Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13/12/2024, 11:42 UTC
General
-
Target
docs/release/build/make64.bat
-
Size
360B
-
MD5
4509df1a39c5581a775f1d48756fabdc
-
SHA1
6a4ae74cedbe5f414f8bf1f7951a4cfaa7d34c91
-
SHA256
d2a0bf481cdce9af659fafa82519af22e8cef599b99681afe2999c6eec4e6383
-
SHA512
e74ca7ea5b24e7db3f451bf6af7bc2f20209dca16455678157e48e7cf7fd0280f2193546ff7f0cfc71f99385b386a5db096c6b5c1ead205d1d09a3f738c66741
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\docs\release\build\make64.bat"1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo."2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" time"2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo."2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" time"2⤵
-
Network
-
DNS13.86.106.20.in-addr.arpaRemote address:8.8.8.8:53Request13.86.106.20.in-addr.arpaIN PTRResponse -
DNS172.210.232.199.in-addr.arpaRemote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
DNS76.32.126.40.in-addr.arpaRemote address:8.8.8.8:53Request76.32.126.40.in-addr.arpaIN PTRResponse
-
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
DNS28.118.140.52.in-addr.arpaRemote address:8.8.8.8:53Request28.118.140.52.in-addr.arpaIN PTRResponse
-
DNS154.239.44.20.in-addr.arpaRemote address:8.8.8.8:53Request154.239.44.20.in-addr.arpaIN PTRResponse
-
DNS212.20.149.52.in-addr.arpaRemote address:8.8.8.8:53Request212.20.149.52.in-addr.arpaIN PTRResponse
-
DNS198.187.3.20.in-addr.arpaRemote address:8.8.8.8:53Request198.187.3.20.in-addr.arpaIN PTRResponse
-
DNS86.49.80.91.in-addr.arpaRemote address:8.8.8.8:53Request86.49.80.91.in-addr.arpaIN PTRResponse
-
DNS227.66.18.2.in-addr.arpaRemote address:8.8.8.8:53Request227.66.18.2.in-addr.arpaIN PTRResponse227.66.18.2.in-addr.arpaIN PTRa2-18-66-227deploystaticakamaitechnologiescom
-
DNS29.243.111.52.in-addr.arpaRemote address:8.8.8.8:53Request29.243.111.52.in-addr.arpaIN PTRResponse
No results found
-
8.8.8.8:5313.86.106.20.in-addr.arpadns
DNS Request
13.86.106.20.in-addr.arpa
-
8.8.8.8:53172.210.232.199.in-addr.arpadns
DNS Request
172.210.232.199.in-addr.arpa
-
8.8.8.8:5376.32.126.40.in-addr.arpadns
DNS Request
76.32.126.40.in-addr.arpa
-
8.8.8.8:5395.221.229.192.in-addr.arpadns
DNS Request
95.221.229.192.in-addr.arpa
-
8.8.8.8:5328.118.140.52.in-addr.arpadns
DNS Request
28.118.140.52.in-addr.arpa
-
8.8.8.8:53154.239.44.20.in-addr.arpadns
DNS Request
154.239.44.20.in-addr.arpa
-
8.8.8.8:53212.20.149.52.in-addr.arpadns
DNS Request
212.20.149.52.in-addr.arpa
-
8.8.8.8:53198.187.3.20.in-addr.arpadns
DNS Request
198.187.3.20.in-addr.arpa
-
8.8.8.8:5386.49.80.91.in-addr.arpadns
DNS Request
86.49.80.91.in-addr.arpa
-
8.8.8.8:53227.66.18.2.in-addr.arpadns
DNS Request
227.66.18.2.in-addr.arpa
-
8.8.8.8:5329.243.111.52.in-addr.arpadns
DNS Request
29.243.111.52.in-addr.arpa