Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

a26d2d6e20...cf.exe

windows7-x64

10

a26d2d6e20...cf.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    91s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/06/2024, 12:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a26d2d6e2027312156914ea918e8ec5058f310852c3b45877d56c37c47acc3cf.exe

  • Size

    5.4MB

  • MD5

    342c2f771ac258ff0a03e68c5164daff

  • SHA1

    6f05adbacb0881ff4487740ea2de06a072f177aa

  • SHA256

    a26d2d6e2027312156914ea918e8ec5058f310852c3b45877d56c37c47acc3cf

  • SHA512

    eefd6bdf935005808266c4836ac33d52d8c511b5e99b36a4362a01a4b4ae99025e7ba449c46f03c0535385ac8c9e51ea02b8d6e996dc33343e97688c4a1beea9

  • SSDEEP

    98304:cCF+OIyoWoZ61i0hUNfHBiCV2HW/40hUNfHBiCV2HvNX/:f+OIynoRjNIK4jNYB

Score
10/10
metasploitbackdoortrojan

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit
  • Loads dropped DLL 3 IoCs
  • Program crash 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a26d2d6e2027312156914ea918e8ec5058f310852c3b45877d56c37c47acc3cf.exe
    "C:\Users\Admin\AppData\Local\Temp\a26d2d6e2027312156914ea918e8ec5058f310852c3b45877d56c37c47acc3cf.exe"
    1⤵
    • Loads dropped DLL
    PID:1668
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 552
      2⤵
      • Program crash
      PID:3228
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 1516
      2⤵
      • Program crash
      PID:432
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1668 -ip 1668
    1⤵
      PID:1644
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1668 -ip 1668
      1⤵
        PID:3860

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\Setup\ds.dll
        Filesize

        67KB

        MD5

        7d5d3e2fcfa5ff53f5ae075ed4327b18

        SHA1

        3905104d8f7ba88b3b34f4997f3948b3183953f6

        SHA256

        e1fb95609f2757ce74cb531a5cf59674e411ea0a262b758371d7236c191910c4

        SHA512

        e67683331bb32ea4b2c38405be7f516db6935f883a1e4ae02a1700f5f36462c31b593e07c6fe06d8c0cb1c20c9f40a507c9eae245667c89f989e32765a89f589

        Download Submit

      • memory/1668-0-0x0000000000400000-0x000000000097B094-memory.dmp

        Filesize

        5.5MB

        Download

      • memory/1668-13-0x0000000005AD0000-0x0000000005AE0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1668-14-0x0000000072A0E000-0x0000000072A0F000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1668-18-0x0000000005A40000-0x0000000005A54000-memory.dmp

        Filesize

        80KB

        Download

      • memory/1668-19-0x0000000000400000-0x000000000097B094-memory.dmp

        Filesize

        5.5MB

        Download