Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    102s
  • max time network
    114s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/03/2025, 10:18 UTC

General

  • Target

    AliIM2013_7.21.04C去广告绿色优化版V2/AliWangWang/7.21.04C/AliMediaPlayer.dll

  • Size

    185KB

  • MD5

    d0868dd3c9a49a0fc30836cafa6846fc

  • SHA1

    f625585d21c75bf377ad0f67718711b9465540af

  • SHA256

    e5dbeda32366d5a997b8953ac56f3cf42e10a701b518a5c13e29c89f28fb6d71

  • SHA512

    47b4f2af9596cee0d9f92451935fced63bff667bab525863b1679983acd804dd92403385ce5bbc53f87d28b7ea01547b1f281c39653f6171fd181fe7244b4d8c

  • SSDEEP

    3072:8Hig5LHgaGGRLU6zE1norQRbbWRbrRbVRbt1OgBmL1Avx+6x:eFe1RmRfRJRvOgBE1x6x

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 28 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\AliIM2013_7.21.04C去广告绿色优化版V2\AliWangWang\7.21.04C\AliMediaPlayer.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1700
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\AliIM2013_7.21.04C去广告绿色优化版V2\AliWangWang\7.21.04C\AliMediaPlayer.dll
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:2168

Network

  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
    Response
    g.bing.com
    IN CNAME
    g-bing-com.ax-0001.ax-msedge.net
    g-bing-com.ax-0001.ax-msedge.net
    IN CNAME
    ax-0001.ax-msedge.net
    ax-0001.ax-msedge.net
    IN A
    150.171.28.10
    ax-0001.ax-msedge.net
    IN A
    150.171.27.10
  • flag-us
    DNS
    c.pki.goog
    Remote address:
    8.8.8.8:53
    Request
    c.pki.goog
    IN A
    Response
    c.pki.goog
    IN CNAME
    pki-goog.l.google.com
    pki-goog.l.google.com
    IN A
    142.250.200.35
  • flag-gb
    GET
    http://c.pki.goog/r/r1.crl
    Remote address:
    142.250.200.35:80
    Request
    GET /r/r1.crl HTTP/1.1
    Cache-Control: max-age = 3000
    Connection: Keep-Alive
    Accept: */*
    If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT
    User-Agent: Microsoft-CryptoAPI/10.0
    Host: c.pki.goog
    Response
    HTTP/1.1 304 Not Modified
    Date: Sun, 16 Mar 2025 10:03:20 GMT
    Expires: Sun, 16 Mar 2025 10:53:20 GMT
    Age: 1039
    Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT
    Cache-Control: public, max-age=3000
    Vary: Accept-Encoding
  • 150.171.28.10:443
    g.bing.com
    tls
    2.0kB
    9.3kB
    21
    18
  • 142.250.200.35:80
    http://c.pki.goog/r/r1.crl
    http
    384 B
    355 B
    4
    3

    HTTP Request

    GET http://c.pki.goog/r/r1.crl

    HTTP Response

    304
  • 8.8.8.8:53
    g.bing.com
    dns
    56 B
    148 B
    1
    1

    DNS Request

    g.bing.com

    DNS Response

    150.171.28.10
    150.171.27.10

  • 8.8.8.8:53
    c.pki.goog
    dns
    56 B
    107 B
    1
    1

    DNS Request

    c.pki.goog

    DNS Response

    142.250.200.35

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.