Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
70s -
max time network
83s -
platform
windows10-1703_x64 -
resource
win10-20230915-en -
resource tags
-
submitted
19/09/2023, 06:51 UTC
General
-
Target
MultiMC/libLauncher_nbt++.dll.a
-
Size
149KB
-
MD5
d33b558ef7bd4d8617686ba972d581eb
-
SHA1
962320c340596f5e91d05453a2ee3047d687f563
-
SHA256
41d0787573ac821be0ce45bcaddc77440a1bb1b9cb077b3c86c39b75b1404b11
-
SHA512
78d633527999e39f810a619d1a7935455631911cc020a75d05718748d2a511f2a01489fa05d3ff8611abde14d9e66beb96d3f514222e5ba95b800a20c8bd5b0a
-
SSDEEP
768:DPr973mNxRtPpcfyqL/8Jm3dW0aNfGannAcDutKuKTDGhi4DvA492TSAiAiTHT41:Dr973mP9aKrcRZBgEoo57vYmu
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\MultiMC\libLauncher_nbt++.dll.a1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
-
DNSf.8.3.8.0.2.1.d.f.d.1.8.5.3.4.0.8.f.7.1.4.4.8.5.8.0.8.0.8.0.8.0.ip6.arpaRemote address:8.8.8.8:53Requestf.8.3.8.0.2.1.d.f.d.1.8.5.3.4.0.8.f.7.1.4.4.8.5.8.0.8.0.8.0.8.0.ip6.arpaIN PTRResponse -
DNS8.8.8.8.in-addr.arpaRemote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
DNS13.227.111.52.in-addr.arpaRemote address:8.8.8.8:53Request13.227.111.52.in-addr.arpaIN PTRResponse
No results found
-
8.8.8.8:53f.8.3.8.0.2.1.d.f.d.1.8.5.3.4.0.8.f.7.1.4.4.8.5.8.0.8.0.8.0.8.0.ip6.arpadns
DNS Request
f.8.3.8.0.2.1.d.f.d.1.8.5.3.4.0.8.f.7.1.4.4.8.5.8.0.8.0.8.0.8.0.ip6.arpa
-
8.8.8.8:538.8.8.8.in-addr.arpadns
DNS Request
8.8.8.8.in-addr.arpa
-
8.8.8.8:5313.227.111.52.in-addr.arpadns
DNS Request
13.227.111.52.in-addr.arpa