Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
131s -
max time network
135s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
20/05/2024, 05:00 UTC
General
-
Target
overrides/kubejs/config/common.properties
-
Size
299B
-
MD5
ace24cb732ef78f280e8cf8ce01fb90b
-
SHA1
30bbb33835106f9a82247b0a95ae6b4aa6c30c0b
-
SHA256
072d44cd4288ea850ea42c00e440765c87a112e9cadbea0f31a41f3592bdbe10
-
SHA512
e957a20576d6ec66cf99ae7e50ae7bd1c86a905ead72724bc69b9b1b6677029d9416ee249f5de8dc44ac42d977526234c5d5ad1aaca912888cf99766c5198584
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\overrides\kubejs\config\common.properties1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
-
DNS168.117.168.52.in-addr.arpaRemote address:8.8.8.8:53Request168.117.168.52.in-addr.arpaIN PTRResponse -
DNS25.140.123.92.in-addr.arpaRemote address:8.8.8.8:53Request25.140.123.92.in-addr.arpaIN PTRResponse25.140.123.92.in-addr.arpaIN PTRa92-123-140-25deploystaticakamaitechnologiescom
No results found
-
8.8.8.8:53168.117.168.52.in-addr.arpadns
DNS Request
168.117.168.52.in-addr.arpa
-
8.8.8.8:5325.140.123.92.in-addr.arpadns
DNS Request
25.140.123.92.in-addr.arpa