Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

Bootstrap ...om.exe

windows11-21h2-x64

7

$PLUGINSDI...er.dll

windows11-21h2-x64

3

$PLUGINSDI...ls.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...ll.dll

windows11-21h2-x64

3

Bootstrap Studio.exe

windows11-21h2-x64

4

LICENSES.c...m.html

windows11-21h2-x64

3

d3dcompiler_47.dll

windows11-21h2-x64

1

ffmpeg.dll

windows11-21h2-x64

1

libEGL.dll

windows11-21h2-x64

1

libGLESv2.dll

windows11-21h2-x64

1

resources/...trc.js

windows11-21h2-x64

3

resources/...all.js

windows11-21h2-x64

3

resources/...nel.js

windows11-21h2-x64

3

resources/...ent.js

windows11-21h2-x64

3

resources/...ent.js

windows11-21h2-x64

3

resources/...nts.js

windows11-21h2-x64

3

resources/...dex.js

windows11-21h2-x64

3

resources/...col.js

windows11-21h2-x64

3

resources/...FTP.js

windows11-21h2-x64

3

resources/...nts.js

windows11-21h2-x64

3

resources/...pto.js

windows11-21h2-x64

3

resources/...o.node

windows11-21h2-x64

3

resources/...305.js

windows11-21h2-x64

3

resources/...ers.js

windows11-21h2-x64

3

resources/...isc.js

windows11-21h2-x64

3

$PLUGINSDI...ec.dll

windows11-21h2-x64

3

$PLUGINSDI...7z.dll

windows11-21h2-x64

3

$R0/Uninst...io.exe

windows11-21h2-x64

7

Bootstrap ...en.exe

windows11-21h2-x64

7

Bootstrap ..._1.dll

windows11-21h2-x64

3

Bootstrap ..._1.dll

windows11-21h2-x64

3

Resubmissions

01/09/2024, 14:15 UTC

240901-rkpldssgrl 7

Analysis

  • max time kernel
    210s
  • max time network
    293s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    01/09/2024, 14:15 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    resources/app.asar.unpacked/node_modules/ssh2/lib/protocol/SFTP.js

  • Size

    106KB

  • MD5

    a5073ccbd57ae415f4bbf164cb8060e7

  • SHA1

    4ce3c58cf87d962bb20de42299f67f6a36e6c867

  • SHA256

    9969e72b877c21bd17234f2084fa26575365b9a516951173d645a7802c43e12f

  • SHA512

    f3aa697a43cc8a507a657020685acf1a1b03a44c1c7bebb2d279804ab49dbebb3282d4facc4541b2fd982b98c40962a765dec1c80d37d9460918d8a89b722ded

  • SSDEEP

    768:u3ot3ZieCIWlpWH+n87niAVJ4UW0UWRKWFWWLoU6WkFWN+GWk0WfBW1WW3kWuhWM:u3+NCMMs9xiiF+EKNBezyr4m7w

Score
3/10
execution

Malware Config

Signatures

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\ssh2\lib\protocol\SFTP.js
    1⤵
      PID:1436

    Network

    • flag-us
      DNS
      31.243.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      31.243.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      14.179.89.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      14.179.89.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      14.179.89.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      14.179.89.13.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      ctldl.windowsupdate.com
      Remote address:
      8.8.8.8:53
      Request
      ctldl.windowsupdate.com
      IN A
      Response
      ctldl.windowsupdate.com
      IN CNAME
      ctldl.windowsupdate.com.delivery.microsoft.com
      ctldl.windowsupdate.com.delivery.microsoft.com
      IN CNAME
      wu-b-net.trafficmanager.net
      wu-b-net.trafficmanager.net
      IN CNAME
      download.windowsupdate.com.edgesuite.net
      download.windowsupdate.com.edgesuite.net
      IN CNAME
      a767.dspw65.akamai.net
      a767.dspw65.akamai.net
      IN A
      2.18.190.79
      a767.dspw65.akamai.net
      IN A
      2.18.190.77
    • flag-us
      DNS
      ctldl.windowsupdate.com
      Remote address:
      8.8.8.8:53
      Request
      ctldl.windowsupdate.com
      IN A
    • flag-us
      DNS
      79.190.18.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      79.190.18.2.in-addr.arpa
      IN PTR
      Response
      79.190.18.2.in-addr.arpa
      IN PTR
      a2-18-190-79deploystaticakamaitechnologiescom
    No results found
    • 8.8.8.8:53
      31.243.111.52.in-addr.arpa
      dns
      214 B
       303 B
       3
      2

      DNS Request

      31.243.111.52.in-addr.arpa

      DNS Request

      14.179.89.13.in-addr.arpa

      DNS Request

      14.179.89.13.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      211 B
       427 B
       3
      2

      DNS Request

      95.221.229.192.in-addr.arpa

      DNS Request

      ctldl.windowsupdate.com

      DNS Request

      ctldl.windowsupdate.com

      DNS Response

      2.18.190.79
      2.18.190.77

    • 8.8.8.8:53
      79.190.18.2.in-addr.arpa
      dns
      70 B
       133 B
       1
      1

      DNS Request

      79.190.18.2.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.