Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
155s -
max time network
203s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
01/12/2022, 15:08 UTC
General
-
Target
11ab051dd40ad83d8c5e042a073a85a21e555d746cbd474f8b4b4c1d07234717.exe
-
Size
550KB
-
MD5
70582c8def0a008fa31b78c3b363a99b
-
SHA1
03b85ef7a9f80fc645c669951001e1c4b5f8fda3
-
SHA256
11ab051dd40ad83d8c5e042a073a85a21e555d746cbd474f8b4b4c1d07234717
-
SHA512
3045348de56708541c8ffcb720e2728768dbeb0f16cb2bac50e27b2b0b389a792cc29da9c896d2a40b9187b1f65658eff73476a76deaa80c4682f04f256bde2a
-
SSDEEP
12288:snRFtj2zJfUbLXEftfLtA8RKO1WHVaTYe70ht8oJo6:qRFtj2dfU3XEFrR41+Ye4/x
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
Processes
-
C:\Users\Admin\AppData\Local\Temp\11ab051dd40ad83d8c5e042a073a85a21e555d746cbd474f8b4b4c1d07234717.exe"C:\Users\Admin\AppData\Local\Temp\11ab051dd40ad83d8c5e042a073a85a21e555d746cbd474f8b4b4c1d07234717.exe"1⤵
Network
-
DNS97.97.242.52.in-addr.arpaRemote address:8.8.8.8:53Request97.97.242.52.in-addr.arpaIN PTRResponse -
DNS106.89.54.20.in-addr.arpaRemote address:8.8.8.8:53Request106.89.54.20.in-addr.arpaIN PTRResponse
-
DNS9.9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.2.0.0.0.0.2.0.1.3.0.6.2.ip6.arpaRemote address:8.8.8.8:53Request9.9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.2.0.0.0.0.2.0.1.3.0.6.2.ip6.arpaIN PTRResponse
-
209.197.3.8:80
-
13.69.239.72:443
-
72.21.91.29:80
-
40.125.122.151:443
-
8.8.8.8:5397.97.242.52.in-addr.arpadns
DNS Request
97.97.242.52.in-addr.arpa
-
8.8.8.8:53106.89.54.20.in-addr.arpadns
DNS Request
106.89.54.20.in-addr.arpa
-
8.8.8.8:539.9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.2.0.0.0.0.2.0.1.3.0.6.2.ip6.arpadns
DNS Request
9.9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.2.0.0.0.0.2.0.1.3.0.6.2.ip6.arpa
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
556KB
-
Filesize
556KB