Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
315s -
max time network
1593s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
27/09/2024, 11:58 UTC
General
-
Target
applist.fatih
-
Size
194B
-
MD5
670417a5203a2d09d10d6fe69172500d
-
SHA1
121b7f1d02197508adb79c270d7fdbb263735f85
-
SHA256
bed4a15e52065fede5b3966ad12a238c76d99acbb38cae33ae97f584730c8beb
-
SHA512
756e9b7fa010eaf57b5d883bb9cfa6d3eaca0c552f1cd48612a0316e835bc5b197da9242006b5e43e51eeb83f751c3643aa111e8818c273c2d0c4f3c74803a0f
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\applist.fatih1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
-
DNS19.229.111.52.in-addr.arpaRemote address:8.8.8.8:53Request19.229.111.52.in-addr.arpaIN PTRResponse -
DNS23.173.189.20.in-addr.arpaRemote address:8.8.8.8:53Request23.173.189.20.in-addr.arpaIN PTRResponse
-
DNS79.190.18.2.in-addr.arpaRemote address:8.8.8.8:53Request79.190.18.2.in-addr.arpaIN PTRResponse79.190.18.2.in-addr.arpaIN PTRa2-18-190-79deploystaticakamaitechnologiescom
-
DNS172.210.232.199.in-addr.arpaRemote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
DNS167.205.23.2.in-addr.arpaRemote address:8.8.8.8:53Request167.205.23.2.in-addr.arpaIN PTRResponse167.205.23.2.in-addr.arpaIN PTRa2-23-205-167deploystaticakamaitechnologiescom
-
52.111.227.11:443
-
8.8.8.8:5319.229.111.52.in-addr.arpadns
DNS Request
19.229.111.52.in-addr.arpa
-
8.8.8.8:5323.173.189.20.in-addr.arpadns
DNS Request
23.173.189.20.in-addr.arpa
-
8.8.8.8:5379.190.18.2.in-addr.arpadns
DNS Request
79.190.18.2.in-addr.arpa
-
8.8.8.8:53172.210.232.199.in-addr.arpadns
DNS Request
172.210.232.199.in-addr.arpa
-
8.8.8.8:53167.205.23.2.in-addr.arpadns
DNS Request
167.205.23.2.in-addr.arpa