Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
19/08/2024, 01:27 UTC
General
-
Target
975ad2d0d9a888eb984b2216c80d7014efc304bf42fe28ce901ecb6820d90018.exe
-
Size
3.1MB
-
MD5
5059176589b4e92ffb896a9ab2076728
-
SHA1
f26ef69afb7ae922194c45647f1c521095626a6b
-
SHA256
975ad2d0d9a888eb984b2216c80d7014efc304bf42fe28ce901ecb6820d90018
-
SHA512
55d3629b538534ce919c759e4952b89a11421ab91755d8918c3bf89483689b276319c69e3937fc4f5b07f8101a5d42912edfb5c8a4fe6bd134ba8afb3bc87386
-
SSDEEP
49152:9QiftKI36ELUp3rbYNi3pOAYVJeYsTDt4hEPD:9JtKI365h3pM3eZ4e
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\975ad2d0d9a888eb984b2216c80d7014efc304bf42fe28ce901ecb6820d90018.exe"C:\Users\Admin\AppData\Local\Temp\975ad2d0d9a888eb984b2216c80d7014efc304bf42fe28ce901ecb6820d90018.exe"1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
Network
-
DNS30.243.111.52.in-addr.arpaRemote address:8.8.8.8:53Request30.243.111.52.in-addr.arpaIN PTRResponse -
DNSself.events.data.microsoft.comRemote address:8.8.8.8:53Requestself.events.data.microsoft.comIN AResponseself.events.data.microsoft.comIN CNAMEself-events-data.trafficmanager.netself-events-data.trafficmanager.netIN CNAMEonedscolprdwus23.westus.cloudapp.azure.comonedscolprdwus23.westus.cloudapp.azure.comIN A20.189.173.24
-
10.127.0.50:80 -
52.111.227.13:443
-
8.8.8.8:5330.243.111.52.in-addr.arpadns
DNS Request
30.243.111.52.in-addr.arpa
DNS Request
self.events.data.microsoft.com
DNS Response
20.189.173.24
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
3.3MB
-
Filesize
4KB
-
Filesize
3.3MB