Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
11/09/2024, 09:10 UTC
General
-
Target
DEUSEXMKD+22Tr-LNG.exe
-
Size
4.0MB
-
MD5
d60f09f0dd451feb6dec466e505fc8a2
-
SHA1
b120849961868983a8d0441579e6bb55856ebbe7
-
SHA256
9b88f96ff05b00bff38560eb562f2d56254aa85164416a765a0fa1782b979c12
-
SHA512
72bf9b33d6e3dd1f21dfe66b6c7f65e6cd56f613f11069312185da1a68590de90443c395c3e0ef45868840af79a50a2d07bcd8145c5843931899d8302ba4113b
-
SSDEEP
49152:ubb/LKDfkvNWpiTOMxoYGQlAkxpP2vrXG6+WZpULn92zFEi2Tnsrc:uCkvLoYGQlAkxpP2vrXG6A92zFL27sw
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DEUSEXMKD+22Tr-LNG.exe"C:\Users\Admin\AppData\Local\Temp\DEUSEXMKD+22Tr-LNG.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x500 0x5101⤵
- Suspicious use of AdjustPrivilegeToken
Network
-
DNS8.8.8.8.in-addr.arpaRemote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle -
DNS28.118.140.52.in-addr.arpaRemote address:8.8.8.8:53Request28.118.140.52.in-addr.arpaIN PTRResponse
-
DNS172.214.232.199.in-addr.arpaRemote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
DNS76.32.126.40.in-addr.arpaRemote address:8.8.8.8:53Request76.32.126.40.in-addr.arpaIN PTRResponse
-
DNS58.55.71.13.in-addr.arpaRemote address:8.8.8.8:53Request58.55.71.13.in-addr.arpaIN PTRResponse
-
DNS196.249.167.52.in-addr.arpaRemote address:8.8.8.8:53Request196.249.167.52.in-addr.arpaIN PTRResponse
-
DNS50.23.12.20.in-addr.arpaRemote address:8.8.8.8:53Request50.23.12.20.in-addr.arpaIN PTRResponse
-
DNS171.39.242.20.in-addr.arpaRemote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
DNS50.139.73.23.in-addr.arpaRemote address:8.8.8.8:53Request50.139.73.23.in-addr.arpaIN PTRResponse50.139.73.23.in-addr.arpaIN PTRa23-73-139-50deploystaticakamaitechnologiescom
-
DNS81.144.22.2.in-addr.arpaRemote address:8.8.8.8:53Request81.144.22.2.in-addr.arpaIN PTRResponse81.144.22.2.in-addr.arpaIN PTRa2-22-144-81deploystaticakamaitechnologiescom
-
DNS29.243.111.52.in-addr.arpaRemote address:8.8.8.8:53Request29.243.111.52.in-addr.arpaIN PTRResponse
-
DNS67.112.168.52.in-addr.arpaRemote address:8.8.8.8:53Request67.112.168.52.in-addr.arpaIN PTRResponse
-
8.8.8.8:538.8.8.8.in-addr.arpadns
DNS Request
8.8.8.8.in-addr.arpa
-
8.8.8.8:5328.118.140.52.in-addr.arpadns
DNS Request
28.118.140.52.in-addr.arpa
-
8.8.8.8:53172.214.232.199.in-addr.arpadns
DNS Request
172.214.232.199.in-addr.arpa
-
8.8.8.8:5376.32.126.40.in-addr.arpadns
DNS Request
76.32.126.40.in-addr.arpa
-
8.8.8.8:5358.55.71.13.in-addr.arpadns
DNS Request
58.55.71.13.in-addr.arpa
-
8.8.8.8:53196.249.167.52.in-addr.arpadns
DNS Request
196.249.167.52.in-addr.arpa
-
8.8.8.8:5350.23.12.20.in-addr.arpadns
DNS Request
50.23.12.20.in-addr.arpa
-
8.8.8.8:53171.39.242.20.in-addr.arpadns
DNS Request
171.39.242.20.in-addr.arpa
-
8.8.8.8:5350.139.73.23.in-addr.arpadns
DNS Request
50.139.73.23.in-addr.arpa
-
8.8.8.8:5381.144.22.2.in-addr.arpadns
DNS Request
81.144.22.2.in-addr.arpa
-
8.8.8.8:5329.243.111.52.in-addr.arpadns
DNS Request
29.243.111.52.in-addr.arpa
-
8.8.8.8:5367.112.168.52.in-addr.arpadns
DNS Request
67.112.168.52.in-addr.arpa
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66KB
MD5c74d260d388f5ac3d95d8c1c3a27c989
SHA15da009086036004a7c670d608d5e1e923aead568
SHA256dc1bebb8ce88d59e4b3130c1ff2c4b7f5df2701c7a71b476b8a6f2ed541db628
SHA5126460db8f73806017d267c0e4e112902956a3bc53853c6a893cff66fe44772305b2c158ef8b58e993806d713aceaddcf2efa7ccf625063678444d3fd20b10546a
-
Filesize
632KB
MD5ddc305fca2a8d80523ad8bc50996480b
SHA17bee723b565267aa355ad9f7f5cf17c74f2cce1f
SHA256af9e46b70c7739547739ddfcdd56b7b218b5bda6e14c49bed3bbc08c2b867216
SHA512acf2064d1b59d73cc5086f9a8c26a5e1fb7e7909e5460d3427d7681ee36709a568146000bbea9464fb173df474c58bda4f87bbbb759ea06ed2fd71d3c6bc0eea
-
Filesize
218KB
MD582dbc53c4e057ad941eb73aba212956e
SHA138a582ce5fbe03e8c5f040d82f89b4797e305860
SHA256eda3f66eedc49ff9b9506c1ccf679a7822104c771eaab3afa367f0d6a2c9bbd5
SHA5126f8e9082750c9cc8eb7bcaf7b7442f52ec55e2b712fff29a3a22868218fbfd605b594314e7be2720fd25f5a89d95774481177429de35acb48d023d39a2767781
-
Filesize
832KB
MD56aab5c90d7c703ed4aefd5100c97fd22
SHA1b6bb0a5614da9565d5ef2a5a23aa0aaa5bd5b3f0
SHA2561b796196d9ae7b15507546d53a2b5aeae36e5b80e6291f02317f6fedab18d74a
SHA5126c1c1cc6da08f49d15f6cbbadc81bdfaa4251d9ecc9321e0de474141534b42f2bc4c4ada053ace81e07635478f945d2266466f45f9e55c3c924c974d86c26251
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
992KB
-
Filesize
10.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
648KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
4.0MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB