Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

3

Static

static

1

xuanxi3.81...ss.vbs

windows7-x64

1

xuanxi3.81...ss.vbs

windows10-2004-x64

1

xuanxi3.81...mn.vbs

windows7-x64

1

xuanxi3.81...mn.vbs

windows10-2004-x64

1

xuanxi3.81...le.vbs

windows7-x64

1

xuanxi3.81...le.vbs

windows10-2004-x64

1

xuanxi3.81...ec.vbs

windows7-x64

1

xuanxi3.81...ec.vbs

windows10-2004-x64

1

xuanxi3.81...ay.vbs

windows7-x64

1

xuanxi3.81...ay.vbs

windows10-2004-x64

1

xuanxi3.81...te.vbs

windows7-x64

1

xuanxi3.81...te.vbs

windows10-2004-x64

1

xuanxi3.81...sh.vbs

windows7-x64

1

xuanxi3.81...sh.vbs

windows10-2004-x64

1

xuanxi3.81...ss.vbs

windows7-x64

1

xuanxi3.81...ss.vbs

windows10-2004-x64

1

xuanxi3.81...se.vbs

windows7-x64

1

xuanxi3.81...se.vbs

windows10-2004-x64

1

xuanxi3.81...ge.vbs

windows7-x64

1

xuanxi3.81...ge.vbs

windows10-2004-x64

1

xuanxi3.81...up.vbs

windows7-x64

1

xuanxi3.81...up.vbs

windows10-2004-x64

1

xuanxi3.81...iew.js

windows7-x64

3

xuanxi3.81...iew.js

windows10-2004-x64

3

xuanxi3.81...ex.vbs

windows7-x64

1

xuanxi3.81...ex.vbs

windows10-2004-x64

1

xuanxi3.81...nk.vbs

windows7-x64

1

xuanxi3.81...nk.vbs

windows10-2004-x64

1

xuanxi3.81...in.vbs

windows7-x64

1

xuanxi3.81...in.vbs

windows10-2004-x64

1

xuanxi3.81...ip.vbs

windows7-x64

1

xuanxi3.81...ip.vbs

windows10-2004-x64

1

Analysis

  • max time kernel
    92s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/07/2024, 04:03 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    xuanxi3.81/admin/admin_loadskin.vbs

  • Size

    19KB

  • MD5

    5da8a159040e61ede1fc8c77220cddd6

  • SHA1

    ac952131760039d09c67f722381de5f6aeda2146

  • SHA256

    051cd34fd11cd8e3b3f778b74c929fed1501feaad72927cb47d6d5691a9447f7

  • SHA512

    66046a577f3829863262ce97bd1a833c9f154a532769f6c167b4ec74d830f271f7b9c90646f0f826f969434023e1bbbbd66ad7646cee6d90f7a5c1a8c18a3594

  • SSDEEP

    384:y5MDuNT2j1RAXAnEFmssHAnHA5VRVaW2hEISoRDrb7jfOD9Qt:y5lT2ZRAXAnEFUHAnHA5hajTf

Score
1/10

Malware Config

Signatures

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\xuanxi3.81\admin\admin_loadskin.vbs"
    1⤵
      PID:4140

    Network

    • flag-us
      DNS
      g.bing.com
      Remote address:
      8.8.8.8:53
      Request
      g.bing.com
      IN A
      Response
      g.bing.com
      IN CNAME
      g-bing-com.dual-a-0034.a-msedge.net
      g-bing-com.dual-a-0034.a-msedge.net
      IN CNAME
      dual-a-0034.a-msedge.net
      dual-a-0034.a-msedge.net
      IN A
      204.79.197.237
      dual-a-0034.a-msedge.net
      IN A
      13.107.21.237
    • flag-us
      GET
      https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=6e53dfd349f84c578f9b093a37a793ae&localId=w:02CFF369-7177-605D-73C2-BA4DB418EA60&deviceId=6896204246996124&anid=
      Remote address:
      204.79.197.237:443
      Request
      GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=6e53dfd349f84c578f9b093a37a793ae&localId=w:02CFF369-7177-605D-73C2-BA4DB418EA60&deviceId=6896204246996124&anid= HTTP/2.0
      host: g.bing.com
      accept-encoding: gzip, deflate
      user-agent: WindowsShellClient/9.0.40929.0 (Windows)
      Response
      HTTP/2.0 204
      cache-control: no-cache, must-revalidate
      pragma: no-cache
      expires: Fri, 01 Jan 1990 00:00:00 GMT
      set-cookie: MUID=357D47100C6E69530A9853A80DD568BF; domain=.bing.com; expires=Mon, 04-Aug-2025 04:04:36 GMT; path=/; SameSite=None; Secure; Priority=High;
      strict-transport-security: max-age=31536000; includeSubDomains; preload
      access-control-allow-origin: *
      x-cache: CONFIG_NOCACHE
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 2EFE448D6524433BA9963F54203BFC06 Ref B: LON04EDGE0916 Ref C: 2024-07-10T04:04:36Z
      date: Wed, 10 Jul 2024 04:04:36 GMT
    • flag-us
      GET
      https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=6e53dfd349f84c578f9b093a37a793ae&localId=w:02CFF369-7177-605D-73C2-BA4DB418EA60&deviceId=6896204246996124&anid=
      Remote address:
      204.79.197.237:443
      Request
      GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=6e53dfd349f84c578f9b093a37a793ae&localId=w:02CFF369-7177-605D-73C2-BA4DB418EA60&deviceId=6896204246996124&anid= HTTP/2.0
      host: g.bing.com
      accept-encoding: gzip, deflate
      user-agent: WindowsShellClient/9.0.40929.0 (Windows)
      cookie: MUID=357D47100C6E69530A9853A80DD568BF
      Response
      HTTP/2.0 204
      cache-control: no-cache, must-revalidate
      pragma: no-cache
      expires: Fri, 01 Jan 1990 00:00:00 GMT
      set-cookie: MSPTC=HV_VvdoW2LE8_Hu2uyKnet9fk932c0c4ly46RXjOa3I; domain=.bing.com; expires=Mon, 04-Aug-2025 04:04:36 GMT; path=/; Partitioned; secure; SameSite=None
      strict-transport-security: max-age=31536000; includeSubDomains; preload
      access-control-allow-origin: *
      x-cache: CONFIG_NOCACHE
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 5C96016F089B46A2BDABF102C3FCBC87 Ref B: LON04EDGE0916 Ref C: 2024-07-10T04:04:36Z
      date: Wed, 10 Jul 2024 04:04:36 GMT
    • flag-us
      GET
      https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=6e53dfd349f84c578f9b093a37a793ae&localId=w:02CFF369-7177-605D-73C2-BA4DB418EA60&deviceId=6896204246996124&anid=
      Remote address:
      204.79.197.237:443
      Request
      GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=6e53dfd349f84c578f9b093a37a793ae&localId=w:02CFF369-7177-605D-73C2-BA4DB418EA60&deviceId=6896204246996124&anid= HTTP/2.0
      host: g.bing.com
      accept-encoding: gzip, deflate
      user-agent: WindowsShellClient/9.0.40929.0 (Windows)
      cookie: MUID=357D47100C6E69530A9853A80DD568BF; MSPTC=HV_VvdoW2LE8_Hu2uyKnet9fk932c0c4ly46RXjOa3I
      Response
      HTTP/2.0 204
      cache-control: no-cache, must-revalidate
      pragma: no-cache
      expires: Fri, 01 Jan 1990 00:00:00 GMT
      strict-transport-security: max-age=31536000; includeSubDomains; preload
      access-control-allow-origin: *
      x-cache: CONFIG_NOCACHE
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: A1BD8AAE68B54BB5A4A4C7427D752C6F Ref B: LON04EDGE0916 Ref C: 2024-07-10T04:04:36Z
      date: Wed, 10 Jul 2024 04:04:36 GMT
    • flag-us
      DNS
      8.8.8.8.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      8.8.8.8.in-addr.arpa
      IN PTR
      Response
      8.8.8.8.in-addr.arpa
      IN PTR
      dnsgoogle
    • flag-us
      DNS
      73.31.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      73.31.126.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      237.197.79.204.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      237.197.79.204.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      172.214.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.214.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      23.236.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      23.236.111.52.in-addr.arpa
      IN PTR
      Response
    • 204.79.197.237:443
      https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=6e53dfd349f84c578f9b093a37a793ae&localId=w:02CFF369-7177-605D-73C2-BA4DB418EA60&deviceId=6896204246996124&anid=
      tls, http2
      2.0kB
       9.3kB
       22
      19

      HTTP Request

      GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=6e53dfd349f84c578f9b093a37a793ae&localId=w:02CFF369-7177-605D-73C2-BA4DB418EA60&deviceId=6896204246996124&anid=

      HTTP Response

      204

      HTTP Request

      GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=6e53dfd349f84c578f9b093a37a793ae&localId=w:02CFF369-7177-605D-73C2-BA4DB418EA60&deviceId=6896204246996124&anid=

      HTTP Response

      204

      HTTP Request

      GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=6e53dfd349f84c578f9b093a37a793ae&localId=w:02CFF369-7177-605D-73C2-BA4DB418EA60&deviceId=6896204246996124&anid=

      HTTP Response

      204
    • 8.8.8.8:53
      g.bing.com
      dns
      56 B
       151 B
       1
      1

      DNS Request

      g.bing.com

      DNS Response

      204.79.197.237
      13.107.21.237

    • 8.8.8.8:53
      8.8.8.8.in-addr.arpa
      dns
      66 B
       90 B
       1
      1

      DNS Request

      8.8.8.8.in-addr.arpa

    • 8.8.8.8:53
      73.31.126.40.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      73.31.126.40.in-addr.arpa

    • 8.8.8.8:53
      237.197.79.204.in-addr.arpa
      dns
      73 B
       143 B
       1
      1

      DNS Request

      237.197.79.204.in-addr.arpa

    • 8.8.8.8:53
      172.214.232.199.in-addr.arpa
      dns
      74 B
       128 B
       1
      1

      DNS Request

      172.214.232.199.in-addr.arpa

    • 8.8.8.8:53
      23.236.111.52.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      23.236.111.52.in-addr.arpa

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.