Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

Updater.zip

windows7-x64

1

Updater.zip

windows10-2004-x64

1

updater.exe

windows7-x64

7

updater.exe

windows10-2004-x64

10

Stub.pyc

windows7-x64

3

Stub.pyc

windows10-2004-x64

3

Analysis

  • max time kernel
    142s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/06/2024, 06:18 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Stub.pyc

  • Size

    872KB

  • MD5

    28d98606a7d2a30f67a5aaeb96d7d1e4

  • SHA1

    efad1e8560d0dd3b21fefa2c671504224998aea9

  • SHA256

    61d574ffce1ea546c31a6a68d0bfb943b355b3a643c06c9e1b17cbae1637e010

  • SHA512

    6f40d175595cf5d0729d7d529bf10f1dcd194c33ae1d20e05a186643398deaea9731015a4b1e15f40e77c4ec54b5dc2fa7e2816b1afa4d03cdd76e82b5ce71f6

  • SSDEEP

    12288:7Nk8Pa3QR3ojyjOAWHfeHpZ4E6+rdYJggiSFCGRln8vkfAL3m/RIPip1ZmBQ:Z9uQR3/CAW/eJZ10iqP/q3CIqp1P

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Stub.pyc
    1⤵
    • Modifies registry class
    PID:868
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1704
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1036 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:3924

    Network

    • flag-us
      DNS
      97.17.167.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      97.17.167.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      80.90.14.23.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      80.90.14.23.in-addr.arpa
      IN PTR
      Response
      80.90.14.23.in-addr.arpa
      IN PTR
      a23-14-90-80deploystaticakamaitechnologiescom
    • flag-us
      DNS
      68.32.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      68.32.126.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      241.150.49.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      241.150.49.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      149.220.183.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      149.220.183.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      chromewebstore.googleapis.com
      Remote address:
      8.8.8.8:53
      Request
      chromewebstore.googleapis.com
      IN A
      Response
      chromewebstore.googleapis.com
      IN A
      142.250.178.10
      chromewebstore.googleapis.com
      IN A
      216.58.204.74
      chromewebstore.googleapis.com
      IN A
      216.58.212.234
      chromewebstore.googleapis.com
      IN A
      142.250.187.234
      chromewebstore.googleapis.com
      IN A
      142.250.187.202
      chromewebstore.googleapis.com
      IN A
      216.58.201.106
      chromewebstore.googleapis.com
      IN A
      142.250.200.42
      chromewebstore.googleapis.com
      IN A
      142.250.179.234
      chromewebstore.googleapis.com
      IN A
      172.217.169.42
      chromewebstore.googleapis.com
      IN A
      216.58.213.10
      chromewebstore.googleapis.com
      IN A
      142.250.180.10
      chromewebstore.googleapis.com
      IN A
      142.250.200.10
      chromewebstore.googleapis.com
      IN A
      172.217.16.234
      chromewebstore.googleapis.com
      IN A
      172.217.169.10
    • flag-us
      DNS
      chromewebstore.googleapis.com
      Remote address:
      8.8.8.8:53
      Request
      chromewebstore.googleapis.com
      IN Unknown
      Response
    • flag-us
      DNS
      pki.goog
      Remote address:
      8.8.8.8:53
      Request
      pki.goog
      IN A
      Response
      pki.goog
      IN A
      216.239.32.29
    • flag-us
      DNS
      pki.goog
      Remote address:
      8.8.8.8:53
      Request
      pki.goog
      IN Unknown
      Response
    • flag-us
      GET
      http://pki.goog/gsr1/gsr1.crt
      Remote address:
      216.239.32.29:80
      Request
      GET /gsr1/gsr1.crt HTTP/1.1
      Host: pki.goog
      Connection: keep-alive
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0
      Accept-Encoding: gzip, deflate
      Accept-Language: en-US,en;q=0.9
      Response
      HTTP/1.1 200 OK
      Accept-Ranges: bytes
      Content-Encoding: gzip
      Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
      Cross-Origin-Resource-Policy: cross-origin
      Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
      Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
      Content-Length: 797
      X-Content-Type-Options: nosniff
      Server: sffe
      X-XSS-Protection: 0
      Date: Sat, 29 Jun 2024 05:37:57 GMT
      Expires: Sat, 29 Jun 2024 06:27:57 GMT
      Cache-Control: public, max-age=3000
      Age: 2498
      Last-Modified: Wed, 20 May 2020 16:45:00 GMT
      Content-Type: application/pkix-cert
      Vary: Accept-Encoding
    • flag-us
      DNS
      i.pki.goog
      Remote address:
      8.8.8.8:53
      Request
      i.pki.goog
      IN A
      Response
      i.pki.goog
      IN CNAME
      pki-goog.l.google.com
      pki-goog.l.google.com
      IN A
      172.217.169.67
    • flag-us
      DNS
      i.pki.goog
      Remote address:
      8.8.8.8:53
      Request
      i.pki.goog
      IN Unknown
      Response
      i.pki.goog
      IN CNAME
      pki-goog.l.google.com
    • flag-gb
      GET
      http://i.pki.goog/r1.crt
      Remote address:
      172.217.169.67:80
      Request
      GET /r1.crt HTTP/1.1
      Host: i.pki.goog
      Connection: keep-alive
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0
      Accept-Encoding: gzip, deflate
      Accept-Language: en-US,en;q=0.9
      Response
      HTTP/1.1 200 OK
      Accept-Ranges: bytes
      Access-Control-Allow-Origin: https://pki.goog
      Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
      Cross-Origin-Resource-Policy: cross-origin
      Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
      Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
      Content-Length: 1371
      X-Content-Type-Options: nosniff
      Server: sffe
      X-XSS-Protection: 0
      Date: Sat, 29 Jun 2024 06:10:54 GMT
      Expires: Sat, 29 Jun 2024 07:00:54 GMT
      Cache-Control: public, max-age=3000
      Age: 522
      Last-Modified: Fri, 27 Oct 2023 09:38:00 GMT
      Content-Type: application/pkix-cert
      Vary: Accept-Encoding
    • flag-gb
      GET
      http://i.pki.goog/wr2.crt
      Remote address:
      172.217.169.67:80
      Request
      GET /wr2.crt HTTP/1.1
      Host: i.pki.goog
      Connection: keep-alive
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0
      Accept-Encoding: gzip, deflate
      Accept-Language: en-US,en;q=0.9
      Response
      HTTP/1.1 200 OK
      Accept-Ranges: bytes
      Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
      Cross-Origin-Resource-Policy: cross-origin
      Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
      Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
      Content-Length: 1295
      X-Content-Type-Options: nosniff
      Server: sffe
      X-XSS-Protection: 0
      Access-Control-Allow-Origin: https://pki.goog
      Date: Sat, 29 Jun 2024 05:41:00 GMT
      Expires: Sat, 29 Jun 2024 06:31:00 GMT
      Cache-Control: public, max-age=3000
      Age: 2316
      Last-Modified: Wed, 13 Dec 2023 15:28:00 GMT
      Content-Type: application/pkix-cert
      Vary: Accept-Encoding
    • flag-us
      DNS
      10.178.250.142.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      10.178.250.142.in-addr.arpa
      IN PTR
      Response
      10.178.250.142.in-addr.arpa
      IN PTR
      lhr48s27-in-f101e100net
    • flag-us
      DNS
      29.32.239.216.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      29.32.239.216.in-addr.arpa
      IN PTR
      Response
      29.32.239.216.in-addr.arpa
      IN PTR
      any-in-201d1e100net
    • flag-us
      DNS
      67.169.217.172.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      67.169.217.172.in-addr.arpa
      IN PTR
      Response
      67.169.217.172.in-addr.arpa
      IN PTR
      lhr48s09-in-f31e100net
    • flag-us
      DNS
      50.23.12.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      50.23.12.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      56.126.166.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      56.126.166.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      92.12.20.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      92.12.20.2.in-addr.arpa
      IN PTR
      Response
      92.12.20.2.in-addr.arpa
      IN PTR
      a2-20-12-92deploystaticakamaitechnologiescom
    • flag-us
      DNS
      82.90.14.23.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      82.90.14.23.in-addr.arpa
      IN PTR
      Response
      82.90.14.23.in-addr.arpa
      IN PTR
      a23-14-90-82deploystaticakamaitechnologiescom
    • flag-us
      DNS
      21.236.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      21.236.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      172.214.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.214.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      235.17.178.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      235.17.178.52.in-addr.arpa
      IN PTR
      Response
    • 142.250.178.10:443
      chromewebstore.googleapis.com
      tls
      909 B
       5.0kB
       8
      8
    • 216.239.32.29:80
      http://pki.goog/gsr1/gsr1.crt
      http
      551 B
       1.8kB
       6
      6

      HTTP Request

      GET http://pki.goog/gsr1/gsr1.crt

      HTTP Response

      200
    • 172.217.169.67:80
      http://i.pki.goog/wr2.crt
      http
      903 B
       4.5kB
       8
      8

      HTTP Request

      GET http://i.pki.goog/r1.crt

      HTTP Response

      200

      HTTP Request

      GET http://i.pki.goog/wr2.crt

      HTTP Response

      200
    • 13.107.246.64:443
      46 B
       40 B
       1
      1
    • 8.8.8.8:53
      97.17.167.52.in-addr.arpa
      dns
      71 B
       145 B
       1
      1

      DNS Request

      97.17.167.52.in-addr.arpa

    • 8.8.8.8:53
      80.90.14.23.in-addr.arpa
      dns
      70 B
       133 B
       1
      1

      DNS Request

      80.90.14.23.in-addr.arpa

    • 8.8.8.8:53
      68.32.126.40.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      68.32.126.40.in-addr.arpa

    • 8.8.8.8:53
      241.150.49.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      241.150.49.20.in-addr.arpa

    • 8.8.8.8:53
      149.220.183.52.in-addr.arpa
      dns
      73 B
       147 B
       1
      1

      DNS Request

      149.220.183.52.in-addr.arpa

    • 8.8.8.8:53
      chromewebstore.googleapis.com
      dns
      75 B
       299 B
       1
      1

      DNS Request

      chromewebstore.googleapis.com

      DNS Response

      142.250.178.10
      216.58.204.74
      216.58.212.234
      142.250.187.234
      142.250.187.202
      216.58.201.106
      142.250.200.42
      142.250.179.234
      172.217.169.42
      216.58.213.10
      142.250.180.10
      142.250.200.10
      172.217.16.234
      172.217.169.10

    • 8.8.8.8:53
      chromewebstore.googleapis.com
      dns
      75 B
       132 B
       1
      1

      DNS Request

      chromewebstore.googleapis.com

    • 8.8.8.8:53
      pki.goog
      dns
      54 B
       70 B
       1
      1

      DNS Request

      pki.goog

      DNS Response

      216.239.32.29

    • 8.8.8.8:53
      pki.goog
      dns
      54 B
       128 B
       1
      1

      DNS Request

      pki.goog

    • 8.8.8.8:53
      i.pki.goog
      dns
      56 B
       107 B
       1
      1

      DNS Request

      i.pki.goog

      DNS Response

      172.217.169.67

    • 8.8.8.8:53
      i.pki.goog
      dns
      56 B
       141 B
       1
      1

      DNS Request

      i.pki.goog

    • 8.8.8.8:53
      10.178.250.142.in-addr.arpa
      dns
      73 B
       112 B
       1
      1

      DNS Request

      10.178.250.142.in-addr.arpa

    • 8.8.8.8:53
      29.32.239.216.in-addr.arpa
      dns
      72 B
       107 B
       1
      1

      DNS Request

      29.32.239.216.in-addr.arpa

    • 8.8.8.8:53
      67.169.217.172.in-addr.arpa
      dns
      73 B
       111 B
       1
      1

      DNS Request

      67.169.217.172.in-addr.arpa

    • 8.8.8.8:53
      50.23.12.20.in-addr.arpa
      dns
      70 B
       156 B
       1
      1

      DNS Request

      50.23.12.20.in-addr.arpa

    • 8.8.8.8:53
      56.126.166.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      56.126.166.20.in-addr.arpa

    • 8.8.8.8:53
      92.12.20.2.in-addr.arpa
      dns
      69 B
       131 B
       1
      1

      DNS Request

      92.12.20.2.in-addr.arpa

    • 8.8.8.8:53
      82.90.14.23.in-addr.arpa
      dns
      70 B
       133 B
       1
      1

      DNS Request

      82.90.14.23.in-addr.arpa

    • 8.8.8.8:53
      21.236.111.52.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      21.236.111.52.in-addr.arpa

    • 8.8.8.8:53
      172.214.232.199.in-addr.arpa
      dns
      74 B
       128 B
       1
      1

      DNS Request

      172.214.232.199.in-addr.arpa

    • 8.8.8.8:53
      235.17.178.52.in-addr.arpa
      dns
      72 B
       146 B
       1
      1

      DNS Request

      235.17.178.52.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.