Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    150ae2d57a09fd1b2a6ad8d34362cade0d0cdd3d9db762f995b6ab8f0be32445

  • Size

    574KB

  • Sample

    221011-j75xwsdgc3

  • MD5

    6cded01b63fa3a3bd8a9ad88b3ebcbb6

  • SHA1

    97450ff3b0e6f0ec33cef13f6b203e14423fcf9b

  • SHA256

    150ae2d57a09fd1b2a6ad8d34362cade0d0cdd3d9db762f995b6ab8f0be32445

  • SHA512

    2c7b52f7ed561c8026a4eb9a6ee04fadfdd5d0f83be3439596b5bb8f0f05d90718306bf6d05e8bfdf310e866e26d4f079fcbad17b5e5fcd794efc930d4011f8f

  • SSDEEP

    12288:0QpNPhKo149mbgiR2zPMXxMVEkuBZuO9yjREt:Rb5Co0zkhoXuaOQ2

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Targets

    • Target

      150ae2d57a09fd1b2a6ad8d34362cade0d0cdd3d9db762f995b6ab8f0be32445

    • Size

      574KB

    • MD5

      6cded01b63fa3a3bd8a9ad88b3ebcbb6

    • SHA1

      97450ff3b0e6f0ec33cef13f6b203e14423fcf9b

    • SHA256

      150ae2d57a09fd1b2a6ad8d34362cade0d0cdd3d9db762f995b6ab8f0be32445

    • SHA512

      2c7b52f7ed561c8026a4eb9a6ee04fadfdd5d0f83be3439596b5bb8f0f05d90718306bf6d05e8bfdf310e866e26d4f079fcbad17b5e5fcd794efc930d4011f8f

    • SSDEEP

      12288:0QpNPhKo149mbgiR2zPMXxMVEkuBZuO9yjREt:Rb5Co0zkhoXuaOQ2

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Deletes itself

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v6

Tasks