Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
24/01/2025, 09:11 UTC
General
-
Target
Spoofer/run after cleaner/Monotone-HWID-Spoofer-0.0.1/Commands/Hidden/process.bat
-
Size
1001B
-
MD5
2d3f9b2d001abd6e58ac6f0e7337c619
-
SHA1
7053a604a394f479b643783098adb056d69a404b
-
SHA256
ef702ce2f8fb1bc71fb60e8b95cb83cef4fa66aa96afd7ca4fd67c96530b6e53
-
SHA512
60d4a7e203e37194f4a78f1c581728197b3cd6581d70e185ba6d0d8206aca3a732319b28fef776028015615ebc0ab164a9c935081cd2496b866c63ad6358fccf
Score
5/10
Malware Config
Signatures
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Spoofer\run after cleaner\Monotone-HWID-Spoofer-0.0.1\Commands\Hidden\process.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping localhost2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\tasklist.exetasklist /NH /FI "imagename eq Monotone.exe"2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\find.exefind /i "Monotone.exe"2⤵
-
Network
-
DNS97.17.167.52.in-addr.arpaRemote address:8.8.8.8:53Request97.17.167.52.in-addr.arpaIN PTRResponse -
DNS218.110.86.104.in-addr.arpaRemote address:8.8.8.8:53Request218.110.86.104.in-addr.arpaIN PTRResponse218.110.86.104.in-addr.arpaIN PTRa104-86-110-218deploystaticakamaitechnologiescom
-
DNS68.159.190.20.in-addr.arpaRemote address:8.8.8.8:53Request68.159.190.20.in-addr.arpaIN PTRResponse
-
DNS227.0.24.184.in-addr.arpaRemote address:8.8.8.8:53Request227.0.24.184.in-addr.arpaIN PTRResponse227.0.24.184.in-addr.arpaIN PTRa184-24-0-227deploystaticakamaitechnologiescom
-
DNS28.118.140.52.in-addr.arpaRemote address:8.8.8.8:53Request28.118.140.52.in-addr.arpaIN PTRResponse
-
DNS209.205.72.20.in-addr.arpaRemote address:8.8.8.8:53Request209.205.72.20.in-addr.arpaIN PTRResponse
-
DNS200.163.202.172.in-addr.arpaRemote address:8.8.8.8:53Request200.163.202.172.in-addr.arpaIN PTRResponse
-
DNS15.164.165.52.in-addr.arpaRemote address:8.8.8.8:53Request15.164.165.52.in-addr.arpaIN PTRResponse
-
DNS24.66.18.2.in-addr.arpaRemote address:8.8.8.8:53Request24.66.18.2.in-addr.arpaIN PTRResponse24.66.18.2.in-addr.arpaIN PTRa2-18-66-24deploystaticakamaitechnologiescom
-
DNS172.214.232.199.in-addr.arpaRemote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
No results found
-
8.8.8.8:5397.17.167.52.in-addr.arpadns
DNS Request
97.17.167.52.in-addr.arpa
-
8.8.8.8:53218.110.86.104.in-addr.arpadns
DNS Request
218.110.86.104.in-addr.arpa
-
8.8.8.8:5368.159.190.20.in-addr.arpadns
DNS Request
68.159.190.20.in-addr.arpa
-
8.8.8.8:53227.0.24.184.in-addr.arpadns
DNS Request
227.0.24.184.in-addr.arpa
-
8.8.8.8:5328.118.140.52.in-addr.arpadns
DNS Request
28.118.140.52.in-addr.arpa
-
8.8.8.8:53209.205.72.20.in-addr.arpadns
DNS Request
209.205.72.20.in-addr.arpa
-
8.8.8.8:53200.163.202.172.in-addr.arpadns
DNS Request
200.163.202.172.in-addr.arpa
-
8.8.8.8:5315.164.165.52.in-addr.arpadns
DNS Request
15.164.165.52.in-addr.arpa
-
8.8.8.8:5324.66.18.2.in-addr.arpadns
DNS Request
24.66.18.2.in-addr.arpa
-
8.8.8.8:53172.214.232.199.in-addr.arpadns
DNS Request
172.214.232.199.in-addr.arpa