Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

1732341067...ed.exe

windows7-x64

3

1732341067...ed.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/11/2024, 05:52 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe

  • Size

    483KB

  • MD5

    c69539e84cc2b3332174b6bbfb5e35e7

  • SHA1

    db1cec011bab82fdde6e087335908f65ad6a32df

  • SHA256

    ff7715c495b9b34a10f9cb7653b09525a194791449c055a1af94e36834b0116a

  • SHA512

    dfb8e29a68ad4be21d40eb63002f4e9468214c4098c334d676954c368e430e3af0c78cc7461922b1ccb1d7126dcac8f5cd5cc8dbf34beddf5c6004cb579907cb

  • SSDEEP

    6144:4Tz+c6KHYBhDc1RGJdv//NkUn+N5Bkf/0TELRvIZPjbsAOZZXAXkcrqT4:4TlrYw1RUh3NFn+N5WfIQIjbs/ZXVT4

Score
3/10
discovery

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    "C:\Users\Admin\AppData\Local\Temp\17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:916

Network

  • flag-us
    DNS
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    Remote address:
    8.8.8.8:53
    Request
    shilajat.duckdns.org
    IN A
    Response
    shilajat.duckdns.org
    IN A
    154.216.17.204
  • flag-us
    DNS
    228.249.119.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    228.249.119.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    136.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    136.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    217.106.137.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    217.106.137.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    149.220.183.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    149.220.183.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    56.163.245.4.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    56.163.245.4.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    241.42.69.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.42.69.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    Remote address:
    8.8.8.8:53
    Request
    shilajat.duckdns.org
    IN A
    Response
  • flag-us
    DNS
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    Remote address:
    8.8.8.8:53
    Request
    shilajat.duckdns.org
    IN A
    Response
  • flag-us
    DNS
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    Remote address:
    8.8.8.8:53
    Request
    shilajat.duckdns.org
    IN A
    Response
  • flag-us
    DNS
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    Remote address:
    8.8.8.8:53
    Request
    shilajat.duckdns.org
    IN A
    Response
    shilajat.duckdns.org
    IN A
    154.216.17.204
  • flag-us
    DNS
    18.31.95.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.31.95.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    Remote address:
    8.8.8.8:53
    Request
    shilajat.duckdns.org
    IN A
    Response
    shilajat.duckdns.org
    IN A
    154.216.17.204
  • flag-us
    DNS
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    Remote address:
    8.8.8.8:53
    Request
    shilajat.duckdns.org
    IN A
    Response
    shilajat.duckdns.org
    IN A
    154.216.17.204
  • flag-us
    DNS
    2.36.159.162.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    2.36.159.162.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    18.31.95.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.31.95.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    92.12.20.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    92.12.20.2.in-addr.arpa
    IN PTR
    Response
    92.12.20.2.in-addr.arpa
    IN PTR
    a2-20-12-92deploystaticakamaitechnologiescom
  • flag-us
    DNS
    22.236.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    22.236.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    Remote address:
    8.8.8.8:53
    Request
    shilajat.duckdns.org
    IN A
    Response
    shilajat.duckdns.org
    IN A
    154.216.17.204
  • 154.216.17.204:2405
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    260 B
     200 B
     5
    5
  • 154.216.17.204:2405
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    260 B
     200 B
     5
    5
  • 154.216.17.204:2405
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    260 B
     200 B
     5
    5
  • 154.216.17.204:2405
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    260 B
     200 B
     5
    5
  • 154.216.17.204:2405
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    260 B
     200 B
     5
    5
  • 154.216.17.204:2405
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    260 B
     200 B
     5
    5
  • 154.216.17.204:2405
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    260 B
     200 B
     5
    5
  • 154.216.17.204:2405
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    260 B
     200 B
     5
    5
  • 154.216.17.204:2405
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    260 B
     200 B
     5
    5
  • 154.216.17.204:2405
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    260 B
     200 B
     5
    5
  • 154.216.17.204:2405
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    260 B
     200 B
     5
    5
  • 154.216.17.204:2405
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    260 B
     200 B
     5
    5
  • 154.216.17.204:2405
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    260 B
     200 B
     5
    5
  • 154.216.17.204:2405
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    260 B
     200 B
     5
    5
  • 154.216.17.204:2405
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    260 B
     160 B
     5
    4
  • 154.216.17.204:2405
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    260 B
     200 B
     5
    5
  • 154.216.17.204:2405
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    260 B
     200 B
     5
    5
  • 154.216.17.204:2405
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    260 B
     200 B
     5
    5
  • 154.216.17.204:2405
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    260 B
     200 B
     5
    5
  • 154.216.17.204:2405
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    260 B
     200 B
     5
    5
  • 154.216.17.204:2405
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    260 B
     200 B
     5
    5
  • 154.216.17.204:2405
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    260 B
     200 B
     5
    5
  • 154.216.17.204:2405
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    260 B
     200 B
     5
    5
  • 154.216.17.204:2405
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    260 B
     200 B
     5
    5
  • 154.216.17.204:2405
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    260 B
     200 B
     5
    5
  • 154.216.17.204:2405
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    260 B
     200 B
     5
    5
  • 154.216.17.204:2405
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    260 B
     200 B
     5
    5
  • 154.216.17.204:2405
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    260 B
     200 B
     5
    5
  • 154.216.17.204:2405
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    260 B
     200 B
     5
    5
  • 154.216.17.204:2405
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    260 B
     200 B
     5
    5
  • 154.216.17.204:2405
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    260 B
     200 B
     5
    5
  • 154.216.17.204:2405
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    260 B
     200 B
     5
    5
  • 154.216.17.204:2405
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    260 B
     200 B
     5
    5
  • 154.216.17.204:2405
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    260 B
     200 B
     5
    5
  • 154.216.17.204:2405
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    260 B
     200 B
     5
    5
  • 154.216.17.204:2405
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    260 B
     200 B
     5
    5
  • 154.216.17.204:2405
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    260 B
     200 B
     5
    5
  • 154.216.17.204:2405
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    260 B
     200 B
     5
    5
  • 154.216.17.204:2405
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    260 B
     200 B
     5
    5
  • 154.216.17.204:2405
    shilajat.duckdns.org
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    260 B
     200 B
     5
    5
  • 154.216.17.204:2405
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
  • 8.8.8.8:53
    shilajat.duckdns.org
    dns
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    66 B
     82 B
     1
    1

    DNS Request

    shilajat.duckdns.org

    DNS Response

    154.216.17.204

  • 8.8.8.8:53
    228.249.119.40.in-addr.arpa
    dns
    73 B
     159 B
     1
    1

    DNS Request

    228.249.119.40.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    136.32.126.40.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    136.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    217.106.137.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    217.106.137.52.in-addr.arpa

  • 8.8.8.8:53
    149.220.183.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    149.220.183.52.in-addr.arpa

  • 8.8.8.8:53
    56.163.245.4.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    56.163.245.4.in-addr.arpa

  • 8.8.8.8:53
    241.42.69.40.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    241.42.69.40.in-addr.arpa

  • 8.8.8.8:53
    shilajat.duckdns.org
    dns
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    264 B
     280 B
     4
    4

    DNS Request

    shilajat.duckdns.org

    DNS Request

    shilajat.duckdns.org

    DNS Request

    shilajat.duckdns.org

    DNS Request

    shilajat.duckdns.org

    DNS Response

    154.216.17.204

  • 8.8.8.8:53
    18.31.95.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    18.31.95.13.in-addr.arpa

  • 8.8.8.8:53
    shilajat.duckdns.org
    dns
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    132 B
     164 B
     2
    2

    DNS Request

    shilajat.duckdns.org

    DNS Request

    shilajat.duckdns.org

    DNS Response

    154.216.17.204

    DNS Response

    154.216.17.204

  • 8.8.8.8:53
    2.36.159.162.in-addr.arpa
    dns
    71 B
     133 B
     1
    1

    DNS Request

    2.36.159.162.in-addr.arpa

  • 8.8.8.8:53
    18.31.95.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    18.31.95.13.in-addr.arpa

  • 8.8.8.8:53
    92.12.20.2.in-addr.arpa
    dns
    69 B
     131 B
     1
    1

    DNS Request

    92.12.20.2.in-addr.arpa

  • 8.8.8.8:53
    22.236.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    22.236.111.52.in-addr.arpa

  • 8.8.8.8:53
    shilajat.duckdns.org
    dns
    17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe
    66 B
     82 B
     1
    1

    DNS Request

    shilajat.duckdns.org

    DNS Response

    154.216.17.204

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\chiqui\back.dat
    Filesize

    144B

    MD5

    4321610c1c15dc7a23a658eb2d111d1a

    SHA1

    eb5ab14fee58e2c7cd357e3bf5c36c81512e30ea

    SHA256

    ffb9ae5b70059672f90de9016dfca4a1512041cf63c986d3f555b46e4d4655dd

    SHA512

    77535e2456d060c2c2f7f8803c2166dc30011eaaf19bf4c8baf5512a3ddb5e0f2ea55d5c683e0677928c9028025c9d3e9821b67e70d768b5bd3e89c2232f81aa

    Download Submit

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.