Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
29/09/2024, 18:32 UTC
General
-
Target
jre/include/win32/bridge/AccessBridgeCallbacks.h
-
Size
5KB
-
MD5
88747b77c61e3a4b1a7216f9c0f833ec
-
SHA1
6e560f50e1211591b8347541e03b642d2af0839d
-
SHA256
92ecc9dc75d30ebdd6ba6da032f567586d258cdd69ccb04621327b9d388f814f
-
SHA512
a02cd27bdf65d28f069337ae426333bebcf78b7023bd0a60fd6f535239859f072e21c68831292e6759e4fd30756680e03c7ebab74654fbc1f9b32b4602ebf44a
-
SSDEEP
96:jMHNr1JBxu21272t2R2d232Y2J2h2iH2N2j2SH2STS2nL2Z2m2o2L2d2YE2n2Y2t:jMHNr0Kwn
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\jre\include\win32\bridge\AccessBridgeCallbacks.h1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
-
DNS14.227.111.52.in-addr.arpaRemote address:8.8.8.8:53Request14.227.111.52.in-addr.arpaIN PTRResponse -
DNS5.173.189.20.in-addr.arpaRemote address:8.8.8.8:53Request5.173.189.20.in-addr.arpaIN PTRResponse
-
DNSocsp.digicert.comRemote address:8.8.8.8:53Requestocsp.digicert.comIN AResponseocsp.digicert.comIN CNAMEocsp.edge.digicert.comocsp.edge.digicert.comIN CNAMEfp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.2be4.phicdn.netIN CNAMEfp2e7a.wpc.phicdn.netfp2e7a.wpc.phicdn.netIN A192.229.221.95
No results found
-
8.8.8.8:5314.227.111.52.in-addr.arpadns
DNS Request
14.227.111.52.in-addr.arpa
DNS Request
5.173.189.20.in-addr.arpa
DNS Request
ocsp.digicert.com
DNS Response
192.229.221.95