Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    139s
  • max time network
    111s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/09/2024, 03:28

General

  • Target

    krnl/krnl/Newtonsoft.Json.xml

  • Size

    489KB

  • MD5

    edea00514ddedc60736475ebb6d7e8d0

  • SHA1

    9941062bc3a62bc6bbe4be9fd2c3817d769312b3

  • SHA256

    2c3fafc94275ffb1b5f37891c452285e1fe7797cf02371def687627903dc4fde

  • SHA512

    ddb912ef462e052f50db8903f5d2c8eddfe8fd1a14b635862b499b751ca5027f2c0098b6ac1c285acf52665c33ab70dec3435bd4c7bfb3387add65d4e3b443eb

  • SSDEEP

    6144:/Gkf3fW1Nt0/IhSBVIeR0R+CRFo9Tt82mafmKj+spjoqoyO185QyMYFLsgfl4:6

Score
1/10

Malware Config

Signatures

Processes

  • C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
    "C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\krnl\krnl\Newtonsoft.Json.xml"
    1⤵
      PID:3680

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3680-1-0x00007FF83D6CD000-0x00007FF83D6CE000-memory.dmp

      Filesize

      4KB

    • memory/3680-0-0x00007FF7FD6B0000-0x00007FF7FD6C0000-memory.dmp

      Filesize

      64KB

    • memory/3680-2-0x00007FF83D630000-0x00007FF83D825000-memory.dmp

      Filesize

      2.0MB

    • memory/3680-3-0x00007FF83D630000-0x00007FF83D825000-memory.dmp

      Filesize

      2.0MB

    • memory/3680-4-0x00007FF83D630000-0x00007FF83D825000-memory.dmp

      Filesize

      2.0MB