Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

84628cf449...0N.exe

windows7-x64

7

84628cf449...0N.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    92s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/09/2024, 01:27 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    84628cf449b946858edb8b47c431ceb0N.exe

  • Size

    88KB

  • MD5

    84628cf449b946858edb8b47c431ceb0

  • SHA1

    cc2e58ad0b158334ae04c1a2e9e5737d33020692

  • SHA256

    1d7c69623517e502ad3d3215a33db87505b1858fd1eddf2e9470907152aa2678

  • SHA512

    b492c298bef271e26d2c2311a04a11c668b7d3a42247fc21a18d7205bb050312da5a3406908df11ac488b8705bc2ed5b56d9395328ca5108dd690779d5f191a2

  • SSDEEP

    1536:vj+jsMQMOtEvwDpj5HwYYTjipvF2hBfWafHNBlX:vCjsIOtEvwDpj5H9YvQd21

Score
7/10
discovery

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies system certificate store 2 TTPs 8 IoCs
    evasionspywaretrojan
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\84628cf449b946858edb8b47c431ceb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\84628cf449b946858edb8b47c431ceb0N.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2592
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      PID:644

Network

  • flag-us
    DNS
    bestccc.com
    misid.exe
    Remote address:
    8.8.8.8:53
    Request
    bestccc.com
    IN A
    Response
    bestccc.com
    IN A
    103.91.187.97
  • flag-in
    GET
    https://bestccc.com/hr/ho2.exe
    misid.exe
    Remote address:
    103.91.187.97:443
    Request
    GET /hr/ho2.exe HTTP/1.1
    Accept: text/*, application/*
    User-Agent: Updates downloader
    Host: bestccc.com
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Date: Sat, 14 Sep 2024 01:27:22 GMT
    Server: Apache/2
    Content-Length: 315
    Content-Type: text/html; charset=iso-8859-1
  • flag-us
    DNS
    58.55.71.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    58.55.71.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    0.205.248.87.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    0.205.248.87.in-addr.arpa
    IN PTR
    Response
    0.205.248.87.in-addr.arpa
    IN PTR
    https-87-248-205-0lgwllnwnet
  • flag-us
    DNS
    64.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    64.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    crl.comodoca.com
    misid.exe
    Remote address:
    8.8.8.8:53
    Request
    crl.comodoca.com
    IN A
    Response
    crl.comodoca.com
    IN CNAME
    crl.comodoca.com.cdn.cloudflare.net
    crl.comodoca.com.cdn.cloudflare.net
    IN A
    172.64.149.23
    crl.comodoca.com.cdn.cloudflare.net
    IN A
    104.18.38.233
  • flag-us
    GET
    http://crl.comodoca.com/cPanelIncCertificationAuthority.crl
    misid.exe
    Remote address:
    172.64.149.23:80
    Request
    GET /cPanelIncCertificationAuthority.crl HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/10.0
    Host: crl.comodoca.com
    Response
    HTTP/1.1 200 OK
    Date: Sat, 14 Sep 2024 01:27:35 GMT
    Content-Type: application/pkix-crl
    Content-Length: 66537
    Connection: keep-alive
    Last-Modified: Fri, 13 Sep 2024 04:33:13 GMT
    Expires: Fri, 20 Sep 2024 04:33:13 GMT
    Etag: "aecf1c3ca5b7e2cd6aba7180b8ce9b90b30a885b"
    Cache-Control: max-age=601776,s-maxage=3600,public,no-transform,must-revalidate
    X-CCACDN-Proxy-ID: mcdpinlb5
    X-Frame-Options: SAMEORIGIN
    CF-Cache-Status: HIT
    Age: 3157
    Accept-Ranges: bytes
    Server: cloudflare
    CF-RAY: 8c2c986fcf5b94e7-LHR
  • flag-us
    DNS
    97.187.91.103.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    97.187.91.103.in-addr.arpa
    IN PTR
    Response
    97.187.91.103.in-addr.arpa
    IN PTR
    1039118797-static-reversegdrnetin
  • flag-us
    DNS
    23.149.64.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    23.149.64.172.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    232.168.11.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    232.168.11.51.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    183.59.114.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    183.59.114.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    15.164.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    15.164.165.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    18.134.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.134.221.88.in-addr.arpa
    IN PTR
    Response
    18.134.221.88.in-addr.arpa
    IN PTR
    a88-221-134-18deploystaticakamaitechnologiescom
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • 103.91.187.97:443
    https://bestccc.com/hr/ho2.exe
    tls, http
    misid.exe
    1.0kB
     5.7kB
     13
    9

    HTTP Request

    GET https://bestccc.com/hr/ho2.exe

    HTTP Response

    404
  • 172.64.149.23:80
    http://crl.comodoca.com/cPanelIncCertificationAuthority.crl
    http
    misid.exe
    1.5kB
     69.1kB
     29
    52

    HTTP Request

    GET http://crl.comodoca.com/cPanelIncCertificationAuthority.crl

    HTTP Response

    200
  • 8.8.8.8:53
    bestccc.com
    dns
    misid.exe
    57 B
     73 B
     1
    1

    DNS Request

    bestccc.com

    DNS Response

    103.91.187.97

  • 8.8.8.8:53
    58.55.71.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    58.55.71.13.in-addr.arpa

  • 8.8.8.8:53
    0.205.248.87.in-addr.arpa
    dns
    71 B
     116 B
     1
    1

    DNS Request

    0.205.248.87.in-addr.arpa

  • 8.8.8.8:53
    64.159.190.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    64.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    crl.comodoca.com
    dns
    misid.exe
    62 B
     143 B
     1
    1

    DNS Request

    crl.comodoca.com

    DNS Response

    172.64.149.23
    104.18.38.233

  • 8.8.8.8:53
    97.187.91.103.in-addr.arpa
    dns
    72 B
     125 B
     1
    1

    DNS Request

    97.187.91.103.in-addr.arpa

  • 8.8.8.8:53
    23.149.64.172.in-addr.arpa
    dns
    72 B
     134 B
     1
    1

    DNS Request

    23.149.64.172.in-addr.arpa

  • 8.8.8.8:53
    232.168.11.51.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    232.168.11.51.in-addr.arpa

  • 8.8.8.8:53
    183.59.114.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    183.59.114.20.in-addr.arpa

  • 8.8.8.8:53
    15.164.165.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    15.164.165.52.in-addr.arpa

  • 8.8.8.8:53
    18.134.221.88.in-addr.arpa
    dns
    72 B
     137 B
     1
    1

    DNS Request

    18.134.221.88.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\misid.exe
    Filesize

    88KB

    MD5

    6084599515081acc9e6d038879095158

    SHA1

    5b1bef54062e0dc27fbca38b94503d9ecf00c60e

    SHA256

    35b6b05bd488ce68cd4962ddd3ae94a494033f72e752b106b421415a7cd686e3

    SHA512

    f1933340358c7872db8cdc933e4fbc53bafa79e0542f1da36a977909a32ff880718846ec349c62ed8cfd8670c6f302d04a6aec6935d3ad01afe447d322f19848

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\misids.exe
    Filesize

    315B

    MD5

    a34ac19f4afae63adc5d2f7bc970c07f

    SHA1

    a82190fc530c265aa40a045c21770d967f4767b8

    SHA256

    d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

    SHA512

    42e53d96e5961e95b7a984d9c9778a1d3bd8ee0c87b8b3b515fa31f67c2d073c8565afc2f4b962c43668c4efa1e478da9bb0ecffa79479c7e880731bc4c55765

    Download Submit

  • memory/2592-0-0x0000000000590000-0x0000000000596000-memory.dmp

    Filesize

    24KB

    Download

  • memory/2592-1-0x0000000000590000-0x0000000000596000-memory.dmp

    Filesize

    24KB

    Download

  • memory/2592-3-0x00000000005B0000-0x00000000005B6000-memory.dmp

    Filesize

    24KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.