Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
443s -
max time network
457s -
platform
windows11-21h2_x64 -
resource
win11-20241007-es -
resource tags
-
submitted
03/02/2025, 14:18 UTC
General
-
Target
ChjokM3/Load/bn.pak
-
Size
780KB
-
MD5
cb203032925be270222dc2c20fe771e2
-
SHA1
2f2f20bbbd07ee01cc996247bd9c2f40037dff80
-
SHA256
297d52b252df0912490ddf26fa58706895e70c2a0f3f09d0dc756706720095ef
-
SHA512
052be75c51051949c84216566b462733b61026ba74e212b000cbed7d93cb852e74ae83d64d2eaadc3093af4265b6783184cf8e0368a75e077d4b75daba40f9b4
-
SSDEEP
3072:Kw+ZjJj+E7z0eC6HcvR1kgBbdawSU5ZwXll4:4tJXZ78vRNBbdz5ily
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ChjokM3\Load\bn.pak1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
-
DNS29.243.111.52.in-addr.arpaRemote address:8.8.8.8:53Request29.243.111.52.in-addr.arpaIN PTRResponse -
DNS233.17.178.52.in-addr.arpaRemote address:8.8.8.8:53Request233.17.178.52.in-addr.arpaIN PTRResponse
-
DNS5.114.82.104.in-addr.arpaRemote address:8.8.8.8:53Request5.114.82.104.in-addr.arpaIN PTRResponse5.114.82.104.in-addr.arpaIN PTRa104-82-114-5deploystaticakamaitechnologiescom
-
DNS172.214.232.199.in-addr.arpaRemote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
No results found
-
8.8.8.8:5329.243.111.52.in-addr.arpadns
DNS Request
29.243.111.52.in-addr.arpa
DNS Request
233.17.178.52.in-addr.arpa
DNS Request
5.114.82.104.in-addr.arpa
DNS Request
172.214.232.199.in-addr.arpa