Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
150ae2d57a09fd1b2a6ad8d34362cade0d0cdd3d9db762f995b6ab8f0be32445
-
Size
574KB
-
Sample
221011-j75xwsdgc3
-
MD5
6cded01b63fa3a3bd8a9ad88b3ebcbb6
-
SHA1
97450ff3b0e6f0ec33cef13f6b203e14423fcf9b
-
SHA256
150ae2d57a09fd1b2a6ad8d34362cade0d0cdd3d9db762f995b6ab8f0be32445
-
SHA512
2c7b52f7ed561c8026a4eb9a6ee04fadfdd5d0f83be3439596b5bb8f0f05d90718306bf6d05e8bfdf310e866e26d4f079fcbad17b5e5fcd794efc930d4011f8f
-
SSDEEP
12288:0QpNPhKo149mbgiR2zPMXxMVEkuBZuO9yjREt:Rb5Co0zkhoXuaOQ2
Static task
static1
Behavioral task
behavioral1
Sample
150ae2d57a09fd1b2a6ad8d34362cade0d0cdd3d9db762f995b6ab8f0be32445.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
150ae2d57a09fd1b2a6ad8d34362cade0d0cdd3d9db762f995b6ab8f0be32445.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Targets
-
-
Target
150ae2d57a09fd1b2a6ad8d34362cade0d0cdd3d9db762f995b6ab8f0be32445
-
Size
574KB
-
MD5
6cded01b63fa3a3bd8a9ad88b3ebcbb6
-
SHA1
97450ff3b0e6f0ec33cef13f6b203e14423fcf9b
-
SHA256
150ae2d57a09fd1b2a6ad8d34362cade0d0cdd3d9db762f995b6ab8f0be32445
-
SHA512
2c7b52f7ed561c8026a4eb9a6ee04fadfdd5d0f83be3439596b5bb8f0f05d90718306bf6d05e8bfdf310e866e26d4f079fcbad17b5e5fcd794efc930d4011f8f
-
SSDEEP
12288:0QpNPhKo149mbgiR2zPMXxMVEkuBZuO9yjREt:Rb5Co0zkhoXuaOQ2
Score10/10-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Drops file in Drivers directory
-
Executes dropped EXE
-
Deletes itself
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-