Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

Launcher.dll

windows10-2004-x64

1

Launcher.exe

windows10-2004-x64

10

data/HzkTNOg6s1em.ps1

windows10-2004-x64

6

data/appIn...m4.ps1

windows10-2004-x64

3

data/appIn...5c.ps1

windows10-2004-x64

3

data/appIn...er.dll

windows10-2004-x64

1

data/appIn...er.exe

windows10-2004-x64

8

data/appIn...AR.exe

windows10-2004-x64

4

data/appIn...er.dll

windows10-2004-x64

1

data/appIn...er.exe

windows10-2004-x64

8

data/appIn...et.exe

windows10-2004-x64

1

data/tAoMyd4BMpNH.ps1

windows10-2004-x64

3

Analysis

  • max time kernel
    424s
  • max time network
    1163s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/07/2024, 05:20 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    data/appInfo/Zxph8ZShJw5c.ps1

  • Size

    110KB

  • MD5

    5249241ac29cdb71e1b4caad76149444

  • SHA1

    f35ec18fcdc29885b028e2d5de7305d9b62088df

  • SHA256

    cff4d04b160809cbc331713287f910d0bfba2bab205c655e58a3c847f6229a2c

  • SHA512

    28c51d9c9330e7e82f56362d9601ebbe2aee4ea81a6a684ce0acd4f583a17db68a580ba8e723581199904eedd4c0ef6ba8e9bd7fdd01309de39ec20c4685aeb0

  • SSDEEP

    3072:cpKcc3xtAjk2y/x92hYpXzoLtj6u8UtQAJ7+6X6e:cpKcitAI2yHGYtzoLtjRtQAJZXJ

Score
3/10
execution

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\data\appInfo\Zxph8ZShJw5c.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1532
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x2c8 0x150
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1588

Network

  • flag-us
    DNS
    240.221.184.93.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    240.221.184.93.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    55.36.223.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    55.36.223.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    26.165.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    26.165.165.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    15.164.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    15.164.165.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    147.142.123.92.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    147.142.123.92.in-addr.arpa
    IN PTR
    Response
    147.142.123.92.in-addr.arpa
    IN PTR
    a92-123-142-147deploystaticakamaitechnologiescom
  • flag-us
    DNS
    21.236.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    21.236.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    73.144.22.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    73.144.22.2.in-addr.arpa
    IN PTR
    Response
    73.144.22.2.in-addr.arpa
    IN PTR
    a2-22-144-73deploystaticakamaitechnologiescom
  • flag-us
    DNS
    27.173.189.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    27.173.189.20.in-addr.arpa
    IN PTR
    Response
No results found
  • 8.8.8.8:53
    240.221.184.93.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    240.221.184.93.in-addr.arpa

  • 8.8.8.8:53
    55.36.223.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    55.36.223.20.in-addr.arpa

  • 8.8.8.8:53
    26.165.165.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    26.165.165.52.in-addr.arpa

  • 8.8.8.8:53
    15.164.165.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    15.164.165.52.in-addr.arpa

  • 8.8.8.8:53
    147.142.123.92.in-addr.arpa
    dns
    73 B
     139 B
     1
    1

    DNS Request

    147.142.123.92.in-addr.arpa

  • 8.8.8.8:53
    21.236.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    21.236.111.52.in-addr.arpa

  • 8.8.8.8:53
    73.144.22.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    73.144.22.2.in-addr.arpa

  • 8.8.8.8:53
    27.173.189.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    27.173.189.20.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cq4m4ezd.3yh.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    Download Submit

  • memory/1532-0-0x00007FF9743F3000-0x00007FF9743F5000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1532-10-0x000001E4D4A60000-0x000001E4D4A82000-memory.dmp

    Filesize

    136KB

    Download

  • memory/1532-11-0x00007FF9743F0000-0x00007FF974EB1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/1532-12-0x00007FF9743F0000-0x00007FF974EB1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/1532-13-0x00007FF9743F0000-0x00007FF974EB1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/1532-16-0x00007FF9743F0000-0x00007FF974EB1000-memory.dmp

    Filesize

    10.8MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.