Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

921ee075a6...4N.exe

windows7-x64

10

921ee075a6...4N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/09/2024, 22:23 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    921ee075a6f01559ad1716254bd4865469be6e0ea53fb5a6d2e538818fcca9f4N.exe

  • Size

    76KB

  • MD5

    01bbe0af85d40da5f55fea2928f25650

  • SHA1

    5c90611c1fd08aec1a9662d6291fba653b0c72de

  • SHA256

    921ee075a6f01559ad1716254bd4865469be6e0ea53fb5a6d2e538818fcca9f4

  • SHA512

    d7e91b29f9b312ea124ec8690f863b4f3e366653886d03c346364302fcea4564d52a30cab014af069a9b0e6fc6d352468039d60cfb394845b16ab1396826b21b

  • SSDEEP

    768:Xb6VvcTMnY+1j4I4SccFhqmvdgxXGcZDxc7mdKnI/:X4nV1U2c+qHhPZDW

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\921ee075a6f01559ad1716254bd4865469be6e0ea53fb5a6d2e538818fcca9f4N.exe
    "C:\Users\Admin\AppData\Local\Temp\921ee075a6f01559ad1716254bd4865469be6e0ea53fb5a6d2e538818fcca9f4N.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2240
    • C:\Users\Admin\Admin.exe
      "C:\Users\Admin\Admin.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:4072

Network

  • flag-us
    DNS
    209.205.72.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    209.205.72.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    ns1.theimageparlour.net
    921ee075a6f01559ad1716254bd4865469be6e0ea53fb5a6d2e538818fcca9f4N.exe
    Remote address:
    8.8.8.8:53
    Request
    ns1.theimageparlour.net
    IN A
    Response
    ns1.theimageparlour.net
    IN A
    206.189.185.75
  • flag-us
    DNS
    17.160.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    17.160.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    28.118.140.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    28.118.140.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    86.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    86.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    15.164.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    15.164.165.52.in-addr.arpa
    IN PTR
    Response
No results found
  • 8.8.8.8:53
    209.205.72.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    209.205.72.20.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    ns1.theimageparlour.net
    dns
    921ee075a6f01559ad1716254bd4865469be6e0ea53fb5a6d2e538818fcca9f4N.exe
    69 B
     85 B
     1
    1

    DNS Request

    ns1.theimageparlour.net

    DNS Response

    206.189.185.75

  • 8.8.8.8:53
    17.160.190.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    17.160.190.20.in-addr.arpa

  • 8.8.8.8:53
    28.118.140.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    28.118.140.52.in-addr.arpa

  • 8.8.8.8:53
    86.23.85.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    86.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    15.164.165.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    15.164.165.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\Admin.exe
    Filesize

    76KB

    MD5

    0cd61e58fc9edcd251ccd07cbfcce6f7

    SHA1

    f46bf54e643337226e751f7dd30f6931483ed97b

    SHA256

    5743fd9f1ee7fddbe81be6c84c61858c8b8db4a0202c12daaab7c97007d9c47e

    SHA512

    751fb66dc1507de1fa0c3baa583cad6458248fa4a273c984d6d956c2ebfe251287f5c07973036b08a7120722bb6c98c8603d536f9a119a47df7f800ddb9568b6

    Download Submit

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.