Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

GrowtopiaI...2).exe

windows7-x64

6

GrowtopiaI...2).exe

windows10-2004-x64

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Growtopia.exe

windows7-x64

1

Growtopia.exe

windows10-2004-x64

1

MicrosoftE...up.exe

windows7-x64

6

MicrosoftE...up.exe

windows10-2004-x64

6

SecureEngineSDK64.dll

windows7-x64

1

SecureEngineSDK64.dll

windows10-2004-x64

1

anzu.dll

windows7-x64

1

anzu.dll

windows10-2004-x64

1

sdkencrypt...64.dll

windows7-x64

1

sdkencrypt...64.dll

windows10-2004-x64

1

steam_api64.dll

windows7-x64

1

steam_api64.dll

windows10-2004-x64

1

ubiservices.dll

windows7-x64

1

ubiservices.dll

windows10-2004-x64

1

vc_redist.x64.exe

windows7-x64

7

vc_redist.x64.exe

windows10-2004-x64

7

vc_redist.x86.exe

windows7-x64

7

vc_redist.x86.exe

windows10-2004-x64

7

zlibwapi.dll

windows7-x64

1

zlibwapi.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    95s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/08/2024, 17:36 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    vc_redist.x64.exe

  • Size

    13.9MB

  • MD5

    27b141aacc2777a82bb3fa9f6e5e5c1c

  • SHA1

    3155cb0f146b927fcc30647c1a904cd162548c8c

  • SHA256

    5eea714e1f22f1875c1cb7b1738b0c0b1f02aec5ecb95f0fdb1c5171c6cd93a3

  • SHA512

    7789eabb6dd4a159bb899d2e6d6df70addb3df239bda6f9ead8c1d2a2ac2062fce3a495814b48a3c2bec12f13800ad0703e2c61c35158b0912011b914f098011

  • SSDEEP

    393216:xTPq5dCsKSR65cX7Eyd/qnejOX3L8T8KYfU3j:VP5iw56oyleejcL8T8fc3

Score
7/10
discovery

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe
    "C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1940
    • C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe
      "C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe" -burn.unelevated BurnPipe.{5FCC7542-FF87-44A5-9136-5B7EA2F0CA9D} {CBAE236B-FB6E-42E6-99C7-5550A615E4FE} 1940
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:3120

Network

  • flag-us
    DNS
    64.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    64.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    26.165.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    26.165.165.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    18.31.95.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.31.95.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    34.56.20.217.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    34.56.20.217.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    73.144.22.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    73.144.22.2.in-addr.arpa
    IN PTR
    Response
    73.144.22.2.in-addr.arpa
    IN PTR
    a2-22-144-73deploystaticakamaitechnologiescom
  • flag-us
    DNS
    13.227.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    13.227.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    37.56.20.217.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    37.56.20.217.in-addr.arpa
    IN PTR
    Response
No results found
  • 8.8.8.8:53
    64.159.190.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    64.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    26.165.165.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    26.165.165.52.in-addr.arpa

  • 8.8.8.8:53
    18.31.95.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    18.31.95.13.in-addr.arpa

  • 8.8.8.8:53
    34.56.20.217.in-addr.arpa
    dns
    71 B
     131 B
     1
    1

    DNS Request

    34.56.20.217.in-addr.arpa

  • 8.8.8.8:53
    73.144.22.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    73.144.22.2.in-addr.arpa

  • 8.8.8.8:53
    13.227.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    13.227.111.52.in-addr.arpa

  • 8.8.8.8:53
    37.56.20.217.in-addr.arpa
    dns
    71 B
     131 B
     1
    1

    DNS Request

    37.56.20.217.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\logo.png
    Filesize

    1KB

    MD5

    d6bd210f227442b3362493d046cea233

    SHA1

    ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

    SHA256

    335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

    SHA512

    464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\wixstdba.dll
    Filesize

    118KB

    MD5

    4d20a950a3571d11236482754b4a8e76

    SHA1

    e68bd784ac143e206d52ecaf54a7e3b8d4d75c9c

    SHA256

    a9295ad4e909f979e2b6cb2b2495c3d35c8517e689cd64a918c690e17b49078b

    SHA512

    8b9243d1f9edbcbd6bdaf6874dc69c806bb29e909bd733781fde8ac80ca3fff574d786ca903871d1e856e73fd58403bebb58c9f23083ea7cd749ba3e890af3d2

    Download Submit

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.