Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    106s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/06/2024, 01:47 UTC

General

  • Target

    76d9f909b801ad442e5b96efbe722ea6.exe

  • Size

    1.6MB

  • MD5

    76d9f909b801ad442e5b96efbe722ea6

  • SHA1

    d3972911f2af7cb09db43e4f1dadd6c359d7a9b2

  • SHA256

    3a27eea1a1b02b56f74dfcafcfe1a7003759be6ae058ba9f1261400592642884

  • SHA512

    0dbce38edcdcd8304a48fc915b18c9e7bcd58261e2406027102aec8161bb138cad8837d201ef1faca25e57575f01c1d8dab124bf6e479972f2ff502f4d1385d2

  • SSDEEP

    24576:gKp1H5vP6lJ3CQvfJFiG8cHmyepJTKzv2O8WjSJXZ2VQqeAyshWmAao32iG:gsV2JhJF1eq4JXZ2VxexcuG

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\76d9f909b801ad442e5b96efbe722ea6.exe
    "C:\Users\Admin\AppData\Local\Temp\76d9f909b801ad442e5b96efbe722ea6.exe"
    1⤵
    • Loads dropped DLL
    PID:4580

Network

  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    13.86.106.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    13.86.106.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    144.107.17.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    144.107.17.2.in-addr.arpa
    IN PTR
    Response
    144.107.17.2.in-addr.arpa
    IN PTR
    a2-17-107-144deploystaticakamaitechnologiescom
  • flag-us
    DNS
    140.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    140.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    228.249.119.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    228.249.119.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    86.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    86.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    198.187.3.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    198.187.3.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    14.227.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    14.227.111.52.in-addr.arpa
    IN PTR
    Response
No results found
  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
    90 B
    1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    13.86.106.20.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    13.86.106.20.in-addr.arpa

  • 8.8.8.8:53
    144.107.17.2.in-addr.arpa
    dns
    71 B
    135 B
    1
    1

    DNS Request

    144.107.17.2.in-addr.arpa

  • 8.8.8.8:53
    140.32.126.40.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    140.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    228.249.119.40.in-addr.arpa
    dns
    73 B
    159 B
    1
    1

    DNS Request

    228.249.119.40.in-addr.arpa

  • 8.8.8.8:53
    86.23.85.13.in-addr.arpa
    dns
    70 B
    144 B
    1
    1

    DNS Request

    86.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    198.187.3.20.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    198.187.3.20.in-addr.arpa

  • 8.8.8.8:53
    14.227.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    14.227.111.52.in-addr.arpa

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\evb3BD2.tmp

    Filesize

    1KB

    MD5

    3b110b7a551c73926524da399a79befb

    SHA1

    ae4a0bc7cc0f1fe6739aa36f17cd18ae02c4086b

    SHA256

    ab44e943da76699cd1b603c789ba5969f8203c16d59afa1a685c703b218e1d05

    SHA512

    bcabd4e3161c48c01eb404d900dd521ca715a8e18072f64c717b3df347e1cb461a0ae6b386b56ea8387377071fd79d6e5ba84d201b259ca4092f76145bfefff5

  • memory/4580-10-0x0000000005400000-0x000000000540A000-memory.dmp

    Filesize

    40KB

  • memory/4580-11-0x0000000005800000-0x0000000005856000-memory.dmp

    Filesize

    344KB

  • memory/4580-3-0x00000000747AE000-0x00000000747AF000-memory.dmp

    Filesize

    4KB

  • memory/4580-0-0x0000000000400000-0x00000000004E0000-memory.dmp

    Filesize

    896KB

  • memory/4580-5-0x0000000002CF0000-0x0000000002D54000-memory.dmp

    Filesize

    400KB

  • memory/4580-6-0x0000000002D70000-0x0000000002E0C000-memory.dmp

    Filesize

    624KB

  • memory/4580-7-0x0000000009C90000-0x000000000A234000-memory.dmp

    Filesize

    5.6MB

  • memory/4580-8-0x00000000747A0000-0x0000000074F50000-memory.dmp

    Filesize

    7.7MB

  • memory/4580-1-0x0000000077922000-0x0000000077923000-memory.dmp

    Filesize

    4KB

  • memory/4580-9-0x0000000005640000-0x00000000056D2000-memory.dmp

    Filesize

    584KB

  • memory/4580-4-0x0000000000400000-0x000000000049C000-memory.dmp

    Filesize

    624KB

  • memory/4580-20-0x00000000058A0000-0x00000000058E2000-memory.dmp

    Filesize

    264KB

  • memory/4580-2-0x0000000077923000-0x0000000077924000-memory.dmp

    Filesize

    4KB

  • memory/4580-21-0x00000000747A0000-0x0000000074F50000-memory.dmp

    Filesize

    7.7MB

  • memory/4580-24-0x0000000000400000-0x00000000004E0000-memory.dmp

    Filesize

    896KB

  • memory/4580-25-0x00000000747AE000-0x00000000747AF000-memory.dmp

    Filesize

    4KB

  • memory/4580-26-0x00000000747A0000-0x0000000074F50000-memory.dmp

    Filesize

    7.7MB

  • memory/4580-29-0x0000000010000000-0x0000000010042000-memory.dmp

    Filesize

    264KB

  • memory/4580-30-0x00000000747A0000-0x0000000074F50000-memory.dmp

    Filesize

    7.7MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.