Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
148s -
platform
windows10-1703_x64 -
resource
win10-20231215-en -
resource tags
-
submitted
05/01/2024, 15:31 UTC
General
-
Target
MacroCreator/Lang/zh_TW.lang
-
Size
62KB
-
MD5
f013093808e98c7b7b188c519393b80e
-
SHA1
7a8d1ef9b946f2b2f29a0d199b8de4e17de772c3
-
SHA256
660629ca162876a1982996364f86a070fe1d35eae463b59ba72089630885cb96
-
SHA512
b7b767e669d05121dfd90a3737c02e16ebb2402473b5f2a7a66378b309e0688d7da686c1f503187764f8827a133c67b293d2bf0df257282cdaec9f230bf084c9
-
SSDEEP
1536:XpIHRlCjuODTUkR1+B22RFffbx1VHxOrt:XpIHRlCjuODTUkR1+B223fq
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\MacroCreator\Lang\zh_TW.lang1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
Network
-
DNS57.110.18.2.in-addr.arpaRemote address:8.8.8.8:53Request57.110.18.2.in-addr.arpaIN PTRResponse57.110.18.2.in-addr.arpaIN PTRa2-18-110-57deploystaticakamaitechnologiescom -
DNS120.150.79.40.in-addr.arpaRemote address:8.8.8.8:53Request120.150.79.40.in-addr.arpaIN PTRResponse
-
DNS194.178.17.96.in-addr.arpaRemote address:8.8.8.8:53Request194.178.17.96.in-addr.arpaIN PTRResponse194.178.17.96.in-addr.arpaIN PTRa96-17-178-194deploystaticakamaitechnologiescom
No results found
-
8.8.8.8:5357.110.18.2.in-addr.arpadns
DNS Request
57.110.18.2.in-addr.arpa
-
8.8.8.8:53120.150.79.40.in-addr.arpadns
DNS Request
120.150.79.40.in-addr.arpa
-
8.8.8.8:53194.178.17.96.in-addr.arpadns
DNS Request
194.178.17.96.in-addr.arpa