Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

27/08/2023, 09:11

230827-k5zhrsgf47 10

27/08/2023, 09:04

230827-k1xtdage92 10

General

  • Target

    shell-x86.exe

  • Size

    72KB

  • Sample

    230827-k1xtdage92

  • MD5

    731a851ba42100f006f2c6529bafbd93

  • SHA1

    68733cb8fb9692a49fc1335d17b563ede9cddc8c

  • SHA256

    7625ea528bb506a8fb7501348eaf4271070830600dca0ef4be3ea4856844c07f

  • SHA512

    30282a29901fa33dfd4c8222e7d9ed8bae186af76173bfc3cae50b81442b6fc4b99e46a28b6830b5de21f48262cd903933cecd78cd98112d84a8528c448fc93a

  • SSDEEP

    1536:IoFsvW69TtaorCtiwyQNUW+i6Zha5kfit3cMb+KR0Nc8QsJq39:BFsu679QNj+i6y6fitMe0Nc8QsC9

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

147.185.221.16:33811

Targets

    • Target

      shell-x86.exe

    • Size

      72KB

    • MD5

      731a851ba42100f006f2c6529bafbd93

    • SHA1

      68733cb8fb9692a49fc1335d17b563ede9cddc8c

    • SHA256

      7625ea528bb506a8fb7501348eaf4271070830600dca0ef4be3ea4856844c07f

    • SHA512

      30282a29901fa33dfd4c8222e7d9ed8bae186af76173bfc3cae50b81442b6fc4b99e46a28b6830b5de21f48262cd903933cecd78cd98112d84a8528c448fc93a

    • SSDEEP

      1536:IoFsvW69TtaorCtiwyQNUW+i6Zha5kfit3cMb+KR0Nc8QsJq39:BFsu679QNj+i6y6fitMe0Nc8QsC9

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Drops file in Drivers directory

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops desktop.ini file(s)

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks