Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

21b5f15387...54.exe

windows7-x64

10

21b5f15387...54.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    117s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    22/08/2023, 22:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    21b5f1538730a9c35c240113310af6ffaf96c19aab9c1da391c40df8e3b75554.exe

  • Size

    19KB

  • MD5

    e294976a9609bae82c28379ec4da1e00

  • SHA1

    8c9f46489812bd57cc4626b69e0f64a6e1fb8b1c

  • SHA256

    21b5f1538730a9c35c240113310af6ffaf96c19aab9c1da391c40df8e3b75554

  • SHA512

    bc2bd38ba0c6415b1f286d61087253cf62fca4af3af2fdb0580716591b7aa9eebd69e2a5c2e09e623ed35d4c01788e078d4301c62e7a82c76afe0c77ba48dc71

  • SSDEEP

    192:LV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/2FR7VWF8qa1Dojjgi:lqaCF31cix+Dc4zjK7YFF46gi

Score
10/10
cobaltstrikebackdoortrojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://111.229.211.161:59999/fH9v

Attributes
  • user_agent

    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727; InfoPath.2)

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\21b5f1538730a9c35c240113310af6ffaf96c19aab9c1da391c40df8e3b75554.exe
    "C:\Users\Admin\AppData\Local\Temp\21b5f1538730a9c35c240113310af6ffaf96c19aab9c1da391c40df8e3b75554.exe"
    1⤵
      PID:2804

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2804-54-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2804-55-0x0000000000400000-0x000000000040C000-memory.dmp

      Filesize

      48KB

      Download