Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

BetterFold...er.dll

windows10-2004-x64

1

CeleryApp.exe

windows10-2004-x64

1

CeleryIn.dll

windows10-2004-x64

1

CeleryInject.exe

windows10-2004-x64

8

Costura.dll

windows10-2004-x64

1

Dragablz.dll

windows10-2004-x64

1

MaterialDe...rs.dll

windows10-2004-x64

1

MaterialDe...ns.dll

windows10-2004-x64

1

Microsoft....re.dll

windows10-2004-x64

1

Microsoft....ms.dll

windows10-2004-x64

1

Microsoft....pf.dll

windows10-2004-x64

1

Microsoft....rs.dll

windows10-2004-x64

1

System.Dia...ce.dll

windows10-2004-x64

1

bin/Monaco/index.html

windows10-2004-x64

3

bin/Monaco...ain.js

windows10-2004-x64

3

bin/Monaco...tes.js

windows10-2004-x64

3

bin/Monaco...ase.js

windows10-2004-x64

3

bin/Monaco...ses.js

windows10-2004-x64

3

bin/Monaco...del.js

windows10-2004-x64

3

bin/Monaco...num.js

windows10-2004-x64

3

bin/Monaco...tem.js

windows10-2004-x64

3

bin/Monaco...ums.js

windows10-2004-x64

3

bin/Monaco...nce.js

windows10-2004-x64

3

bin/Monaco...del.js

windows10-2004-x64

3

bin/Monaco...nal.js

windows10-2004-x64

3

bin/Monaco...der.js

windows10-2004-x64

3

bin/Monaco...ace.js

windows10-2004-x64

3

bin/Monaco...rnl.js

windows10-2004-x64

3

bin/Monaco...ons.js

windows10-2004-x64

3

bin/Monaco...als.js

windows10-2004-x64

3

bin/Monaco...rds.js

windows10-2004-x64

3

bin/Monaco...ing.js

windows10-2004-x64

3

Resubmissions

09/08/2024, 00:02 UTC

240809-abhm2swglc 8

08/08/2024, 23:58 UTC

240808-31lp8asfqn 4

Analysis

  • max time kernel
    125s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/08/2024, 00:02 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bin/Monaco/vs/basic-languages/lua/autocompletes/classes.js

  • Size

    33KB

  • MD5

    fabe9b3ec7774eb374f18709ab41c8c0

  • SHA1

    de6c19413ef008000357bccea90faf0d23ccf605

  • SHA256

    75418233aff9a1401f6c467f8ca20999803436bc1ebb463123d1fb94dcff1f38

  • SHA512

    d7b4a9dbfab0ec55e27b2ded86066b37ebea7d50b3b6b28f44c996f8280463176f1107c6bf15a52fb700f88ac3e0e7b87fb8a50664da9b31fc0e89a38d2055e9

  • SSDEEP

    768:EDVdzN+yYumzw/Wx5nYCH0e2zBsGMPv3lHhj4MyjKG9jn9/j7NFvHR0hT/YEkd3M:H6/W3YCUpqUDW

Score
3/10
execution

Malware Config

Signatures

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\bin\Monaco\vs\basic-languages\lua\autocompletes\classes.js
    1⤵
      PID:1396
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3668,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=4040 /prefetch:8
      1⤵
        PID:1900

      Network

      • flag-us
        DNS
        g.bing.com
        Remote address:
        8.8.8.8:53
        Request
        g.bing.com
        IN A
        Response
        g.bing.com
        IN CNAME
        g-bing-com.dual-a-0034.a-msedge.net
        g-bing-com.dual-a-0034.a-msedge.net
        IN CNAME
        dual-a-0034.a-msedge.net
        dual-a-0034.a-msedge.net
        IN A
        13.107.21.237
        dual-a-0034.a-msedge.net
        IN A
        204.79.197.237
      • flag-us
        GET
        https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=452aeefe4b0d4a8f85df8d1a30bd4c5e&localId=w:C1C7FDA1-57D8-3617-175E-F6F87939E990&deviceId=6755468654767491&anid=
        Remote address:
        13.107.21.237:443
        Request
        GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=452aeefe4b0d4a8f85df8d1a30bd4c5e&localId=w:C1C7FDA1-57D8-3617-175E-F6F87939E990&deviceId=6755468654767491&anid= HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        set-cookie: MUID=24BDA3429CBB6E1D30B8B7949D9C6FC9; domain=.bing.com; expires=Wed, 03-Sep-2025 00:03:33 GMT; path=/; SameSite=None; Secure; Priority=High;
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 2D19CFEFBA4D4374A45586C000AD54E0 Ref B: LON04EDGE0611 Ref C: 2024-08-09T00:03:33Z
        date: Fri, 09 Aug 2024 00:03:33 GMT
      • flag-us
        GET
        https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=452aeefe4b0d4a8f85df8d1a30bd4c5e&localId=w:C1C7FDA1-57D8-3617-175E-F6F87939E990&deviceId=6755468654767491&anid=
        Remote address:
        13.107.21.237:443
        Request
        GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=452aeefe4b0d4a8f85df8d1a30bd4c5e&localId=w:C1C7FDA1-57D8-3617-175E-F6F87939E990&deviceId=6755468654767491&anid= HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        cookie: MUID=24BDA3429CBB6E1D30B8B7949D9C6FC9
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        set-cookie: MSPTC=wwbaFD3qeFi_lXYzM-8w3qQKh-k_qYWD6tREZi7QSLc; domain=.bing.com; expires=Wed, 03-Sep-2025 00:03:33 GMT; path=/; Partitioned; secure; SameSite=None
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: F150DFB689E74D70BD192B73B63B10C7 Ref B: LON04EDGE0611 Ref C: 2024-08-09T00:03:33Z
        date: Fri, 09 Aug 2024 00:03:33 GMT
      • flag-us
        GET
        https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=452aeefe4b0d4a8f85df8d1a30bd4c5e&localId=w:C1C7FDA1-57D8-3617-175E-F6F87939E990&deviceId=6755468654767491&anid=
        Remote address:
        13.107.21.237:443
        Request
        GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=452aeefe4b0d4a8f85df8d1a30bd4c5e&localId=w:C1C7FDA1-57D8-3617-175E-F6F87939E990&deviceId=6755468654767491&anid= HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        cookie: MUID=24BDA3429CBB6E1D30B8B7949D9C6FC9; MSPTC=wwbaFD3qeFi_lXYzM-8w3qQKh-k_qYWD6tREZi7QSLc
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 0FDD6261485543BE8F94BF34189B0F38 Ref B: LON04EDGE0611 Ref C: 2024-08-09T00:03:34Z
        date: Fri, 09 Aug 2024 00:03:33 GMT
      • flag-us
        DNS
        8.8.8.8.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        8.8.8.8.in-addr.arpa
        IN PTR
        Response
        8.8.8.8.in-addr.arpa
        IN PTR
        dnsgoogle
      • flag-us
        DNS
        240.221.184.93.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        240.221.184.93.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        237.21.107.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        237.21.107.13.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        72.32.126.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        72.32.126.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        95.221.229.192.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        95.221.229.192.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        157.123.68.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        157.123.68.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        198.187.3.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        198.187.3.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        12.173.189.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        12.173.189.20.in-addr.arpa
        IN PTR
        Response
      • 13.107.21.237:443
        https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=452aeefe4b0d4a8f85df8d1a30bd4c5e&localId=w:C1C7FDA1-57D8-3617-175E-F6F87939E990&deviceId=6755468654767491&anid=
        tls, http2
        2.5kB
         9.4kB
         25
        20

        HTTP Request

        GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=452aeefe4b0d4a8f85df8d1a30bd4c5e&localId=w:C1C7FDA1-57D8-3617-175E-F6F87939E990&deviceId=6755468654767491&anid=

        HTTP Response

        204

        HTTP Request

        GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=452aeefe4b0d4a8f85df8d1a30bd4c5e&localId=w:C1C7FDA1-57D8-3617-175E-F6F87939E990&deviceId=6755468654767491&anid=

        HTTP Response

        204

        HTTP Request

        GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=452aeefe4b0d4a8f85df8d1a30bd4c5e&localId=w:C1C7FDA1-57D8-3617-175E-F6F87939E990&deviceId=6755468654767491&anid=

        HTTP Response

        204
      • 8.8.8.8:53
        g.bing.com
        dns
        56 B
         151 B
         1
        1

        DNS Request

        g.bing.com

        DNS Response

        13.107.21.237
        204.79.197.237

      • 8.8.8.8:53
        8.8.8.8.in-addr.arpa
        dns
        66 B
         90 B
         1
        1

        DNS Request

        8.8.8.8.in-addr.arpa

      • 8.8.8.8:53
        240.221.184.93.in-addr.arpa
        dns
        73 B
         144 B
         1
        1

        DNS Request

        240.221.184.93.in-addr.arpa

      • 8.8.8.8:53
        237.21.107.13.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        237.21.107.13.in-addr.arpa

      • 8.8.8.8:53
        72.32.126.40.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        72.32.126.40.in-addr.arpa

      • 8.8.8.8:53
        95.221.229.192.in-addr.arpa
        dns
        73 B
         144 B
         1
        1

        DNS Request

        95.221.229.192.in-addr.arpa

      • 8.8.8.8:53
        157.123.68.40.in-addr.arpa
        dns
        72 B
         146 B
         1
        1

        DNS Request

        157.123.68.40.in-addr.arpa

      • 8.8.8.8:53
        198.187.3.20.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        198.187.3.20.in-addr.arpa

      • 8.8.8.8:53
        12.173.189.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        12.173.189.20.in-addr.arpa

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.