Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
158s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
21/08/2024, 10:04 UTC
General
-
Target
$PLUGINSDIR/uninstall.ini
-
Size
52B
-
MD5
e978a46d7e23c139e4df7b526f86745f
-
SHA1
f280d921ff3bbf5e171b0f6aa9e48e9914e32dd6
-
SHA256
435288e587018aa375e8a4bf3f35cd8dfffd559053f5ca6a0e487a61ff23e5db
-
SHA512
7b7150f3b2385d7a7264839d626e9b7c7026868d57f9f5df7d42ddb01688a7bf3008937ef2aa06c3f49089cb4cfbbfb8b6d9661fbc6a4f8e555305552759a75f
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\uninstall.ini1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
-
DNS8.8.8.8.in-addr.arpaRemote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle -
DNSself.events.data.microsoft.comRemote address:8.8.8.8:53Requestself.events.data.microsoft.comIN AResponseself.events.data.microsoft.comIN CNAMEself-events-data.trafficmanager.netself-events-data.trafficmanager.netIN CNAMEonedscolprdeus21.eastus.cloudapp.azure.comonedscolprdeus21.eastus.cloudapp.azure.comIN A20.42.73.31
-
DNS31.73.42.20.in-addr.arpaRemote address:8.8.8.8:53Request31.73.42.20.in-addr.arpaIN PTRResponse
No results found
-
8.8.8.8:538.8.8.8.in-addr.arpadns
DNS Request
8.8.8.8.in-addr.arpa
DNS Request
self.events.data.microsoft.com
DNS Response
20.42.73.31
DNS Request
31.73.42.20.in-addr.arpa