Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18/01/2025, 04:32 UTC
Behavioral task
behavioral1
Sample
72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237.exe
Resource
win10v2004-20241007-en
General
-
Target
72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237.exe
-
Size
482KB
-
MD5
9d0cb1390b23b035277d9595fd22a333
-
SHA1
fa0288c883caa88fa86b696fad34e0d1d0c3c8e9
-
SHA256
72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237
-
SHA512
eaf8132e1e358f55661107efdf9dde0bb398666d4b766374e0dcf0d2ac7d1063a424c4ffef43fa91cbc7bfabdf0a92ee2b91bb9b82aa8e4b61d57c6367aa0b8b
-
SSDEEP
12288:x13ak/mBXTG4/1v08KI7ZnMEF76JqmsvZQoS:jak/mBXTV/R0nEF76gFZ/
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237.exe
Processes
Network
-
Remote address:8.8.8.8:53Requestagamwizard.duckdns.orgIN AResponseagamwizard.duckdns.orgIN A94.156.167.85
-
Remote address:8.8.8.8:53Requestagamwizard.duckdns.orgIN AResponseagamwizard.duckdns.orgIN A94.156.167.85
-
Remote address:8.8.8.8:53Request232.168.11.51.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request8.153.16.2.in-addr.arpaIN PTRResponse8.153.16.2.in-addr.arpaIN PTRa2-16-153-8deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request68.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request167.173.78.104.in-addr.arpaIN PTRResponse167.173.78.104.in-addr.arpaIN PTRa104-78-173-167deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request97.17.167.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request228.249.119.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request200.163.202.172.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request198.187.3.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request166.190.18.2.in-addr.arpaIN PTRResponse166.190.18.2.in-addr.arpaIN PTRa2-18-190-166deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestagamwizard.duckdns.orgIN AResponseagamwizard.duckdns.orgIN A94.156.167.85
-
Remote address:8.8.8.8:53Request11.227.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestagamwizard.duckdns.orgIN AResponseagamwizard.duckdns.orgIN A94.156.167.85
-
Remote address:8.8.8.8:53Request88.16.208.104.in-addr.arpaIN PTRResponse
-
94.156.167.85:4044agamwizard.duckdns.org72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237.exe260 B 160 B 5 4
-
94.156.167.85:4044agamwizard.duckdns.org72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237.exe260 B 200 B 5 5
-
94.156.167.85:4044agamwizard.duckdns.org72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237.exe260 B 200 B 5 5
-
94.156.167.85:4044agamwizard.duckdns.org72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237.exe260 B 200 B 5 5
-
94.156.167.85:4044agamwizard.duckdns.org72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237.exe260 B 160 B 5 4
-
94.156.167.85:4044agamwizard.duckdns.org72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237.exe260 B 200 B 5 5
-
94.156.167.85:4044agamwizard.duckdns.org72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237.exe260 B 200 B 5 5
-
94.156.167.85:4044agamwizard.duckdns.org72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237.exe260 B 200 B 5 5
-
94.156.167.85:4044agamwizard.duckdns.org72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237.exe260 B 200 B 5 5
-
94.156.167.85:4044agamwizard.duckdns.org72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237.exe260 B 200 B 5 5
-
94.156.167.85:4044agamwizard.duckdns.org72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237.exe260 B 200 B 5 5
-
94.156.167.85:4044agamwizard.duckdns.org72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237.exe260 B 200 B 5 5
-
94.156.167.85:4044agamwizard.duckdns.org72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237.exe260 B 160 B 5 4
-
94.156.167.85:4044agamwizard.duckdns.org72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237.exe260 B 160 B 5 4
-
94.156.167.85:4044agamwizard.duckdns.org72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237.exe260 B 160 B 5 4
-
94.156.167.85:4044agamwizard.duckdns.org72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237.exe260 B 200 B 5 5
-
94.156.167.85:4044agamwizard.duckdns.org72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237.exe260 B 200 B 5 5
-
94.156.167.85:4044agamwizard.duckdns.org72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237.exe260 B 200 B 5 5
-
94.156.167.85:4044agamwizard.duckdns.org72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237.exe260 B 200 B 5 5
-
94.156.167.85:4044agamwizard.duckdns.org72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237.exe260 B 200 B 5 5
-
94.156.167.85:4044agamwizard.duckdns.org72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237.exe260 B 200 B 5 5
-
94.156.167.85:4044agamwizard.duckdns.org72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237.exe260 B 200 B 5 5
-
94.156.167.85:4044agamwizard.duckdns.org72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237.exe260 B 200 B 5 5
-
94.156.167.85:4044agamwizard.duckdns.org72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237.exe260 B 200 B 5 5
-
94.156.167.85:4044agamwizard.duckdns.org72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237.exe260 B 200 B 5 5
-
94.156.167.85:4044agamwizard.duckdns.org72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237.exe260 B 200 B 5 5
-
94.156.167.85:4044agamwizard.duckdns.org72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237.exe260 B 200 B 5 5
-
94.156.167.85:4044agamwizard.duckdns.org72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237.exe260 B 160 B 5 4
-
94.156.167.85:4044agamwizard.duckdns.org72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237.exe260 B 200 B 5 5
-
94.156.167.85:4044agamwizard.duckdns.org72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237.exe260 B 160 B 5 4
-
94.156.167.85:4044agamwizard.duckdns.org72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237.exe260 B 200 B 5 5
-
94.156.167.85:4044agamwizard.duckdns.org72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237.exe260 B 200 B 5 5
-
94.156.167.85:4044agamwizard.duckdns.org72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237.exe260 B 200 B 5 5
-
94.156.167.85:4044agamwizard.duckdns.org72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237.exe260 B 200 B 5 5
-
94.156.167.85:4044agamwizard.duckdns.org72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237.exe260 B 200 B 5 5
-
94.156.167.85:4044agamwizard.duckdns.org72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237.exe260 B 160 B 5 4
-
94.156.167.85:4044agamwizard.duckdns.org72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237.exe260 B 200 B 5 5
-
94.156.167.85:4044agamwizard.duckdns.org72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237.exe52 B 40 B 1 1
-
8.8.8.8:53agamwizard.duckdns.orgdns72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237.exe136 B 168 B 2 2
DNS Request
agamwizard.duckdns.org
DNS Request
agamwizard.duckdns.org
DNS Response
94.156.167.85
DNS Response
94.156.167.85
-
72 B 158 B 1 1
DNS Request
232.168.11.51.in-addr.arpa
-
69 B 131 B 1 1
DNS Request
8.153.16.2.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
68.32.126.40.in-addr.arpa
-
73 B 139 B 1 1
DNS Request
167.173.78.104.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
97.17.167.52.in-addr.arpa
-
73 B 159 B 1 1
DNS Request
228.249.119.40.in-addr.arpa
-
74 B 160 B 1 1
DNS Request
200.163.202.172.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
198.187.3.20.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
166.190.18.2.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.214.232.199.in-addr.arpa
-
8.8.8.8:53agamwizard.duckdns.orgdns72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237.exe68 B 84 B 1 1
DNS Request
agamwizard.duckdns.org
DNS Response
94.156.167.85
-
72 B 158 B 1 1
DNS Request
11.227.111.52.in-addr.arpa
-
8.8.8.8:53agamwizard.duckdns.orgdns72be52fba2205242c1ce33347edf5f3e207188663300f522a6a6ec36c6a73237.exe68 B 84 B 1 1
DNS Request
agamwizard.duckdns.org
DNS Response
94.156.167.85
-
72 B 146 B 1 1
DNS Request
88.16.208.104.in-addr.arpa