Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

d7deda9897...8d.exe

windows7-x64

7

d7deda9897...8d.exe

windows10-2004-x64

7

d80d51404c...20.exe

windows7-x64

7

d80d51404c...20.exe

windows10-2004-x64

7

d8a40fff2e...76.exe

windows7-x64

7

d8a40fff2e...76.exe

windows10-2004-x64

7

d92b5b0796...45.exe

windows7-x64

7

d92b5b0796...45.exe

windows10-2004-x64

7

de558a924a...a1.exe

windows7-x64

10

de558a924a...a1.exe

windows10-2004-x64

10

e1051e77a0...c0.exe

windows7-x64

1

e1051e77a0...c0.exe

windows10-2004-x64

1

e1ae0e66e2...be.exe

windows7-x64

10

e1ae0e66e2...be.exe

windows10-2004-x64

10

e4d5b043f5...f1.exe

windows7-x64

7

e4d5b043f5...f1.exe

windows10-2004-x64

7

e4d72d8ddc...a8.exe

windows7-x64

10

e4d72d8ddc...a8.exe

windows10-2004-x64

10

e5370d47a3...e0.exe

windows7-x64

10

e5370d47a3...e0.exe

windows10-2004-x64

10

e57bff75d5...ad.exe

windows7-x64

1

e57bff75d5...ad.exe

windows10-2004-x64

1

e65128450f...ea.exe

windows7-x64

10

e65128450f...ea.exe

windows10-2004-x64

10

e800a3ce24...c8.exe

windows7-x64

10

e800a3ce24...c8.exe

windows10-2004-x64

7

e8412c4989...cb.exe

windows7-x64

1

e8412c4989...cb.exe

windows10-2004-x64

10

e91296156c...ff.exe

windows7-x64

7

e91296156c...ff.exe

windows10-2004-x64

7

ea6ec9be3a...54.exe

windows7-x64

1

ea6ec9be3a...54.exe

windows10-2004-x64

1

Resubmissions

05/09/2023, 01:34 UTC

230905-by5lrsch46 10

Analysis

  • max time kernel
    140s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/05/2024, 01:20 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e4d5b043f5c9e0894a5f4a21c93cd7347a609a900da8f56f55a0dd84269e81f1.exe

  • Size

    6.9MB

  • MD5

    acc8d28b6efffe73bc7087b610c6dd9f

  • SHA1

    ee5d1ce578c07a8378189e72345277efc696c090

  • SHA256

    e4d5b043f5c9e0894a5f4a21c93cd7347a609a900da8f56f55a0dd84269e81f1

  • SHA512

    a94ce3d5795d13d4474a0afcbd65772d4d34f5756f2ae961f5082aa0570e078ea410aafc893cff54e2a1fad2b690de7060754aafbd48b3a9f1b2d28753b9db7c

  • SSDEEP

    196608:MYh4Y2TV9xyWZzP+EyNlbof4N9XxuzeS5fWPs1:VuYW1PK9owN9BceifWPS

Score
7/10
vmprotect

Malware Config

Signatures

  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e4d5b043f5c9e0894a5f4a21c93cd7347a609a900da8f56f55a0dd84269e81f1.exe
    "C:\Users\Admin\AppData\Local\Temp\e4d5b043f5c9e0894a5f4a21c93cd7347a609a900da8f56f55a0dd84269e81f1.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:4420

Network

  • flag-us
    DNS
    196.249.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    196.249.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    14.160.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    14.160.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    phonevronlene.xyz
    e4d5b043f5c9e0894a5f4a21c93cd7347a609a900da8f56f55a0dd84269e81f1.exe
    Remote address:
    8.8.8.8:53
    Request
    phonevronlene.xyz
    IN A
    Response
  • flag-us
    DNS
    gapi-node.io
    e4d5b043f5c9e0894a5f4a21c93cd7347a609a900da8f56f55a0dd84269e81f1.exe
    Remote address:
    8.8.8.8:53
    Request
    gapi-node.io
    IN A
    Response
  • flag-us
    DNS
    gapi-node.io
    e4d5b043f5c9e0894a5f4a21c93cd7347a609a900da8f56f55a0dd84269e81f1.exe
    Remote address:
    8.8.8.8:53
    Request
    gapi-node.io
    IN A
    Response
  • flag-us
    DNS
    gapi-node.io
    e4d5b043f5c9e0894a5f4a21c93cd7347a609a900da8f56f55a0dd84269e81f1.exe
    Remote address:
    8.8.8.8:53
    Request
    gapi-node.io
    IN A
    Response
  • flag-us
    DNS
    gapi-node.io
    e4d5b043f5c9e0894a5f4a21c93cd7347a609a900da8f56f55a0dd84269e81f1.exe
    Remote address:
    8.8.8.8:53
    Request
    gapi-node.io
    IN A
    Response
  • flag-us
    DNS
    133.211.185.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.211.185.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    183.59.114.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    183.59.114.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    198.187.3.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    198.187.3.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    48.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    48.229.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    203.107.17.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    203.107.17.2.in-addr.arpa
    IN PTR
    Response
    203.107.17.2.in-addr.arpa
    IN PTR
    a2-17-107-203deploystaticakamaitechnologiescom
  • flag-us
    DNS
    12.173.189.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    12.173.189.20.in-addr.arpa
    IN PTR
    Response
No results found
  • 8.8.8.8:53
    196.249.167.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    196.249.167.52.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    14.160.190.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    14.160.190.20.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    phonevronlene.xyz
    dns
    e4d5b043f5c9e0894a5f4a21c93cd7347a609a900da8f56f55a0dd84269e81f1.exe
    63 B
     63 B
     1
    1

    DNS Request

    phonevronlene.xyz

  • 8.8.8.8:53
    gapi-node.io
    dns
    e4d5b043f5c9e0894a5f4a21c93cd7347a609a900da8f56f55a0dd84269e81f1.exe
    232 B
     232 B
     4
    4

    DNS Request

    gapi-node.io

    DNS Request

    gapi-node.io

    DNS Request

    gapi-node.io

    DNS Request

    gapi-node.io

  • 8.8.8.8:53
    133.211.185.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    133.211.185.52.in-addr.arpa

  • 8.8.8.8:53
    183.59.114.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    183.59.114.20.in-addr.arpa

  • 8.8.8.8:53
    198.187.3.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    198.187.3.20.in-addr.arpa

  • 8.8.8.8:53
    48.229.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    48.229.111.52.in-addr.arpa

  • 8.8.8.8:53
    203.107.17.2.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    203.107.17.2.in-addr.arpa

  • 8.8.8.8:53
    12.173.189.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    12.173.189.20.in-addr.arpa

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4420-2-0x0000000001920000-0x0000000001921000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4420-6-0x0000000001980000-0x0000000001981000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4420-5-0x0000000001970000-0x0000000001971000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4420-4-0x0000000001960000-0x0000000001961000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4420-7-0x0000000001990000-0x0000000001991000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4420-3-0x0000000001950000-0x0000000001951000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4420-1-0x00000000008F7000-0x0000000000C83000-memory.dmp

    Filesize

    3.5MB

    Download

  • memory/4420-0-0x0000000001910000-0x0000000001911000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4420-10-0x0000000000880000-0x0000000001342000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/4420-12-0x0000000000880000-0x0000000001342000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/4420-13-0x00000000008F7000-0x0000000000C83000-memory.dmp

    Filesize

    3.5MB

    Download

  • memory/4420-14-0x0000000000880000-0x0000000001342000-memory.dmp

    Filesize

    10.8MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.