Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

Court Proj...IO.exe

windows7-x64

7

Court Proj...IO.exe

windows10-2004-x64

7

Court Proj...ct.exe

windows7-x64

7

Court Proj...ct.exe

windows10-2004-x64

9

Court Proj...fo.exe

windows7-x64

1

Court Proj...fo.exe

windows10-2004-x64

1

Court Proj...ing.py

windows7-x64

3

Court Proj...ing.py

windows10-2004-x64

3

Court Proj...ker.py

ubuntu-18.04-amd64

1

Court Proj...ker.py

debian-9-armhf

1

Court Proj...ker.py

debian-9-mips

Court Proj...ker.py

debian-9-mipsel

Court Proj...mer.py

windows7-x64

3

Court Proj...mer.py

windows10-2004-x64

3

Court Proj...up.exe

windows7-x64

7

Court Proj...up.exe

windows10-2004-x64

7

Court Proj...one.py

windows7-x64

3

Court Proj...one.py

windows10-2004-x64

3

Court Proj...pic.py

windows7-x64

3

Court Proj...pic.py

windows10-2004-x64

3

Resubmissions

25/12/2024, 11:40

241225-ns1f3ssmct 10

20/06/2024, 01:12

240620-bk1qnavdrk 10

01/06/2024, 22:28

240601-2d43lsgh7s 10

Analysis

  • max time kernel
    147s
  • max time network
    97s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/06/2024, 22:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Court Project V1.1/iplookup.exe

  • Size

    2.1MB

  • MD5

    cb4903c1c4f23b021905da634c002f04

  • SHA1

    c2ccf3a1e5037c6e540b94a59e2c367ba8cd9090

  • SHA256

    49945b5eb3f80e6bb9dba81c6c6f643245bb0831ce2f6e5abf4db12ab6709b76

  • SHA512

    7f632331ba7f2fdd3c76f7f158a1cd6e79be796f2dc9f9149b7a071bb77b35fc4f0c6f189a8179eaf4947533513a3f926c879c50c8cf6cb13abdd424113f48fa

  • SSDEEP

    49152:PFkR/VWoA1QfIBoq2Pkbu5Gk6hQW/3f2V1mPzidqz/CIaB2w:NkR/VMCGvj/vYkP9aB

Score
7/10

Malware Config

Signatures

  • .NET Reactor proctector 1 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Court Project V1.1\iplookup.exe
    "C:\Users\Admin\AppData\Local\Temp\Court Project V1.1\iplookup.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/872-0-0x0000000074C1E000-0x0000000074C1F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/872-1-0x0000000000550000-0x000000000076E000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/872-2-0x00000000058A0000-0x0000000005E44000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/872-3-0x00000000051F0000-0x0000000005282000-memory.dmp

    Filesize

    584KB

    Download

  • memory/872-4-0x0000000074C10000-0x00000000753C0000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/872-5-0x0000000074C10000-0x00000000753C0000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/872-6-0x0000000005580000-0x000000000558A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/872-7-0x0000000074C10000-0x00000000753C0000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/872-8-0x0000000074C1E000-0x0000000074C1F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/872-9-0x0000000074C10000-0x00000000753C0000-memory.dmp

    Filesize

    7.7MB

    Download