Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

Mercurial....03.rar

windows10-ltsc 2021-x64

1

Mercurial ...al.exe

windows10-ltsc 2021-x64

10

Mercurial ...config

windows10-ltsc 2021-x64

3

Mercurial ...rs.xml

windows10-ltsc 2021-x64

3

Mercurial ...ner.cs

windows10-ltsc 2021-x64

3

Mercurial ...rm1.js

windows10-ltsc 2021-x64

3

Mercurial ...m1.vbs

windows10-ltsc 2021-x64

1

Mercurial ...csproj

windows10-ltsc 2021-x64

3

Mercurial ...ram.cs

windows10-ltsc 2021-x64

3

Mercurial ...nfo.cs

windows10-ltsc 2021-x64

3

Mercurial ...er.vbs

windows10-ltsc 2021-x64

1

Mercurial ...es.vbs

windows10-ltsc 2021-x64

1

Mercurial ...ner.cs

windows10-ltsc 2021-x64

3

Mercurial ...ttings

windows10-ltsc 2021-x64

3

Mercurial ...s.licx

windows10-ltsc 2021-x64

3

Mercurial ...Gcm.js

windows10-ltsc 2021-x64

3

Mercurial ...ser.js

windows10-ltsc 2021-x64

3

Mercurial ...mon.js

windows10-ltsc 2021-x64

3

Mercurial ...ber.js

windows10-ltsc 2021-x64

3

Mercurial ...ine.js

windows10-ltsc 2021-x64

3

Mercurial ...ram.js

windows10-ltsc 2021-x64

3

Mercurial ...ite.cs

windows10-ltsc 2021-x64

3

Mercurial ...ser.cs

windows10-ltsc 2021-x64

3

Mercurial ...ook.js

windows10-ltsc 2021-x64

3

Mercurial ...ing.cs

windows10-ltsc 2021-x64

3

Mercurial ...go.ico

windows10-ltsc 2021-x64

3

Mercurial ...config

windows10-ltsc 2021-x64

3

Analysis

  • max time kernel
    96s
  • max time network
    143s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241023-de
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241023-delocale:de-deos:windows10-ltsc 2021-x64systemwindows
  • submitted
    19/11/2024, 11:24 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Mercurial Grabber.v1.03/Mercurial/Properties/Resources.vbs

  • Size

    7KB

  • MD5

    58467f11104425fb5a573c71dbd37b3b

  • SHA1

    8319ab7aacb06d06162a66cfdf0b97376cfd68e3

  • SHA256

    df4a76464b02f4f7ee34aca6ca710ea0e770e62126f0ba49df74d3a548ffedc6

  • SHA512

    a345e33b7e87c06aedb143f6b80c145b408c32e5fdf472768c5c0ada0c63a7c6e70ce5f114ce973a1b53633ee6249981b20cef9411a45a84c81497a08ef4bed4

  • SSDEEP

    192:Zf+tLPfYnLvFVOiFQaUD7Ug94E2Km2y+2hb2ZT2392WK2cU2jh2X92+:Zf+tLPQnLvDOiFQXD7Ug12H2h2x2R2NT

Score
1/10

Malware Config

Signatures

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Mercurial Grabber.v1.03\Mercurial\Properties\Resources.vbs"
    1⤵
      PID:5168

    Network

    • flag-us
      DNS
      104.219.191.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      104.219.191.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      172.210.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.210.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      71.31.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      71.31.126.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      28.118.140.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      28.118.140.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      fd.api.iris.microsoft.com
      Remote address:
      8.8.8.8:53
      Request
      fd.api.iris.microsoft.com
      IN A
      Response
      fd.api.iris.microsoft.com
      IN CNAME
      fd-api-iris.trafficmanager.net
      fd-api-iris.trafficmanager.net
      IN CNAME
      iris-de-prod-azsc-v2-frc-b.francecentral.cloudapp.azure.com
      iris-de-prod-azsc-v2-frc-b.francecentral.cloudapp.azure.com
      IN A
      20.74.47.205
    • flag-us
      DNS
      56.163.245.4.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      56.163.245.4.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      18.31.95.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      18.31.95.13.in-addr.arpa
      IN PTR
      Response
    • 20.74.47.205:443
      fd.api.iris.microsoft.com
      98 B
       52 B
       2
      1
    • 8.8.8.8:53
      104.219.191.52.in-addr.arpa
      dns
      73 B
       147 B
       1
      1

      DNS Request

      104.219.191.52.in-addr.arpa

    • 8.8.8.8:53
      172.210.232.199.in-addr.arpa
      dns
      74 B
       128 B
       1
      1

      DNS Request

      172.210.232.199.in-addr.arpa

    • 8.8.8.8:53
      71.31.126.40.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      71.31.126.40.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
       144 B
       1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      28.118.140.52.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      28.118.140.52.in-addr.arpa

    • 8.8.8.8:53
      fd.api.iris.microsoft.com
      dns
      71 B
       201 B
       1
      1

      DNS Request

      fd.api.iris.microsoft.com

      DNS Response

      20.74.47.205

    • 8.8.8.8:53
      56.163.245.4.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      56.163.245.4.in-addr.arpa

    • 8.8.8.8:53
      18.31.95.13.in-addr.arpa
      dns
      70 B
       144 B
       1
      1

      DNS Request

      18.31.95.13.in-addr.arpa

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.