Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

6

Static

static

3

9cdcc8031a...b2.exe

windows7-x64

6

9cdcc8031a...b2.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    122s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    25/05/2024, 03:17 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9cdcc8031a330e38b9d7f338dc33942f289ab5369030f57bfcfc7becc66a2eb2.exe

  • Size

    264KB

  • MD5

    35056beb8aab9999867440b937eef4e3

  • SHA1

    c8f75c1553af2f85def823bc0069801e626821db

  • SHA256

    9cdcc8031a330e38b9d7f338dc33942f289ab5369030f57bfcfc7becc66a2eb2

  • SHA512

    010dde975d6408efe66909c2be8065c6f9b44f2f0681f7298641f85600d885f1af037f3fd27e7c9406a25408adc332376101010751dc3e20b0b079ac8b40e27e

  • SSDEEP

    192:xPuTunAtt5Pg1lld07xFVd4yywe/2D4Ec7KdT:tYcAP+PlOzVdNpe/REmi

Score
6/10

Malware Config

Signatures

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9cdcc8031a330e38b9d7f338dc33942f289ab5369030f57bfcfc7becc66a2eb2.exe
    "C:\Users\Admin\AppData\Local\Temp\9cdcc8031a330e38b9d7f338dc33942f289ab5369030f57bfcfc7becc66a2eb2.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3056

Network

  • flag-us
    DNS
    ip-api.com
    9cdcc8031a330e38b9d7f338dc33942f289ab5369030f57bfcfc7becc66a2eb2.exe
    Remote address:
    8.8.8.8:53
    Request
    ip-api.com
    IN A
    Response
    ip-api.com
    IN A
    208.95.112.1
  • flag-us
    GET
    http://ip-api.com/line/?fields=query,isp
    9cdcc8031a330e38b9d7f338dc33942f289ab5369030f57bfcfc7becc66a2eb2.exe
    Remote address:
    208.95.112.1:80
    Request
    GET /line/?fields=query,isp HTTP/1.1
    Host: ip-api.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Sat, 25 May 2024 03:17:18 GMT
    Content-Type: text/plain; charset=utf-8
    Content-Length: 39
    Access-Control-Allow-Origin: *
    X-Ttl: 60
    X-Rl: 44
  • flag-us
    DNS
    api.telegram.org
    9cdcc8031a330e38b9d7f338dc33942f289ab5369030f57bfcfc7becc66a2eb2.exe
    Remote address:
    8.8.8.8:53
    Request
    api.telegram.org
    IN A
    Response
    api.telegram.org
    IN A
    149.154.167.220
  • 208.95.112.1:80
    http://ip-api.com/line/?fields=query,isp
    http
    9cdcc8031a330e38b9d7f338dc33942f289ab5369030f57bfcfc7becc66a2eb2.exe
    266 B
     341 B
     4
    3

    HTTP Request

    GET http://ip-api.com/line/?fields=query,isp

    HTTP Response

    200
  • 149.154.167.220:443
    api.telegram.org
    tls
    9cdcc8031a330e38b9d7f338dc33942f289ab5369030f57bfcfc7becc66a2eb2.exe
    396 B
     219 B
     6
    5
  • 8.8.8.8:53
    ip-api.com
    dns
    9cdcc8031a330e38b9d7f338dc33942f289ab5369030f57bfcfc7becc66a2eb2.exe
    56 B
     72 B
     1
    1

    DNS Request

    ip-api.com

    DNS Response

    208.95.112.1

  • 8.8.8.8:53
    api.telegram.org
    dns
    9cdcc8031a330e38b9d7f338dc33942f289ab5369030f57bfcfc7becc66a2eb2.exe
    62 B
     78 B
     1
    1

    DNS Request

    api.telegram.org

    DNS Response

    149.154.167.220

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3056-0-0x00000000746BE000-0x00000000746BF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3056-1-0x0000000000960000-0x000000000096A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/3056-2-0x00000000746B0000-0x0000000074D9E000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/3056-3-0x00000000746BE000-0x00000000746BF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3056-4-0x00000000746B0000-0x0000000074D9E000-memory.dmp

    Filesize

    6.9MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.