Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10testsh-x2/5 (1).exe
windows7-x64
1testsh-x2/5 (1).exe
windows10-2004-x64
1testsh-x2/5 (10).exe
windows7-x64
1testsh-x2/5 (10).exe
windows10-2004-x64
1testsh-x2/5 (11).exe
windows7-x64
1testsh-x2/5 (11).exe
windows10-2004-x64
1testsh-x2/5 (12).exe
windows7-x64
1testsh-x2/5 (12).exe
windows10-2004-x64
1testsh-x2/5 (13).exe
windows7-x64
1testsh-x2/5 (13).exe
windows10-2004-x64
1testsh-x2/5 (14).exe
windows7-x64
1testsh-x2/5 (14).exe
windows10-2004-x64
1testsh-x2/5 (15).exe
windows7-x64
1testsh-x2/5 (15).exe
windows10-2004-x64
1testsh-x2/5 (16).exe
windows7-x64
1testsh-x2/5 (16).exe
windows10-2004-x64
1testsh-x2/5 (17).exe
windows7-x64
1testsh-x2/5 (17).exe
windows10-2004-x64
1testsh-x2/5 (18).exe
windows7-x64
1testsh-x2/5 (18).exe
windows10-2004-x64
1testsh-x2/5 (19).exe
windows7-x64
1testsh-x2/5 (19).exe
windows10-2004-x64
1testsh-x2/5 (2).exe
windows7-x64
1testsh-x2/5 (2).exe
windows10-2004-x64
1testsh-x2/5 (20).exe
windows7-x64
1testsh-x2/5 (20).exe
windows10-2004-x64
1testsh-x2/5 (21).exe
windows7-x64
1testsh-x2/5 (21).exe
windows10-2004-x64
1testsh-x2/5 (22).exe
windows7-x64
1testsh-x2/5 (22).exe
windows10-2004-x64
1testsh-x2/5 (23).exe
windows7-x64
1testsh-x2/5 (23).exe
windows10-2004-x64
1Analysis
-
max time kernel
137s -
max time network
309s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
07/07/2024, 08:06 UTC
Behavioral task
behavioral1
Sample
testsh-x2/5 (1).exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
testsh-x2/5 (1).exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
testsh-x2/5 (10).exe
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
testsh-x2/5 (10).exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral5
Sample
testsh-x2/5 (11).exe
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
testsh-x2/5 (11).exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
testsh-x2/5 (12).exe
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
testsh-x2/5 (12).exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral9
Sample
testsh-x2/5 (13).exe
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
testsh-x2/5 (13).exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral11
Sample
testsh-x2/5 (14).exe
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
testsh-x2/5 (14).exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral13
Sample
testsh-x2/5 (15).exe
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
testsh-x2/5 (15).exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral15
Sample
testsh-x2/5 (16).exe
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
testsh-x2/5 (16).exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral17
Sample
testsh-x2/5 (17).exe
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
testsh-x2/5 (17).exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral19
Sample
testsh-x2/5 (18).exe
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
testsh-x2/5 (18).exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral21
Sample
testsh-x2/5 (19).exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
testsh-x2/5 (19).exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral23
Sample
testsh-x2/5 (2).exe
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
testsh-x2/5 (2).exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
testsh-x2/5 (20).exe
Resource
win7-20240705-en
Behavioral task
behavioral26
Sample
testsh-x2/5 (20).exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral27
Sample
testsh-x2/5 (21).exe
Resource
win7-20240705-en
Behavioral task
behavioral28
Sample
testsh-x2/5 (21).exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
testsh-x2/5 (22).exe
Resource
win7-20240704-en
Behavioral task
behavioral30
Sample
testsh-x2/5 (22).exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral31
Sample
testsh-x2/5 (23).exe
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
testsh-x2/5 (23).exe
Resource
win10v2004-20240704-en
General
-
Target
testsh-x2/5 (12).exe
-
Size
6.1MB
-
MD5
c0f8959614ae06561216158d78a787e5
-
SHA1
73167d1fd0cee1c96a6505606d21cbfe4369eb00
-
SHA256
e199d88569fb54346d5fa20ee7b59b2ea6f16f4ecca3ea1e1c937b11aab7b2b0
-
SHA512
a24fcf344d08c64ac301d5e4979f062b5e28e8e4acf1d2790916149ffe7726b0c4a11e0775aeba6b841d2d5081e1bd13e2b80390bf9bfbc44d67e54ec07cd746
-
SSDEEP
98304:AwHlVzThdquIJ3mH6KfTSr2tJCkN3dOauqMAC2Taf43TZquOE2:fVz5CkN3dXuq9Taf4jLt2
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 2156 5 (12).exe Token: SeLockMemoryPrivilege 2156 5 (12).exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2156 5 (12).exe
Processes
Network
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Request73.31.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request73.144.22.2.in-addr.arpaIN PTRResponse73.144.22.2.in-addr.arpaIN PTRa2-22-144-73deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request26.35.223.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestsg-zephyr.miningocean.orgIN AResponsesg-zephyr.miningocean.orgIN A51.79.157.201
-
Remote address:8.8.8.8:53Request201.157.79.51.in-addr.arpaIN PTRResponse201.157.79.51.in-addr.arpaIN PTRvps-eaaaf6bfvpsovhca
-
Remote address:8.8.8.8:53Requestslscr.update.microsoft.comIN AResponseslscr.update.microsoft.comIN CNAMEsls.update.microsoft.comsls.update.microsoft.comIN CNAMEglb.sls.prod.dcat.dsp.trafficmanager.netglb.sls.prod.dcat.dsp.trafficmanager.netIN A20.114.59.183
-
Remote address:8.8.8.8:53Request183.59.114.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request0.205.248.87.in-addr.arpaIN PTRResponse0.205.248.87.in-addr.arpaIN PTRhttps-87-248-205-0lgwllnwnet
-
Remote address:8.8.8.8:53Request11.227.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request81.144.22.2.in-addr.arpaIN PTRResponse81.144.22.2.in-addr.arpaIN PTRa2-22-144-81deploystaticakamaitechnologiescom
-
66 B 90 B 1 1
DNS Request
8.8.8.8.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
73.31.126.40.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
73.144.22.2.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
26.35.223.20.in-addr.arpa
-
71 B 87 B 1 1
DNS Request
sg-zephyr.miningocean.org
DNS Response
51.79.157.201
-
144 B 269 B 2 2
DNS Request
201.157.79.51.in-addr.arpa
DNS Request
slscr.update.microsoft.com
DNS Response
20.114.59.183
-
72 B 158 B 1 1
DNS Request
183.59.114.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
171.39.242.20.in-addr.arpa
-
71 B 116 B 1 1
DNS Request
0.205.248.87.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
11.227.111.52.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
81.144.22.2.in-addr.arpa