Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

7

ΝΕΑ Π�...DF.exe

windows7-x64

10

ΝΕΑ Π�...DF.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    126s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/09/2024, 01:30 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ΝΕΑ ΠΑΡΑΓΓΕΛΙΑ Doc_PRG211003417144356060.PDF.exe

  • Size

    617KB

  • MD5

    77e2a7eff380e6b378443b71247204b3

  • SHA1

    45150f01da24eb9bb7083470c15fbf92dccafb7f

  • SHA256

    a8f4efff89b74b63c720cff52221a7e62dc648ac40d3b2f5ab271a1e5d78b7ab

  • SHA512

    e86b836904623a77f73e52484e18a7570a16d53212dfc4f473ac5f5bf1cdefb29a32fa35496737de56143024de6e3f26c4c60a77614cfd4e9e8f1f820d34aa24

  • SSDEEP

    12288:6sHzOUNUSB/o5LsI1uwajJ5yvv1l2kNtPmB/EaR/GrYjQ6v0Uw:tiUmSB/o5d1ubcv9GlkrYsH/

Score
7/10
discoveryupx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ΝΕΑ ΠΑΡΑΓΓΕΛΙΑ Doc_PRG211003417144356060.PDF.exe
    "C:\Users\Admin\AppData\Local\Temp\ΝΕΑ ΠΑΡΑΓΓΕΛΙΑ Doc_PRG211003417144356060.PDF.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:768
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\ΝΕΑ ΠΑΡΑΓΓΕΛΙΑ Doc_PRG211003417144356060.PDF.exe"
      2⤵
        PID:1780
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 768 -s 764
        2⤵
        • Program crash
        PID:4716
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 768 -ip 768
      1⤵
        PID:4764
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4460,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:8
        1⤵
          PID:4792

        Network

        • flag-us
          DNS
          8.8.8.8.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          8.8.8.8.in-addr.arpa
          IN PTR
          Response
          8.8.8.8.in-addr.arpa
          IN PTR
          dnsgoogle
        • flag-us
          DNS
          133.211.185.52.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          133.211.185.52.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          73.144.22.2.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          73.144.22.2.in-addr.arpa
          IN PTR
          Response
          73.144.22.2.in-addr.arpa
          IN PTR
          a2-22-144-73deploystaticakamaitechnologiescom
        • flag-us
          DNS
          95.221.229.192.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          95.221.229.192.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          58.55.71.13.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          58.55.71.13.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          157.123.68.40.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          157.123.68.40.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          171.39.242.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          171.39.242.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          18.134.221.88.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          18.134.221.88.in-addr.arpa
          IN PTR
          Response
          18.134.221.88.in-addr.arpa
          IN PTR
          a88-221-134-18deploystaticakamaitechnologiescom
        • flag-us
          DNS
          19.229.111.52.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          19.229.111.52.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          81.144.22.2.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          81.144.22.2.in-addr.arpa
          IN PTR
          Response
          81.144.22.2.in-addr.arpa
          IN PTR
          a2-22-144-81deploystaticakamaitechnologiescom
        No results found
        • 8.8.8.8:53
          8.8.8.8.in-addr.arpa
          dns
          66 B
           90 B
           1
          1

          DNS Request

          8.8.8.8.in-addr.arpa

        • 8.8.8.8:53
          133.211.185.52.in-addr.arpa
          dns
          73 B
           147 B
           1
          1

          DNS Request

          133.211.185.52.in-addr.arpa

        • 8.8.8.8:53
          73.144.22.2.in-addr.arpa
          dns
          70 B
           133 B
           1
          1

          DNS Request

          73.144.22.2.in-addr.arpa

        • 8.8.8.8:53
          95.221.229.192.in-addr.arpa
          dns
          73 B
           144 B
           1
          1

          DNS Request

          95.221.229.192.in-addr.arpa

        • 8.8.8.8:53
          58.55.71.13.in-addr.arpa
          dns
          70 B
           144 B
           1
          1

          DNS Request

          58.55.71.13.in-addr.arpa

        • 8.8.8.8:53
          157.123.68.40.in-addr.arpa
          dns
          72 B
           146 B
           1
          1

          DNS Request

          157.123.68.40.in-addr.arpa

        • 8.8.8.8:53
          171.39.242.20.in-addr.arpa
          dns
          72 B
           158 B
           1
          1

          DNS Request

          171.39.242.20.in-addr.arpa

        • 8.8.8.8:53
          18.134.221.88.in-addr.arpa
          dns
          72 B
           137 B
           1
          1

          DNS Request

          18.134.221.88.in-addr.arpa

        • 8.8.8.8:53
          19.229.111.52.in-addr.arpa
          dns
          72 B
           158 B
           1
          1

          DNS Request

          19.229.111.52.in-addr.arpa

        • 8.8.8.8:53
          81.144.22.2.in-addr.arpa
          dns
          70 B
           133 B
           1
          1

          DNS Request

          81.144.22.2.in-addr.arpa

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/768-0-0x00000000000B0000-0x0000000000211000-memory.dmp

          Filesize

          1.4MB

          Download

        • memory/768-12-0x00000000035F0000-0x00000000035F4000-memory.dmp

          Filesize

          16KB

          Download

        • memory/768-13-0x00000000000B0000-0x0000000000211000-memory.dmp

          Filesize

          1.4MB

          Download

        We care about your privacy.

        This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.