Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10Remouse.Mi...cg.exe
windows11-21h2-x64
3SecuriteIn...dE.exe
windows11-21h2-x64
10SecuriteIn...ee.dll
windows11-21h2-x64
10SecurityTa...up.exe
windows11-21h2-x64
4Treasure.V...ox.exe
windows11-21h2-x64
3VyprVPN.exe
windows11-21h2-x64
10WSHSetup[1].exe
windows11-21h2-x64
3Yard.dll
windows11-21h2-x64
10b2bd3de3e5...2).exe
windows11-21h2-x64
10b2bd3de3e5...3).dll
windows11-21h2-x64
10b2bd3de3e5...4).dll
windows11-21h2-x64
10cd9ccf8681...f7.exe
windows11-21h2-x64
10cobaltstri...de.exe
windows11-21h2-x64
10default.exe
windows11-21h2-x64
10ec4f09f82d...d3.exe
windows11-21h2-x64
10efd97b1038...ea4.js
windows11-21h2-x64
3emotet_exe...04.exe
windows11-21h2-x64
10emotet_exe...23.exe
windows11-21h2-x64
10eupdate.exe
windows11-21h2-x64
7f4f47c67be...3f.exe
windows11-21h2-x64
10fb5d110ced...9c.exe
windows11-21h2-x64
6fee15285c3...35.exe
windows11-21h2-x64
10file(1).exe
windows11-21h2-x64
1file.exe
windows11-21h2-x64
7gjMEi6eG.exe
windows11-21h2-x64
10good.exe
windows11-21h2-x64
5hyundai st...1).exe
windows11-21h2-x64
10hyundai st...10.exe
windows11-21h2-x64
10infected d...er.exe
windows11-21h2-x64
10inps_979.xls
windows11-21h2-x64
1jar.jar
windows11-21h2-x64
10june9.dll
windows11-21h2-x64
10Resubmissions
01/03/2025, 18:58
250301-xmhhrayp15 10Analysis
-
max time kernel
444s -
max time network
449s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
04/12/2024, 11:35
Static task
static1
Behavioral task
behavioral1
Sample
Remouse.Micro.Micro.v3.5.3.serial.maker.by.aaocg.exe
Resource
win11-20241007-en
windows11-21h2-x64
windows11-21h2-x64
Behavioral task
behavioral3
Sample
SecuriteInfo.com.Generic.mg.cde56cf0169830ee.dll
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral4
Sample
SecurityTaskManager_Setup.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
Treasure.Vault.3D.Screensaver.keygen.by.Paradox.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral6
Sample
VyprVPN.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
WSHSetup[1].exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral8
Sample
Yard.dll
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb (2).exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral10
Sample
b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb (3).dll
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb (4).dll
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral12
Sample
cd9ccf8681ed1a5380f8a27cd6dc927ab719b04baa6c6583a0c793a6dc00d5f7.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
cobaltstrike_shellcode.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral14
Sample
default.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
ec4f09f82d932cdd40700a74a8875b73a783cbaab1f313286adf615a5336d7d3.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral16
Sample
efd97b1038e063779fb32a3ab35adc481679a5c6c8e3f4f69c44987ff08b6ea4.js
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
emotet_exe_e1_ef536781ae8be4b67a7fb8aa562d84994ad250d97d5606115b6f4e6e2992363f_2020-11-17__174504.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral18
Sample
emotet_exe_e3_93074e9fbde60e4182f5d763bac7762f2d4e2fcf9baf457b6f12e7696b3562c1_2020-11-17__182823.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
eupdate.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral20
Sample
f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
fb5d110ced698b06c6cb8c7112792a2d37c579dcd9bde808310cb8dc88e16d9c.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral22
Sample
fee15285c36fa7e28e28c7bb9b4cd3940ef12b9907de59d11ab6e2376416d35.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
file(1).exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral24
Sample
file.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral25
Sample
gjMEi6eG.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral26
Sample
good.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral27
Sample
hyundai steel-pipe- job 8010(1).exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral28
Sample
hyundai steel-pipe- job 8010.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral29
Sample
infected dot net installer.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral30
Sample
inps_979.xls
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral31
Sample
jar.jar
Resource
win11-20241007-en
windows11-21h2-x64
General
-
Target
f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe
-
Size
332KB
-
MD5
1e0ff1a8078820c5c10652e406d51bef
-
SHA1
e191fdbe58b527301eb4bd244a2258ba1cad0182
-
SHA256
f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f
-
SHA512
eb1a011724b988362aa52bdcb69d2886b736dbbe72fe9e53fa3530eeec6bb4089519896a88af48df8e99c7010930fb84cd33599e57f8477e8748cf5259e428a0
-
SSDEEP
6144:R+xWEy53Bhj8sW4y9wTeT10hFPascnojIXTvUv7ohqfp2:RSw53Bhj8sW4ya6T6hFPasco4cv7o7
Malware Config
Signatures
-
BazarBackdoor 64 IoCs
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
description flow ioc Process 30 younika-hayde.bazar Process not Found 54 younika-hayde.bazar Process not Found 56 younika-hayde.bazar Process not Found 60 younika-hayde.bazar Process not Found 61 younika-hayde.bazar Process not Found 62 younika-hayde.bazar Process not Found Key created \REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\Root f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe 13 younika-hayde.bazar Process not Found 27 younika-hayde.bazar Process not Found 89 younika-hayde.bazar Process not Found 50 younika-hayde.bazar Process not Found 51 younika-hayde.bazar Process not Found 58 younika-hayde.bazar Process not Found 59 younika-hayde.bazar Process not Found 74 younika-hayde.bazar Process not Found 84 younika-hayde.bazar Process not Found 36 younika-hayde.bazar Process not Found 47 younika-hayde.bazar Process not Found 52 younika-hayde.bazar Process not Found 40 younika-hayde.bazar Process not Found 57 younika-hayde.bazar Process not Found 71 younika-hayde.bazar Process not Found 19 younika-hayde.bazar Process not Found 32 younika-hayde.bazar Process not Found 83 younika-hayde.bazar Process not Found 85 younika-hayde.bazar Process not Found 39 younika-hayde.bazar Process not Found 66 younika-hayde.bazar Process not Found 80 younika-hayde.bazar Process not Found 86 younika-hayde.bazar Process not Found 17 younika-hayde.bazar Process not Found 33 younika-hayde.bazar Process not Found 76 younika-hayde.bazar Process not Found 70 younika-hayde.bazar Process not Found 73 younika-hayde.bazar Process not Found 68 younika-hayde.bazar Process not Found 81 younika-hayde.bazar Process not Found 25 younika-hayde.bazar Process not Found 79 younika-hayde.bazar Process not Found 77 younika-hayde.bazar Process not Found 78 younika-hayde.bazar Process not Found 24 younika-hayde.bazar Process not Found 46 younika-hayde.bazar Process not Found 82 younika-hayde.bazar Process not Found 88 younika-hayde.bazar Process not Found 31 younika-hayde.bazar Process not Found 37 younika-hayde.bazar Process not Found 69 younika-hayde.bazar Process not Found 34 younika-hayde.bazar Process not Found 64 younika-hayde.bazar Process not Found 48 younika-hayde.bazar Process not Found 53 younika-hayde.bazar Process not Found 55 younika-hayde.bazar Process not Found 72 younika-hayde.bazar Process not Found 26 younika-hayde.bazar Process not Found 44 younika-hayde.bazar Process not Found 45 younika-hayde.bazar Process not Found 49 younika-hayde.bazar Process not Found 87 younika-hayde.bazar Process not Found 14 younika-hayde.bazar Process not Found 38 younika-hayde.bazar Process not Found 23 younika-hayde.bazar Process not Found 41 younika-hayde.bazar Process not Found 42 younika-hayde.bazar Process not Found -
Bazarbackdoor family
-
Tries to connect to .bazar domain 64 IoCs
Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.
flow ioc 34 younika-hayde.bazar 45 younika-hayde.bazar 58 younika-hayde.bazar 72 younika-hayde.bazar 85 younika-hayde.bazar 27 younika-hayde.bazar 57 younika-hayde.bazar 60 younika-hayde.bazar 64 younika-hayde.bazar 65 younika-hayde.bazar 42 younika-hayde.bazar 73 younika-hayde.bazar 80 younika-hayde.bazar 38 younika-hayde.bazar 13 younika-hayde.bazar 16 younika-hayde.bazar 17 younika-hayde.bazar 23 younika-hayde.bazar 44 younika-hayde.bazar 71 younika-hayde.bazar 79 younika-hayde.bazar 88 younika-hayde.bazar 39 younika-hayde.bazar 50 younika-hayde.bazar 70 younika-hayde.bazar 81 younika-hayde.bazar 36 younika-hayde.bazar 37 younika-hayde.bazar 49 younika-hayde.bazar 51 younika-hayde.bazar 86 younika-hayde.bazar 46 younika-hayde.bazar 68 younika-hayde.bazar 84 younika-hayde.bazar 54 younika-hayde.bazar 63 younika-hayde.bazar 67 younika-hayde.bazar 48 younika-hayde.bazar 66 younika-hayde.bazar 83 younika-hayde.bazar 19 younika-hayde.bazar 30 younika-hayde.bazar 47 younika-hayde.bazar 62 younika-hayde.bazar 69 younika-hayde.bazar 75 younika-hayde.bazar 31 younika-hayde.bazar 32 younika-hayde.bazar 55 younika-hayde.bazar 56 younika-hayde.bazar 74 younika-hayde.bazar 76 younika-hayde.bazar 78 younika-hayde.bazar 82 younika-hayde.bazar 14 younika-hayde.bazar 24 younika-hayde.bazar 26 younika-hayde.bazar 61 younika-hayde.bazar 89 younika-hayde.bazar 33 younika-hayde.bazar 59 younika-hayde.bazar 77 younika-hayde.bazar 25 younika-hayde.bazar 43 younika-hayde.bazar -
Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 192.99.85.244 Destination IP 94.177.171.127 Destination IP 193.183.98.66 Destination IP 142.4.205.47 Destination IP 87.98.175.85 Destination IP 89.35.39.64 Destination IP 144.76.133.38 Destination IP 172.98.193.42 Destination IP 111.67.20.8 Destination IP 158.69.239.167 Destination IP 66.70.211.246 Destination IP 138.197.25.214 Destination IP 217.12.210.54 Destination IP 63.231.92.27 Destination IP 96.47.228.108 Destination IP 128.52.130.209 Destination IP 46.28.207.199 Destination IP 69.164.196.21 Destination IP 87.98.175.85 Destination IP 146.185.176.36 Destination IP 176.126.70.119 Destination IP 107.172.42.186 Destination IP 212.24.98.54 Destination IP 82.196.9.45 Destination IP 50.3.82.215 Destination IP 139.59.23.241 Destination IP 185.164.136.225 Destination IP 163.53.248.170 Destination IP 51.254.25.115 Destination IP 51.255.48.78 Destination IP 192.52.166.110 Destination IP 81.2.241.148 Destination IP 185.208.208.141 Destination IP 51.254.25.115 Destination IP 147.135.185.78 Destination IP 89.18.27.167 Destination IP 188.165.200.156 Destination IP 92.222.97.145 Destination IP 178.17.170.179 Destination IP 77.73.68.161 Destination IP 35.196.105.24 Destination IP 130.255.78.223 Destination IP 172.104.136.243 Destination IP 45.63.124.65 Destination IP 5.132.191.104 Destination IP 31.171.251.118 Destination IP 139.99.96.146 Destination IP 142.4.204.111 Destination IP 82.141.39.32 Destination IP 193.183.98.66 Destination IP 167.99.153.82 Destination IP 51.255.211.146 Destination IP 5.45.97.127 Destination IP 139.59.208.246 Destination IP 104.238.186.189 Destination IP 91.217.137.37 Destination IP 91.217.137.37 Destination IP 185.117.154.144 Destination IP 169.239.202.202 Destination IP 198.251.90.143 Destination IP 158.69.160.164 Destination IP 46.101.70.183 Destination IP 162.248.241.94 Destination IP 104.37.195.178 -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
description flow ioc HTTP URL 12 https://api.opennicproject.org/geoip/