Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

5

Static

static

5

cc9e91b706...5N.exe

windows7-x64

5

cc9e91b706...5N.exe

windows10-2004-x64

5

Analysis

  • max time kernel
    91s
  • max time network
    93s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/09/2024, 05:20 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cc9e91b706e008a4cc795e6b6f4963a482804178d25aeffb53299ca48f342815N.exe

  • Size

    236KB

  • MD5

    ce75db7af438190eef5177174b95a490

  • SHA1

    500b7836b477085c8409118d2dfbc3c353780c31

  • SHA256

    cc9e91b706e008a4cc795e6b6f4963a482804178d25aeffb53299ca48f342815

  • SHA512

    b5a4c891a3e8384f119e884c936a1a1270bf4e0b9a9d5905ef2c10f6491367a08f71fdf6441a3713f52128ca373b15cae14ca94184e9592615bfa3caf9092af1

  • SSDEEP

    3072:AJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/7/FnncroP9:kwDeM7iNEkgiOb31k1ECbJ/F

Score
5/10
discoveryupx

Malware Config

Signatures

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\cc9e91b706e008a4cc795e6b6f4963a482804178d25aeffb53299ca48f342815N.exe
    "C:\Users\Admin\AppData\Local\Temp\cc9e91b706e008a4cc795e6b6f4963a482804178d25aeffb53299ca48f342815N.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:1616

Network

  • flag-us
    DNS
    58.55.71.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    58.55.71.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    83.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    83.210.23.2.in-addr.arpa
    IN PTR
    Response
    83.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-83deploystaticakamaitechnologiescom
  • flag-us
    DNS
    140.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    140.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    149.220.183.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    149.220.183.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    154.239.44.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    154.239.44.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    wecan.hasthe.technology
    cc9e91b706e008a4cc795e6b6f4963a482804178d25aeffb53299ca48f342815N.exe
    Remote address:
    8.8.8.8:53
    Request
    wecan.hasthe.technology
    IN A
    Response
    wecan.hasthe.technology
    IN A
    172.67.183.40
    wecan.hasthe.technology
    IN A
    104.21.59.199
  • flag-us
    POST
    http://wecan.hasthe.technology/upload
    cc9e91b706e008a4cc795e6b6f4963a482804178d25aeffb53299ca48f342815N.exe
    Remote address:
    172.67.183.40:80
    Request
    POST /upload HTTP/1.1
    Host: wecan.hasthe.technology
    Accept: */*
    Content-Length: 242084
    Expect: 100-continue
    Content-Type: multipart/form-data; boundary=------------------------826efc1115e90799
    Response
    HTTP/1.1 301 Moved Permanently
    Date: Fri, 27 Sep 2024 05:21:28 GMT
    Content-Type: text/html
    Content-Length: 167
    Connection: keep-alive
    Cache-Control: max-age=3600
    Expires: Fri, 27 Sep 2024 06:21:28 GMT
    Location: https://computernewb.com/collab-vm/
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LSrZ2bUeKa1YtywNSdww5L1Z3M9htb14b5WHJVznuxL6W4P2q5v352%2BL%2FD1BMYtn7anJVGdnoUKa9JxCwZpY8Y36cFq4GraDrQ35LdmPvl2%2BDQ4a7j2bcIqdzYNXqNseuZBNWQJvRqCJKA%3D%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 8c990ce6fb6dcd26-LHR
  • flag-us
    DNS
    86.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    86.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    40.183.67.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    40.183.67.172.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    198.187.3.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    198.187.3.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    wecan.hasthe.technology
    cc9e91b706e008a4cc795e6b6f4963a482804178d25aeffb53299ca48f342815N.exe
    Remote address:
    8.8.8.8:53
    Request
    wecan.hasthe.technology
    IN A
    Response
    wecan.hasthe.technology
    IN A
    172.67.183.40
    wecan.hasthe.technology
    IN A
    104.21.59.199
  • flag-us
    POST
    http://wecan.hasthe.technology/upload
    cc9e91b706e008a4cc795e6b6f4963a482804178d25aeffb53299ca48f342815N.exe
    Remote address:
    172.67.183.40:80
    Request
    POST /upload HTTP/1.1
    Host: wecan.hasthe.technology
    Accept: */*
    Content-Length: 242084
    Expect: 100-continue
    Content-Type: multipart/form-data; boundary=------------------------c19ca51c3d0f7846
    Response
    HTTP/1.1 301 Moved Permanently
    Date: Fri, 27 Sep 2024 05:21:58 GMT
    Content-Type: text/html
    Content-Length: 167
    Connection: keep-alive
    Cache-Control: max-age=3600
    Expires: Fri, 27 Sep 2024 06:21:58 GMT
    Location: https://computernewb.com/collab-vm/
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XGpIpKqFac6JIR8GJNPkV1%2Fep4%2FkGTsyrBCY%2Bd%2FX2olecN5XvPrGEFWfjULt7%2BMvJDVUEbWlo2Ad94HrQcD1RnWYgglpYjr7XF68yw5EXNoaOTNwHQLc7y3Nmwys6mBByp3IkIk7IpA75w%3D%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 8c990da4f8c2769e-LHR
  • flag-us
    DNS
    88.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.210.23.2.in-addr.arpa
    IN PTR
    Response
    88.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-88deploystaticakamaitechnologiescom
  • flag-us
    POST
    http://wecan.hasthe.technology/upload
    cc9e91b706e008a4cc795e6b6f4963a482804178d25aeffb53299ca48f342815N.exe
    Remote address:
    172.67.183.40:80
    Request
    POST /upload HTTP/1.1
    Host: wecan.hasthe.technology
    Accept: */*
    Content-Length: 242084
    Expect: 100-continue
    Content-Type: multipart/form-data; boundary=------------------------577a95d727a56ae4
    Response
    HTTP/1.1 301 Moved Permanently
    Date: Fri, 27 Sep 2024 05:22:29 GMT
    Content-Type: text/html
    Content-Length: 167
    Connection: keep-alive
    Cache-Control: max-age=3600
    Expires: Fri, 27 Sep 2024 06:22:29 GMT
    Location: https://computernewb.com/collab-vm/
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bS62GX2yAVmyiGfaA4bjSe474FNzEoEXE7WMEKkwElzKGN8R4j0zqJ8%2FiTdOOkISZ1SmxcYXnqezOjVtzdoLLFcNY5%2FlmCFQr5Zf%2B7tphFdEG4PcN%2F5f3ijdfz7ne8oORMJkYpW%2B7joXyQ%3D%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 8c990e62d93e52f1-LHR
  • 172.67.183.40:80
    http://wecan.hasthe.technology/upload
    http
    cc9e91b706e008a4cc795e6b6f4963a482804178d25aeffb53299ca48f342815N.exe
    250.1kB
     6.3kB
     195
    137

    HTTP Request

    POST http://wecan.hasthe.technology/upload

    HTTP Response

    301
  • 172.67.183.40:80
    http://wecan.hasthe.technology/upload
    http
    cc9e91b706e008a4cc795e6b6f4963a482804178d25aeffb53299ca48f342815N.exe
    250.1kB
     7.7kB
     195
    170

    HTTP Request

    POST http://wecan.hasthe.technology/upload

    HTTP Response

    301
  • 172.67.183.40:80
    http://wecan.hasthe.technology/upload
    http
    cc9e91b706e008a4cc795e6b6f4963a482804178d25aeffb53299ca48f342815N.exe
    250.1kB
     3.3kB
     195
    60

    HTTP Request

    POST http://wecan.hasthe.technology/upload

    HTTP Response

    301
  • 8.8.8.8:53
    58.55.71.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    58.55.71.13.in-addr.arpa

  • 8.8.8.8:53
    83.210.23.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    83.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    140.32.126.40.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    140.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    149.220.183.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    149.220.183.52.in-addr.arpa

  • 8.8.8.8:53
    154.239.44.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    154.239.44.20.in-addr.arpa

  • 8.8.8.8:53
    wecan.hasthe.technology
    dns
    cc9e91b706e008a4cc795e6b6f4963a482804178d25aeffb53299ca48f342815N.exe
    69 B
     101 B
     1
    1

    DNS Request

    wecan.hasthe.technology

    DNS Response

    172.67.183.40
    104.21.59.199

  • 8.8.8.8:53
    86.23.85.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    86.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    40.183.67.172.in-addr.arpa
    dns
    72 B
     134 B
     1
    1

    DNS Request

    40.183.67.172.in-addr.arpa

  • 8.8.8.8:53
    198.187.3.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    198.187.3.20.in-addr.arpa

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.214.232.199.in-addr.arpa

  • 8.8.8.8:53
    wecan.hasthe.technology
    dns
    cc9e91b706e008a4cc795e6b6f4963a482804178d25aeffb53299ca48f342815N.exe
    69 B
     101 B
     1
    1

    DNS Request

    wecan.hasthe.technology

    DNS Response

    172.67.183.40
    104.21.59.199

  • 8.8.8.8:53
    88.210.23.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    88.210.23.2.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\rifaien2-4HBhfLgirlqQOrzB.exe
    Filesize

    236KB

    MD5

    ebd3aa1b6c02f773921506e0d10115e0

    SHA1

    2d6e1375c3d93b0e84c60f916cd13d38d17d5dec

    SHA256

    97f438051859c1e51d0fe05d058e5ed996e80da3b19ccfa9eeaf0bec2355b551

    SHA512

    171b5c5487f43015ab05868cbaf26682a68cec4397f7b35291f0f20b00eb68ede4117c245e2630ab5d8b4afb9fbceb7bde05d92b9b9c4f653966ccf56716876a

    Download Submit

  • memory/1616-0-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

    Download

  • memory/1616-1-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.