Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
132s -
platform
windows10-1703_x64 -
resource
win10-20231215-en -
resource tags
-
submitted
05/01/2024, 15:31 UTC
General
-
Target
MacroCreator/Lang/ur.lang
-
Size
100KB
-
MD5
3bc326676f13772561d383a07b39aadf
-
SHA1
210ab41d5f759665bdfc60abf0cbea84b2bc6fe1
-
SHA256
37d411533d51ffc4f67af2efe1b7f144cd64c98fbd496532d9a52a603ed78a1c
-
SHA512
14ebf2a3f34a9bdf043157776c28929e4a2eb88c1e67a07a37ceccc21dd981fb44957140859764aef2ed603374da7ecb90b67e4124cf57eed9dc2cf293d77b79
-
SSDEEP
3072:wLhdd7VvVDd9gTyYwN0iPfSVHRdbolRXWq2jeR5azVOFDmy6wARv8orrT97377S0:wLhdd7VvVDd9gTyYwNDPKWsXnyjO
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\MacroCreator\Lang\ur.lang1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
Network
-
DNS22.236.111.52.in-addr.arpaRemote address:8.8.8.8:53Request22.236.111.52.in-addr.arpaIN PTRResponse -
DNS22.236.111.52.in-addr.arpaRemote address:8.8.8.8:53Request22.236.111.52.in-addr.arpaIN PTR
-
DNS9.179.89.13.in-addr.arpaRemote address:8.8.8.8:53Request9.179.89.13.in-addr.arpaIN PTRResponse
No results found
-
8.8.8.8:5322.236.111.52.in-addr.arpadns
DNS Request
22.236.111.52.in-addr.arpa
DNS Request
22.236.111.52.in-addr.arpa
-
8.8.8.8:539.179.89.13.in-addr.arpadns
DNS Request
9.179.89.13.in-addr.arpa