.190.18.2.in-addr.arpa

    • 8.8.8.8:53
      183.59.114.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      183.59.114.20.in-addr.arpa

    • 8.8.8.8:53
      56.126.166.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      56.126.166.20.in-addr.arpa

    • 8.8.8.8:53
      79.190.18.2.in-addr.arpa
      dns
      70 B
      133 B
      1
      1

      DNS Request

      79.190.18.2.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\123.bat

      Filesize

      443B

      MD5

      70170ba16a737a438223b88279dc6c85

      SHA1

      cc066efa0fca9bc9f44013660dea6b28ddfd6a24

      SHA256

      d3674f4b34a8ca8167160519aa5c66b6024eb09f4cb0c9278bc44370b0efec6a

      SHA512

      37cc8c954544374d0a1ca4d012c9bd0b47781bc9bb8d0c15a8a95b9934893db3bedee867b984c20edabe54c39574abf7250de433aade6c0d544b8dd2c972c6da

    • C:\Program Files\7-Zip\7zG.exe

      Filesize

      5.5MB

      MD5

      36d20a2505bae083cda7db7ae54df169

      SHA1

      a933cc966f471a7eb8b1001af0cee7da16c306ef

      SHA256

      8dcf4fdfe916146236b206f95645222908dde7000ca1489aea96ba8c2d83ee6c

      SHA512

      4bdc458d6bf007f3c748d187e1d0dbb6d86eba077ab05f4b18517b6d8a8568e1a8bf2c770aaa92fa64ef069ac0b0d2a30c782b82d77d8e3f4b47a92d8e67faf7

    • memory/3740-0-0x0000000000400000-0x0000000000C94000-memory.dmp

      Filesize

      8.6MB

    • memory/3740-1-0x000000000040E000-0x000000000070E000-memory.dmp

      Filesize

      3.0MB

    • memory/3740-3-0x0000000000400000-0x0000000000C94000-memory.dmp

      Filesize

      8.6MB

    • memory/3740-2-0x0000000000D30000-0x0000000000D31000-memory.dmp

      Filesize

      4KB

    • memory/3740-5-0x0000000000400000-0x0000000000C94000-memory.dmp

      Filesize

      8.6MB

    • memory/3740-8-0x0000000000400000-0x0000000000C94000-memory.dmp

      Filesize

      8.6MB

    • memory/3740-1022-0x0000000000400000-0x0000000000C94000-memory.dmp

      Filesize

      8.6MB

    • memory/3740-1023-0x000000000040E000-0x000000000070E000-memory.dmp

      Filesize

      3.0MB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.