Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

45042eccc4...18.exe

windows7-x64

7

45042eccc4...18.exe

windows10-2004-x64

7

$PLUGINSDI...ub.exe

windows7-x64

7

$PLUGINSDI...ub.exe

windows10-2004-x64

7

$PLUGINSDI...RL.dll

windows7-x64

3

$PLUGINSDI...RL.dll

windows10-2004-x64

3

$PLUGINSDI...se.dll

windows7-x64

3

$PLUGINSDI...se.dll

windows10-2004-x64

3

$PLUGINSDI...se.rtf

windows7-x64

4

$PLUGINSDI...se.rtf

windows10-2004-x64

1

$PLUGINSDI...on.dll

windows7-x64

3

$PLUGINSDI...on.dll

windows10-2004-x64

3

$PLUGINSDIR/Math.dll

windows7-x64

3

$PLUGINSDIR/Math.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...fo.dll

windows7-x64

3

$PLUGINSDI...fo.dll

windows10-2004-x64

3

$PLUGINSDI...se.rtf

windows7-x64

4

$PLUGINSDI...se.rtf

windows10-2004-x64

1

$PLUGINSDI...se.rtf

windows7-x64

4

$PLUGINSDI...se.rtf

windows10-2004-x64

1

$PLUGINSDI...se.rtf

windows7-x64

4

$PLUGINSDI...se.rtf

windows10-2004-x64

1

$PLUGINSDI...ib.dll

windows7-x64

3

$PLUGINSDI...ib.dll

windows10-2004-x64

3

$PLUGINSDI...se.rtf

windows7-x64

4

$PLUGINSDI...se.rtf

windows10-2004-x64

1

$PLUGINSDI...br.rtf

windows7-x64

4

$PLUGINSDI...br.rtf

windows10-2004-x64

1

$PLUGINSDI...pw.rtf

windows7-x64

4

$PLUGINSDI...pw.rtf

windows10-2004-x64

1

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/07/2024, 08:17 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    $PLUGINSDIR/CustomLicense.dll

  • Size

    4KB

  • MD5

    ca37f2747e04ae09ae9f14852574abef

  • SHA1

    e40bf34907337340520f368575c848ddb62f98c5

  • SHA256

    bbcab5c7e9f4b3f63184b23995e5b335a1c6ca5108aaa1be0eaf3fbf78afc1c4

  • SHA512

    ea781e646313bc458fba0ce66e357818725f385cb6c3383bb9c41dbb5221a6f43e3d8296aa3cbd5e8759d95d87a8eefa5f87665912fbc65c8eb4efcacabfdb60

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\CustomLicense.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3840
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\CustomLicense.dll,#1
      2⤵
        PID:3600
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3600 -s 600
          3⤵
          • Program crash
          PID:3320
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3600 -ip 3600
      1⤵
        PID:4888

      Network

      • flag-us
        DNS
        g.bing.com
        Remote address:
        8.8.8.8:53
        Request
        g.bing.com
        IN A
        Response
        g.bing.com
        IN CNAME
        g-bing-com.dual-a-0034.a-msedge.net
        g-bing-com.dual-a-0034.a-msedge.net
        IN CNAME
        dual-a-0034.a-msedge.net
        dual-a-0034.a-msedge.net
        IN A
        204.79.197.237
        dual-a-0034.a-msedge.net
        IN A
        13.107.21.237
      • flag-us
        GET
        https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=b5798d45570740ceab8c869c52c16215&localId=w:5E455798-4EFE-C2ED-DBE1-D53A409DAB3B&deviceId=6755471838261800&anid=
        Remote address:
        204.79.197.237:443
        Request
        GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=b5798d45570740ceab8c869c52c16215&localId=w:5E455798-4EFE-C2ED-DBE1-D53A409DAB3B&deviceId=6755471838261800&anid= HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        set-cookie: MUID=0E2DB1F9873F66D6070CA545861867DC; domain=.bing.com; expires=Fri, 08-Aug-2025 08:18:05 GMT; path=/; SameSite=None; Secure; Priority=High;
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: A15EBE89A394416DA80005F215688B96 Ref B: LON04EDGE0706 Ref C: 2024-07-14T08:18:05Z
        date: Sun, 14 Jul 2024 08:18:05 GMT
      • flag-us
        GET
        https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=b5798d45570740ceab8c869c52c16215&localId=w:5E455798-4EFE-C2ED-DBE1-D53A409DAB3B&deviceId=6755471838261800&anid=
        Remote address:
        204.79.197.237:443
        Request
        GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=b5798d45570740ceab8c869c52c16215&localId=w:5E455798-4EFE-C2ED-DBE1-D53A409DAB3B&deviceId=6755471838261800&anid= HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        cookie: MUID=0E2DB1F9873F66D6070CA545861867DC
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        set-cookie: MSPTC=qKe1HxyuuDCLcjJujbhdSQGX9ALGJfIgavUmp9i_0oo; domain=.bing.com; expires=Fri, 08-Aug-2025 08:18:05 GMT; path=/; Partitioned; secure; SameSite=None
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 331CA4C032CA48B0B48799F27949EEBC Ref B: LON04EDGE0706 Ref C: 2024-07-14T08:18:05Z
        date: Sun, 14 Jul 2024 08:18:05 GMT
      • flag-us
        GET
        https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=b5798d45570740ceab8c869c52c16215&localId=w:5E455798-4EFE-C2ED-DBE1-D53A409DAB3B&deviceId=6755471838261800&anid=
        Remote address:
        204.79.197.237:443
        Request
        GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=b5798d45570740ceab8c869c52c16215&localId=w:5E455798-4EFE-C2ED-DBE1-D53A409DAB3B&deviceId=6755471838261800&anid= HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        cookie: MUID=0E2DB1F9873F66D6070CA545861867DC; MSPTC=qKe1HxyuuDCLcjJujbhdSQGX9ALGJfIgavUmp9i_0oo
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: FDFFA8C1C7C5447AA6EE227F6AD34AC8 Ref B: LON04EDGE0706 Ref C: 2024-07-14T08:18:05Z
        date: Sun, 14 Jul 2024 08:18:05 GMT
      • flag-us
        DNS
        237.197.79.204.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        237.197.79.204.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        237.197.79.204.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        237.197.79.204.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        83.210.23.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        83.210.23.2.in-addr.arpa
        IN PTR
        Response
        83.210.23.2.in-addr.arpa
        IN PTR
        a2-23-210-83deploystaticakamaitechnologiescom
      • flag-us
        DNS
        83.210.23.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        83.210.23.2.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        75.159.190.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        75.159.190.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        26.165.165.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        26.165.165.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        206.23.85.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        206.23.85.13.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        240.221.184.93.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        240.221.184.93.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        101.58.20.217.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        101.58.20.217.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        101.58.20.217.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        101.58.20.217.in-addr.arpa
        IN PTR
      • 204.79.197.237:443
        https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=b5798d45570740ceab8c869c52c16215&localId=w:5E455798-4EFE-C2ED-DBE1-D53A409DAB3B&deviceId=6755471838261800&anid=
        tls, http2
        2.0kB
         9.3kB
         21
        19

        HTTP Request

        GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=b5798d45570740ceab8c869c52c16215&localId=w:5E455798-4EFE-C2ED-DBE1-D53A409DAB3B&deviceId=6755471838261800&anid=

        HTTP Response

        204

        HTTP Request

        GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=b5798d45570740ceab8c869c52c16215&localId=w:5E455798-4EFE-C2ED-DBE1-D53A409DAB3B&deviceId=6755471838261800&anid=

        HTTP Response

        204

        HTTP Request

        GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=b5798d45570740ceab8c869c52c16215&localId=w:5E455798-4EFE-C2ED-DBE1-D53A409DAB3B&deviceId=6755471838261800&anid=

        HTTP Response

        204
      • 8.8.8.8:53
        g.bing.com
        dns
        56 B
         151 B
         1
        1

        DNS Request

        g.bing.com

        DNS Response

        204.79.197.237
        13.107.21.237

      • 8.8.8.8:53
        237.197.79.204.in-addr.arpa
        dns
        146 B
         143 B
         2
        1

        DNS Request

        237.197.79.204.in-addr.arpa

        DNS Request

        237.197.79.204.in-addr.arpa

      • 8.8.8.8:53
        83.210.23.2.in-addr.arpa
        dns
        140 B
         133 B
         2
        1

        DNS Request

        83.210.23.2.in-addr.arpa

        DNS Request

        83.210.23.2.in-addr.arpa

      • 8.8.8.8:53
        75.159.190.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        75.159.190.20.in-addr.arpa

      • 8.8.8.8:53
        26.165.165.52.in-addr.arpa
        dns
        72 B
         146 B
         1
        1

        DNS Request

        26.165.165.52.in-addr.arpa

      • 8.8.8.8:53
        206.23.85.13.in-addr.arpa
        dns
        71 B
         145 B
         1
        1

        DNS Request

        206.23.85.13.in-addr.arpa

      • 8.8.8.8:53
        240.221.184.93.in-addr.arpa
        dns
        73 B
         144 B
         1
        1

        DNS Request

        240.221.184.93.in-addr.arpa

      • 8.8.8.8:53
        101.58.20.217.in-addr.arpa
        dns
        144 B
         132 B
         2
        1

        DNS Request

        101.58.20.217.in-addr.arpa

        DNS Request

        101.58.20.217.in-addr.arpa

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.