Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
22/12/2024, 14:30 UTC
General
-
Target
internal/extensions/CNativeReg.lua
-
Size
3KB
-
MD5
6b75b1d3f480dcf226ebacff62d35165
-
SHA1
b170d5079a507e9f9fd918ba993498cecb5b69b8
-
SHA256
20298293eaf7060ea4cf99a5b2e790471431166fe618b1032719b01d5d00adc5
-
SHA512
4a0ebd56072f0415f79b79c1ccad3b1acf334a9e8e07e671b27297a9eb6dda1ae34e7c44dc98029f4e8da8e43fe33fcf560fc098d2267312182576f7461e871d
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\internal\extensions\CNativeReg.lua1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
-
DNS13.227.111.52.in-addr.arpaRemote address:8.8.8.8:53Request13.227.111.52.in-addr.arpaIN PTRResponse -
DNS8.173.189.20.in-addr.arpaRemote address:8.8.8.8:53Request8.173.189.20.in-addr.arpaIN PTRResponse
No results found
-
8.8.8.8:5313.227.111.52.in-addr.arpadns
DNS Request
13.227.111.52.in-addr.arpa
DNS Request
8.173.189.20.in-addr.arpa