Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

5

9c0df6bb5a...0N.exe

windows7-x64

10

9c0df6bb5a...0N.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    91s
  • max time network
    97s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/09/2024, 11:40 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9c0df6bb5a583077732c10adb7c12ade664b637f4f2fcd9f05c90a5c3577d010N.exe

  • Size

    1.3MB

  • MD5

    1598e0f57e2396152ed603ff8832cb30

  • SHA1

    f7679b18051a9daf1daf683c3249c8fcb3d9d82c

  • SHA256

    9c0df6bb5a583077732c10adb7c12ade664b637f4f2fcd9f05c90a5c3577d010

  • SHA512

    57bc83847fef987d2decdf02f72f3a030032f610b1b39a10a1db0f16329ca49f972a7a0817a89493ea0654b233f08ea8b58c17a3c945b7fd0909ee15fdbbab29

  • SSDEEP

    24576:9qDEvCTbMWu7rQYlBQcBiT6rprG8aU4pjS0h/dSEAMSJGciQBIZX:9TvC/MTQYxsWR7aUES0h/hAMSJG

Score
3/10
discovery

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9c0df6bb5a583077732c10adb7c12ade664b637f4f2fcd9f05c90a5c3577d010N.exe
    "C:\Users\Admin\AppData\Local\Temp\9c0df6bb5a583077732c10adb7c12ade664b637f4f2fcd9f05c90a5c3577d010N.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1388
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\9c0df6bb5a583077732c10adb7c12ade664b637f4f2fcd9f05c90a5c3577d010N.exe"
      2⤵
        PID:4232
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1388 -s 692
        2⤵
        • Program crash
        PID:2424
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1388 -ip 1388
      1⤵
        PID:2432

      Network

      • flag-us
        DNS
        8.8.8.8.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        8.8.8.8.in-addr.arpa
        IN PTR
        Response
        8.8.8.8.in-addr.arpa
        IN PTR
        dnsgoogle
      • flag-us
        DNS
        58.55.71.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        58.55.71.13.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        172.214.232.199.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        172.214.232.199.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        95.221.229.192.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        95.221.229.192.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        75.159.190.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        75.159.190.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        154.239.44.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        154.239.44.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        50.23.12.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        50.23.12.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        50.23.12.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        50.23.12.20.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        50.23.12.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        50.23.12.20.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        18.31.95.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        18.31.95.13.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        121.170.16.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        121.170.16.2.in-addr.arpa
        IN PTR
        Response
        121.170.16.2.in-addr.arpa
        IN PTR
        a2-16-170-121deploystaticakamaitechnologiescom
      • flag-us
        DNS
        25.140.123.92.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        25.140.123.92.in-addr.arpa
        IN PTR
        Response
        25.140.123.92.in-addr.arpa
        IN PTR
        a92-123-140-25deploystaticakamaitechnologiescom
      No results found
      • 8.8.8.8:53
        8.8.8.8.in-addr.arpa
        dns
        66 B
         90 B
         1
        1

        DNS Request

        8.8.8.8.in-addr.arpa

      • 8.8.8.8:53
        58.55.71.13.in-addr.arpa
        dns
        70 B
         144 B
         1
        1

        DNS Request

        58.55.71.13.in-addr.arpa

      • 8.8.8.8:53
        172.214.232.199.in-addr.arpa
        dns
        74 B
         128 B
         1
        1

        DNS Request

        172.214.232.199.in-addr.arpa

      • 8.8.8.8:53
        95.221.229.192.in-addr.arpa
        dns
        73 B
         144 B
         1
        1

        DNS Request

        95.221.229.192.in-addr.arpa

      • 8.8.8.8:53
        75.159.190.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        75.159.190.20.in-addr.arpa

      • 8.8.8.8:53
        154.239.44.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        154.239.44.20.in-addr.arpa

      • 8.8.8.8:53
        50.23.12.20.in-addr.arpa
        dns
        210 B
         156 B
         3
        1

        DNS Request

        50.23.12.20.in-addr.arpa

        DNS Request

        50.23.12.20.in-addr.arpa

        DNS Request

        50.23.12.20.in-addr.arpa

      • 8.8.8.8:53
        18.31.95.13.in-addr.arpa
        dns
        70 B
         144 B
         1
        1

        DNS Request

        18.31.95.13.in-addr.arpa

      • 8.8.8.8:53
        121.170.16.2.in-addr.arpa
        dns
        71 B
         135 B
         1
        1

        DNS Request

        121.170.16.2.in-addr.arpa

      • 8.8.8.8:53
        25.140.123.92.in-addr.arpa
        dns
        72 B
         137 B
         1
        1

        DNS Request

        25.140.123.92.in-addr.arpa

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1388-2-0x00000000011F0000-0x00000000015F0000-memory.dmp

        Filesize

        4.0MB

        Download

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.