Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

5

Static

static

4

#Pa$$w0rD_...#$.zip

windows7-x64

1

#Pa$$w0rD_...#$.zip

windows10-2004-x64

1

#Pa$$w0rD_...p#$.7z

windows7-x64

1

#Pa$$w0rD_...p#$.7z

windows10-2004-x64

1

Resources/...w.phpt

windows7-x64

3

Resources/...w.phpt

windows10-2004-x64

3

Resources/...1.phpt

windows7-x64

3

Resources/...1.phpt

windows10-2004-x64

3

Resources/...8.phpt

windows7-x64

3

Resources/...8.phpt

windows10-2004-x64

5

Resources/...g.phpt

windows7-x64

3

Resources/...g.phpt

windows10-2004-x64

3

Resources/...007.js

windows7-x64

3

Resources/...007.js

windows10-2004-x64

3

Resources/...3.phpt

windows7-x64

3

Resources/...3.phpt

windows10-2004-x64

3

Resources/...007.js

windows7-x64

3

Resources/...007.js

windows10-2004-x64

3

Resources/...4.phpt

windows7-x64

3

Resources/...4.phpt

windows10-2004-x64

3

Resources/...01.ps1

windows7-x64

3

Resources/...01.ps1

windows10-2004-x64

3

Resources/...oard.h

windows7-x64

3

Resources/...oard.h

windows10-2004-x64

3

Resources/...6.phpt

windows7-x64

3

Resources/...6.phpt

windows10-2004-x64

3

Resources/...8.phpt

windows7-x64

3

Resources/...8.phpt

windows10-2004-x64

3

Resources/...1.phpt

windows7-x64

3

Resources/...1.phpt

windows10-2004-x64

3

Resources/...6/htwj

windows7-x64

1

Resources/...6/htwj

windows10-2004-x64

1

Resubmissions

06/01/2025, 08:53 UTC

250106-ktfaravkfl 5

06/01/2025, 08:49 UTC

250106-kreansskgv 10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/01/2025, 08:53 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Resources/Data/x64/r4_groupH_simple_rpcenc_017w.phpt

  • Size

    1KB

  • MD5

    c9ff7b8b28e4f6f1960cb2250a51b4e9

  • SHA1

    4b7236cb5d51ea64907c85c2520e7d58de500852

  • SHA256

    19566e8db5d6df0af3b0db04c081c8755d51287d6cf037ea76daa149719594a7

  • SHA512

    ae8687155ae836cc2a8085e784e153b992d81063db662224497ee2f4c4999446fbfa79d34f59410ab69f7c469ea28530fc1e1251e480d3af5f528c8cb9f9aaf2

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Resources\Data\x64\r4_groupH_simple_rpcenc_017w.phpt
    1⤵
    • Modifies registry class
    PID:4324
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3948

Network

  • flag-us
    DNS
    58.55.71.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    58.55.71.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    104.219.191.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    104.219.191.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    56.163.245.4.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    56.163.245.4.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    18.31.95.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.31.95.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    134.130.81.91.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    134.130.81.91.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    29.243.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    29.243.111.52.in-addr.arpa
    IN PTR
    Response
No results found
  • 8.8.8.8:53
    58.55.71.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    58.55.71.13.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    104.219.191.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    104.219.191.52.in-addr.arpa

  • 8.8.8.8:53
    56.163.245.4.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    56.163.245.4.in-addr.arpa

  • 8.8.8.8:53
    18.31.95.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    18.31.95.13.in-addr.arpa

  • 8.8.8.8:53
    134.130.81.91.in-addr.arpa
    dns
    72 B
     147 B
     1
    1

    DNS Request

    134.130.81.91.in-addr.arpa

  • 8.8.8.8:53
    29.243.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    29.243.111.52.in-addr.arpa

  • 8.8.8.8:53

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.