Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
389s -
max time network
1818s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
17/04/2023, 23:47 UTC
General
-
Target
firefox/libsmime3.so
-
Size
159KB
-
MD5
6a3f8e781058b8674ec23c0f181d74e4
-
SHA1
b23d3e198c939b3981e91a5c6927d67b7acee758
-
SHA256
b75e823e834f8ac279cb6f9387c1e29eac084a8f019d3bcb0b27f8ff9b03d2ae
-
SHA512
b229a1f3de41fe0db915b34a60079361cbaea02910f165f35930b277fe9f7578e556f2cee8afe5a7331e44341b135c7e7459c865e264eeaf67fd28cdabc0f10f
-
SSDEEP
1536:eNg2yy5Ch5MGSNwKPYkenRxg1CuLpY2YMWtUfSrNB67xoRiuDZ+3rjpSi:qg2yy5CjtwCZnRxwVaL67SEBSi
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\firefox\libsmime3.so1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
-
DNS63.13.109.52.in-addr.arpaRemote address:8.8.8.8:53Request63.13.109.52.in-addr.arpaIN PTRResponse -
DNS226.162.46.104.in-addr.arpaRemote address:8.8.8.8:53Request226.162.46.104.in-addr.arpaIN PTRResponse
-
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
DNS254.136.241.8.in-addr.arpaRemote address:8.8.8.8:53Request254.136.241.8.in-addr.arpaIN PTRResponse
-
13.89.178.27:443
-
93.184.221.240:80
-
8.8.8.8:5363.13.109.52.in-addr.arpadns
DNS Request
63.13.109.52.in-addr.arpa
-
8.8.8.8:53226.162.46.104.in-addr.arpadns
DNS Request
226.162.46.104.in-addr.arpa
-
8.8.8.8:5395.221.229.192.in-addr.arpadns
DNS Request
95.221.229.192.in-addr.arpa
-
8.8.8.8:53254.136.241.8.in-addr.arpadns
DNS Request
254.136.241.8.in-addr.arpa