Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

24/02/2025, 20:57

250224-zrl3vavqs5 10

12/10/2024, 18:55

241012-xk1asazfrj 10

30/11/2023, 19:32

231130-x8zddshb2y 10

28/06/2021, 11:05

210628-3vdg7sx13e 3

Analysis

  • max time kernel
    10s
  • max time network
    127s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    28/06/2021, 11:05

General

  • Target

    31.214.157.40_#DarkRadiation_by_@r3dbU7z/api/code.sh

  • Size

    4KB

  • MD5

    4409d0036c0668c33ca152abb8eb8776

  • SHA1

    e918e127494ac5dcc839e827b1ca9e40a0650cb0

  • SHA256

    4c037b151ab09258f31193160d5b715c2fd14290344bfdf12fab16301095f7b7

  • SHA512

    e0524e00bd42d3d4eb38e1b84e80416d95d9f081792e66f16a38e8fb8b5b71bd3b06b9fc7143bddeb87f4101aa12beacabcd540a985e8f2249a8e6f4d7a18059

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\31.214.157.40_#DarkRadiation_by_@r3dbU7z\api\code.sh
    1⤵
    • Modifies registry class
    PID:1696
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2608

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads