Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
161s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
-
submitted
22/02/2024, 19:07 UTC
General
-
Target
encodings/cp950.pyc
-
Size
1KB
-
MD5
164e556801bc27419d5e82d03b20ba4a
-
SHA1
bbede8fda4b8de05c08096aca9d2625590db90db
-
SHA256
e576c17ad1c35666a03c535e6b693b45d9d52d2094e04d75df177cbfcbf72b65
-
SHA512
ac9689341614545f227a599300588f6feacb42c8fe363069ea0c771f2aa05de544573543ce51618883ce499186859e280308193e8d8dd5f4d130727deedbf973
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\encodings\cp950.pyc1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
-
DNS0.181.190.20.in-addr.arpaRemote address:8.8.8.8:53Request0.181.190.20.in-addr.arpaIN PTRResponse -
DNSnexusrules.officeapps.live.comRemote address:8.8.8.8:53Requestnexusrules.officeapps.live.comIN AResponsenexusrules.officeapps.live.comIN CNAMEprod.nexusrules.live.com.akadns.netprod.nexusrules.live.com.akadns.netIN A52.111.243.31
-
DNS178.178.17.96.in-addr.arpaRemote address:8.8.8.8:53Request178.178.17.96.in-addr.arpaIN PTRResponse178.178.17.96.in-addr.arpaIN PTRa96-17-178-178deploystaticakamaitechnologiescom
-
DNS180.178.17.96.in-addr.arpaRemote address:8.8.8.8:53Request180.178.17.96.in-addr.arpaIN PTRResponse180.178.17.96.in-addr.arpaIN PTRa96-17-178-180deploystaticakamaitechnologiescom
-
DNSself.events.data.microsoft.comRemote address:8.8.8.8:53Requestself.events.data.microsoft.comIN AResponseself.events.data.microsoft.comIN CNAMEself-events-data.trafficmanager.netself-events-data.trafficmanager.netIN CNAMEonedscolprdwus16.westus.cloudapp.azure.comonedscolprdwus16.westus.cloudapp.azure.comIN A20.189.173.23
-
DNSself.events.data.microsoft.comRemote address:8.8.8.8:53Requestself.events.data.microsoft.comIN A
-
DNSself.events.data.microsoft.comRemote address:8.8.8.8:53Requestself.events.data.microsoft.comIN A
No results found
-
8.8.8.8:530.181.190.20.in-addr.arpadns
DNS Request
0.181.190.20.in-addr.arpa
DNS Request
nexusrules.officeapps.live.com
DNS Response
52.111.243.31
-
8.8.8.8:53178.178.17.96.in-addr.arpadns
DNS Request
178.178.17.96.in-addr.arpa
DNS Request
180.178.17.96.in-addr.arpa
DNS Request
self.events.data.microsoft.com
DNS Request
self.events.data.microsoft.com
DNS Request
self.events.data.microsoft.com
DNS Response
20.189.173.23