Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

4b48c7972a...36.exe

windows7-x64

10

4b48c7972a...36.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    19/11/2024, 18:12 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4b48c7972af7f961dbbf32fa2ed945547ed6696cafa72cd61d121eebd1d86b36.exe

  • Size

    203KB

  • MD5

    4779404dc94727cf35302f941fe8a36b

  • SHA1

    6f44727b959424451f78eb0e36dacb68c715116f

  • SHA256

    4b48c7972af7f961dbbf32fa2ed945547ed6696cafa72cd61d121eebd1d86b36

  • SHA512

    d47122823a62ecd1234cbd8d8a7d9c4fbdaebb84055c97942c5162bf0f618b6e959ebc8d4ccd7bfffb6e5135c94963328f66945f498e9f780f481c11284fd11f

  • SSDEEP

    6144:MLV6Bta6dtJmakIM5B6V2qhLyNPYTbEjA:MLV6Btpmk6M2uL4YT5

Score
10/10
nanocorediscoveryevasionkeyloggerspywarestealertrojan

Malware Config

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore
  • Nanocore family
    nanocore
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4b48c7972af7f961dbbf32fa2ed945547ed6696cafa72cd61d121eebd1d86b36.exe
    "C:\Users\Admin\AppData\Local\Temp\4b48c7972af7f961dbbf32fa2ed945547ed6696cafa72cd61d121eebd1d86b36.exe"
    1⤵
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2344
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /f /tn "WPA Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp7E73.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2172

Network

  • flag-us
    DNS
    20.ip.gl.ply.gg
    4b48c7972af7f961dbbf32fa2ed945547ed6696cafa72cd61d121eebd1d86b36.exe
    Remote address:
    8.8.8.8:53
    Request
    20.ip.gl.ply.gg
    IN A
    Response
    20.ip.gl.ply.gg
    IN A
    147.185.221.20
  • flag-us
    DNS
    20.ip.gl.ply.gg
    4b48c7972af7f961dbbf32fa2ed945547ed6696cafa72cd61d121eebd1d86b36.exe
    Remote address:
    8.8.8.8:53
    Request
    20.ip.gl.ply.gg
    IN A
  • flag-us
    DNS
    20.ip.gl.ply.gg
    4b48c7972af7f961dbbf32fa2ed945547ed6696cafa72cd61d121eebd1d86b36.exe
    Remote address:
    8.8.8.8:53
    Request
    20.ip.gl.ply.gg
    IN A
    Response
    20.ip.gl.ply.gg
    IN A
    147.185.221.20
  • flag-us
    DNS
    20.ip.gl.ply.gg
    4b48c7972af7f961dbbf32fa2ed945547ed6696cafa72cd61d121eebd1d86b36.exe
    Remote address:
    8.8.8.8:53
    Request
    20.ip.gl.ply.gg
    IN A
    Response
    20.ip.gl.ply.gg
    IN A
    147.185.221.20
  • flag-us
    DNS
    20.ip.gl.ply.gg
    4b48c7972af7f961dbbf32fa2ed945547ed6696cafa72cd61d121eebd1d86b36.exe
    Remote address:
    8.8.8.8:53
    Request
    20.ip.gl.ply.gg
    IN A
    Response
    20.ip.gl.ply.gg
    IN A
    147.185.221.20
  • flag-us
    DNS
    20.ip.gl.ply.gg
    4b48c7972af7f961dbbf32fa2ed945547ed6696cafa72cd61d121eebd1d86b36.exe
    Remote address:
    8.8.8.8:53
    Request
    20.ip.gl.ply.gg
    IN A
    Response
    20.ip.gl.ply.gg
    IN A
    147.185.221.20
  • flag-us
    DNS
    20.ip.gl.ply.gg
    4b48c7972af7f961dbbf32fa2ed945547ed6696cafa72cd61d121eebd1d86b36.exe
    Remote address:
    8.8.8.8:53
    Request
    20.ip.gl.ply.gg
    IN A
    Response
    20.ip.gl.ply.gg
    IN A
    147.185.221.20
  • 147.185.221.20:13422
    20.ip.gl.ply.gg
    4b48c7972af7f961dbbf32fa2ed945547ed6696cafa72cd61d121eebd1d86b36.exe
    152 B
     3
  • 147.185.221.20:13422
    20.ip.gl.ply.gg
    4b48c7972af7f961dbbf32fa2ed945547ed6696cafa72cd61d121eebd1d86b36.exe
    152 B
     3
  • 147.185.221.20:13422
    20.ip.gl.ply.gg
    4b48c7972af7f961dbbf32fa2ed945547ed6696cafa72cd61d121eebd1d86b36.exe
    152 B
     3
  • 127.0.0.1:13422
    4b48c7972af7f961dbbf32fa2ed945547ed6696cafa72cd61d121eebd1d86b36.exe
  • 127.0.0.1:13422
    4b48c7972af7f961dbbf32fa2ed945547ed6696cafa72cd61d121eebd1d86b36.exe
  • 127.0.0.1:13422
    4b48c7972af7f961dbbf32fa2ed945547ed6696cafa72cd61d121eebd1d86b36.exe
  • 147.185.221.20:13422
    20.ip.gl.ply.gg
    4b48c7972af7f961dbbf32fa2ed945547ed6696cafa72cd61d121eebd1d86b36.exe
    152 B
     3
  • 147.185.221.20:13422
    20.ip.gl.ply.gg
    4b48c7972af7f961dbbf32fa2ed945547ed6696cafa72cd61d121eebd1d86b36.exe
    152 B
     3
  • 147.185.221.20:13422
    20.ip.gl.ply.gg
    4b48c7972af7f961dbbf32fa2ed945547ed6696cafa72cd61d121eebd1d86b36.exe
    152 B
     3
  • 127.0.0.1:13422
    4b48c7972af7f961dbbf32fa2ed945547ed6696cafa72cd61d121eebd1d86b36.exe
  • 8.8.8.8:53
    20.ip.gl.ply.gg
    dns
    4b48c7972af7f961dbbf32fa2ed945547ed6696cafa72cd61d121eebd1d86b36.exe
    122 B
     77 B
     2
    1

    DNS Request

    20.ip.gl.ply.gg

    DNS Request

    20.ip.gl.ply.gg

    DNS Response

    147.185.221.20

  • 8.8.8.8:53
    20.ip.gl.ply.gg
    dns
    4b48c7972af7f961dbbf32fa2ed945547ed6696cafa72cd61d121eebd1d86b36.exe
    61 B
     77 B
     1
    1

    DNS Request

    20.ip.gl.ply.gg

    DNS Response

    147.185.221.20

  • 8.8.8.8:53
    20.ip.gl.ply.gg
    dns
    4b48c7972af7f961dbbf32fa2ed945547ed6696cafa72cd61d121eebd1d86b36.exe
    61 B
     77 B
     1
    1

    DNS Request

    20.ip.gl.ply.gg

    DNS Response

    147.185.221.20

  • 8.8.8.8:53
    20.ip.gl.ply.gg
    dns
    4b48c7972af7f961dbbf32fa2ed945547ed6696cafa72cd61d121eebd1d86b36.exe
    61 B
     77 B
     1
    1

    DNS Request

    20.ip.gl.ply.gg

    DNS Response

    147.185.221.20

  • 8.8.8.8:53
    20.ip.gl.ply.gg
    dns
    4b48c7972af7f961dbbf32fa2ed945547ed6696cafa72cd61d121eebd1d86b36.exe
    61 B
     77 B
     1
    1

    DNS Request

    20.ip.gl.ply.gg

    DNS Response

    147.185.221.20

  • 8.8.8.8:53
    20.ip.gl.ply.gg
    dns
    4b48c7972af7f961dbbf32fa2ed945547ed6696cafa72cd61d121eebd1d86b36.exe
    61 B
     77 B
     1
    1

    DNS Request

    20.ip.gl.ply.gg

    DNS Response

    147.185.221.20

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp7E73.tmp
    Filesize

    1KB

    MD5

    59647c1a25f103da61b26c87c40edab5

    SHA1

    929b1ab8d69d3fe92d6f33caee493c82e42418eb

    SHA256

    352a12261c77202d8bba0391d97b555c31675baec7996b7d8a86c1557c37166c

    SHA512

    e75b9f1d26c28b0c0c363ae09f5290d449c3ab4e35b8e5928c451f534c5f18cb4b3cc369f8022b8f40ee9636d6ae6abf354fab63efdc4b45aafc35f8b7e2ca1c

    Download Submit

  • memory/2344-0-0x00000000745B1000-0x00000000745B2000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2344-1-0x00000000745B0000-0x0000000074B5B000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2344-2-0x00000000745B0000-0x0000000074B5B000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2344-7-0x00000000745B0000-0x0000000074B5B000-memory.dmp

    Filesize

    5.7MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.