Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
02/05/2022, 02:17 UTC
General
-
Target
27d6e6cd3ff5d26a814eb1439919a61d6725856065401c51e477e62f9fcf6fa7.exe
-
Size
482KB
-
MD5
4bdb473e70c6c7e688e15049f103cd5d
-
SHA1
d64100709ae9cb4968dd5d6e5d526b6c10b87678
-
SHA256
27d6e6cd3ff5d26a814eb1439919a61d6725856065401c51e477e62f9fcf6fa7
-
SHA512
d774898c41c70096cf601edf2b3fbe92181119f490909ac9b17eb3fc08d5131b6c9d29d4451bb78e232893a23789c2a5923f8a7c23eaf030a7297b448831caa2
Score
10/10
Malware Config
Signatures
-
Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
-
Chinese Botnet Payload 1 IoCs
-
VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\27d6e6cd3ff5d26a814eb1439919a61d6725856065401c51e477e62f9fcf6fa7.exe"C:\Users\Admin\AppData\Local\Temp\27d6e6cd3ff5d26a814eb1439919a61d6725856065401c51e477e62f9fcf6fa7.exe"1⤵
- Suspicious use of SetWindowsHookEx
Network
- No results found
-
43.229.113.41:8990 -
43.229.113.41:5699
-
43.229.113.41:8990
-
20.189.173.12:443 -
67.24.25.254:80
-
8.238.20.126:80
-
8.238.20.126:80
-
8.238.20.126:80
-
43.229.113.41:8990
-
43.229.113.41:8990
-
43.229.113.41:8990
-
43.229.113.41:8990
-
43.229.113.41:8990
-
43.229.113.41:8990
No results found
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
504KB
-
Filesize
92KB