Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
7d52edd1f46bb0b3bb86a943bbd7274ba454408e460a132e4490bc27ecde6244
-
Size
602KB
-
Sample
230930-hk6egahe3x
-
MD5
f49a471f795fe3a12b3c4614cd29f689
-
SHA1
ed1239ae95af75eaf8e4e6f0744b68a1d199962f
-
SHA256
7d52edd1f46bb0b3bb86a943bbd7274ba454408e460a132e4490bc27ecde6244
-
SHA512
387b85cda79be530fd8723d9fd84bf5bb943166ab083047efe17425dd1c802e1ae02890f88b882ff8e859749ab6e6bac56cfce417aa178ee651d070f8a7c3d04
-
SSDEEP
12288:Ah4tgyE4tHdVB/+BHqA95nyH3CGQh13y7n7xh+4EObPsawmfWAFhN:w4trE4tHdmH9ZySV3wxUMLHFuA/
Behavioral task
behavioral1
Sample
7d52edd1f46bb0b3bb86a943bbd7274ba454408e460a132e4490bc27ecde6244.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
7d52edd1f46bb0b3bb86a943bbd7274ba454408e460a132e4490bc27ecde6244.exe
Resource
win10v2004-20230915-en
Malware Config
Extracted
cobaltstrike
391144938
http://service-2saemj0p-1319375115.bj.apigw.tencentcs.com:443/azure/cloud/api/v2/05c284a1a387e
-
access_type
512
-
beacon_type
2048
-
host
service-2saemj0p-1319375115.bj.apigw.tencentcs.com,/azure/cloud/api/v2/05c284a1a387e
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAcAAAAAAAAAAwAAAAIAAAAKU0VTU0lPTklEPQAAAAYAAAAGQ29va2llAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAmQ29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi9vY3RldC1zdHJlYW0AAAAHAAAAAAAAAAMAAAACAAAACUpTRVNTSU9OPQAAAAYAAAAGQ29va2llAAAABwAAAAEAAAADAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
jitter
1792
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDCuApVekElesfYb0KHl9dKWZTQyqcUiBt8UzzFvbY3sZUfYnQYjbnFSblz/vaUosWSMHOPSEXAwJ00q7pt8F7C9Zhzym1U8ACAuNRh2W+aRQ9V3585RgSJt8t3ynifjE+/IEcuRoULXtL+jP/AqS5s9At7yXMrJCKLeNbRxgiz7QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
1.481970944e+09
-
unknown2
AAAABAAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/azure/cloud/api/v2/1a543d786910
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36 uacq
-
watermark
391144938
Targets
-
-
Target
7d52edd1f46bb0b3bb86a943bbd7274ba454408e460a132e4490bc27ecde6244
-
Size
602KB
-
MD5
f49a471f795fe3a12b3c4614cd29f689
-
SHA1
ed1239ae95af75eaf8e4e6f0744b68a1d199962f
-
SHA256
7d52edd1f46bb0b3bb86a943bbd7274ba454408e460a132e4490bc27ecde6244
-
SHA512
387b85cda79be530fd8723d9fd84bf5bb943166ab083047efe17425dd1c802e1ae02890f88b882ff8e859749ab6e6bac56cfce417aa178ee651d070f8a7c3d04
-
SSDEEP
12288:Ah4tgyE4tHdVB/+BHqA95nyH3CGQh13y7n7xh+4EObPsawmfWAFhN:w4trE4tHdmH9ZySV3wxUMLHFuA/
Score10/10 -