Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
110s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
01/10/2024, 22:58 UTC
General
-
Target
d6e0b6fcc83c9d387705a4c53f84b2a8cde4db3a874ab8713814a0fa61f02e80N.exe
-
Size
83KB
-
MD5
91afe7a56d198c2a8234e1fd9b61d490
-
SHA1
7a5201d01c063d5ea760e9df62c67a952c0e4100
-
SHA256
d6e0b6fcc83c9d387705a4c53f84b2a8cde4db3a874ab8713814a0fa61f02e80
-
SHA512
7cf20499dceeb4529afe5ebdf6a21d8548b0152047c7c9301943ae62148a98b9ef1401bb6058ee7c7e940ecd6529f1b2beb63641522105d410cee625aee6ee47
-
SSDEEP
1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+OK:LJ0TAz6Mte4A+aaZx8EnCGVuO
Score
5/10
Malware Config
Signatures
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6e0b6fcc83c9d387705a4c53f84b2a8cde4db3a874ab8713814a0fa61f02e80N.exe"C:\Users\Admin\AppData\Local\Temp\d6e0b6fcc83c9d387705a4c53f84b2a8cde4db3a874ab8713814a0fa61f02e80N.exe"1⤵
- System Location Discovery: System Language Discovery
Network
-
DNS58.55.71.13.in-addr.arpaRemote address:8.8.8.8:53Request58.55.71.13.in-addr.arpaIN PTRResponse -
DNS172.214.232.199.in-addr.arpaRemote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
DNS20.160.190.20.in-addr.arpaRemote address:8.8.8.8:53Request20.160.190.20.in-addr.arpaIN PTRResponse
-
DNS232.168.11.51.in-addr.arpaRemote address:8.8.8.8:53Request232.168.11.51.in-addr.arpaIN PTRResponse
-
DNSwecan.hasthe.technologyRemote address:8.8.8.8:53Requestwecan.hasthe.technologyIN AResponsewecan.hasthe.technologyIN A172.67.183.40wecan.hasthe.technologyIN A104.21.59.199
-
POSThttp://wecan.hasthe.technology/uploadRemote address:172.67.183.40:80RequestPOST /upload HTTP/1.1
Host: wecan.hasthe.technology
Accept: */*
Content-Length: 85412
Expect: 100-continue
Content-Type: multipart/form-data; boundary=------------------------6faf0cf85b8e9078
ResponseHTTP/1.1 301 Moved Permanently
Date: Tue, 01 Oct 2024 22:59:27 GMT
Content-Type: text/html
Content-Length: 167
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Tue, 01 Oct 2024 23:59:27 GMT
Location: https://computernewb.com/collab-vm/
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cHtymbNgYDIT9kZxhaMch1Cw%2Bq8bve4EiDnfD%2FA3dyv1gQKbwJI8svLqOr8R%2BGNXummCva6q9HOb4GTptsjMy6GP4hWJq78Wjm%2BcU5Uw9ksxigQBAB0EIDKE8PxuzFNluTbvTih393wPhA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8cc0102d9bb563e2-LHR
-
DNS86.23.85.13.in-addr.arpaRemote address:8.8.8.8:53Request86.23.85.13.in-addr.arpaIN PTRResponse
-
DNS40.183.67.172.in-addr.arpaRemote address:8.8.8.8:53Request40.183.67.172.in-addr.arpaIN PTRResponse
-
DNS206.23.85.13.in-addr.arpaRemote address:8.8.8.8:53Request206.23.85.13.in-addr.arpaIN PTRResponse
-
DNS68.209.201.84.in-addr.arpaRemote address:8.8.8.8:53Request68.209.201.84.in-addr.arpaIN PTRResponse
-
POSThttp://wecan.hasthe.technology/uploadRemote address:172.67.183.40:80RequestPOST /upload HTTP/1.1
Host: wecan.hasthe.technology
Accept: */*
Content-Length: 85412
Expect: 100-continue
Content-Type: multipart/form-data; boundary=------------------------2b45e3af0fbc0829
ResponseHTTP/1.1 301 Moved Permanently
Date: Tue, 01 Oct 2024 22:59:57 GMT
Content-Type: text/html
Content-Length: 167
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Tue, 01 Oct 2024 23:59:57 GMT
Location: https://computernewb.com/collab-vm/
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MMUGRsriucaHAzjjehPv5x9%2Bv%2B6iKG6w4S4jMjerFoGEU0veUWAg42ys6mRabc7J%2BbCH6VaXfLEdKrjNFwrspVRS99fcLBAY%2F442xhRGH5BrJdsVLxWguf55jFoDA20L2cYz%2BXdB6AvqEQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8cc010ea98e3beaf-LHR
-
POSThttp://wecan.hasthe.technology/uploadRemote address:172.67.183.40:80RequestPOST /upload HTTP/1.1
Host: wecan.hasthe.technology
Accept: */*
Content-Length: 85412
Expect: 100-continue
Content-Type: multipart/form-data; boundary=------------------------57cb4266a29a4d22
ResponseHTTP/1.1 301 Moved Permanently
Date: Tue, 01 Oct 2024 23:00:27 GMT
Content-Type: text/html
Content-Length: 167
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Wed, 02 Oct 2024 00:00:27 GMT
Location: https://computernewb.com/collab-vm/
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Bs%2FWSFwrvhkERJgGi8FEKFY0H446rKrxf9Q89FNvZqqAhrxWjuuKPoD7dsVZYfGqnDCwnaYstvYx26KilTL6nRsYpNlfLLuqMEi3GHk5U4BQsf6%2Bd6E3589qr6egA2yhzv3%2BeJldtnbREQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8cc011a7e801cda6-LHR
-
DNS48.229.111.52.in-addr.arpaRemote address:8.8.8.8:53Request48.229.111.52.in-addr.arpaIN PTRResponse
-
172.67.183.40:80http://wecan.hasthe.technology/uploadhttp
HTTP Request
POST http://wecan.hasthe.technology/uploadHTTP Response
301 -
172.67.183.40:80http://wecan.hasthe.technology/uploadhttp
HTTP Request
POST http://wecan.hasthe.technology/uploadHTTP Response
301 -
172.67.183.40:80http://wecan.hasthe.technology/uploadhttp
HTTP Request
POST http://wecan.hasthe.technology/uploadHTTP Response
301
-
8.8.8.8:5358.55.71.13.in-addr.arpadns
DNS Request
58.55.71.13.in-addr.arpa
-
8.8.8.8:53172.214.232.199.in-addr.arpadns
DNS Request
172.214.232.199.in-addr.arpa
-
8.8.8.8:5320.160.190.20.in-addr.arpadns
DNS Request
20.160.190.20.in-addr.arpa
-
8.8.8.8:53232.168.11.51.in-addr.arpadns
DNS Request
232.168.11.51.in-addr.arpa
-
8.8.8.8:53wecan.hasthe.technologydns
DNS Request
wecan.hasthe.technology
DNS Response
172.67.183.40104.21.59.199
-
8.8.8.8:5386.23.85.13.in-addr.arpadns
DNS Request
86.23.85.13.in-addr.arpa
-
8.8.8.8:5340.183.67.172.in-addr.arpadns
DNS Request
40.183.67.172.in-addr.arpa
-
8.8.8.8:53206.23.85.13.in-addr.arpadns
DNS Request
206.23.85.13.in-addr.arpa
-
8.8.8.8:5368.209.201.84.in-addr.arpadns
DNS Request
68.209.201.84.in-addr.arpa
-
8.8.8.8:5348.229.111.52.in-addr.arpadns
DNS Request
48.229.111.52.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
83KB
MD53d3ef03229a4db6db7c6308cef256a93
SHA124e8bb98e2bc57e74c0a0df5a2a7d07afa3d4e7d
SHA256d3b36583b3f982df2e6ecb0495cca2a8330dba4b4b9eeb19ace4be9cff2ece78
SHA512c9274c5214c6d666db0b25be9ea2414b8763ac7e0e7ea343a15b6d66eba1d46e7dc776647f7a20d55556a074c61480b53a21afa942d7feda998571b8a87b662f
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB