Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26/07/2024, 05:59
Behavioral task
behavioral1
Sample
cad274c5c0130cf5a21aa44914bbee5fa1b8205c7b19843ea2ee1054e671c3cd.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
cad274c5c0130cf5a21aa44914bbee5fa1b8205c7b19843ea2ee1054e671c3cd.exe
Resource
win10v2004-20240709-en
General
-
Target
cad274c5c0130cf5a21aa44914bbee5fa1b8205c7b19843ea2ee1054e671c3cd.exe
-
Size
5.7MB
-
MD5
a3c08ba1a63a6789186de34cd55ec710
-
SHA1
a5abffea8b4fa8a7fdd45cf405a1dce25b5bda98
-
SHA256
cad274c5c0130cf5a21aa44914bbee5fa1b8205c7b19843ea2ee1054e671c3cd
-
SHA512
e8b3d3daea255a731bd0dc9c447542a0a5cecddcf1bb02fdfdd7eb30afcbd9a75e01e9889bfd8b95a165ff6ed0a2b2dc2dbf5a5866085d92e0877e5e4a5e8f85
-
SSDEEP
98304:CXbBg9hU36OshoKyDvuIYc5AhVYEc4kZvRLoI0EJfNAIjvJJT1aOcKoS:CrBQ6qOshoKMuIkhVfstRL5Die1Zc
Malware Config
Extracted
metasploit
metasploit_stager
101.33.35.171:8080
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Loads dropped DLL 4 IoCs
pid Process 4732 cad274c5c0130cf5a21aa44914bbee5fa1b8205c7b19843ea2ee1054e671c3cd.exe 4732 cad274c5c0130cf5a21aa44914bbee5fa1b8205c7b19843ea2ee1054e671c3cd.exe 4732 cad274c5c0130cf5a21aa44914bbee5fa1b8205c7b19843ea2ee1054e671c3cd.exe 4732 cad274c5c0130cf5a21aa44914bbee5fa1b8205c7b19843ea2ee1054e671c3cd.exe -
resource yara_rule behavioral2/files/0x0007000000023487-13.dat upx behavioral2/memory/4732-17-0x00007FFCC9F30000-0x00007FFCCA519000-memory.dmp upx behavioral2/files/0x0007000000023486-22.dat upx behavioral2/memory/4732-32-0x00007FFCDC820000-0x00007FFCDC82F000-memory.dmp upx behavioral2/memory/4732-31-0x00007FFCDAF20000-0x00007FFCDAF43000-memory.dmp upx behavioral2/files/0x0007000000023483-30.dat upx behavioral2/files/0x0007000000023482-29.dat upx behavioral2/files/0x0007000000023481-28.dat upx behavioral2/files/0x0007000000023480-27.dat upx behavioral2/files/0x000700000002347e-26.dat upx behavioral2/files/0x0007000000023489-25.dat upx behavioral2/files/0x0007000000023488-24.dat upx behavioral2/files/0x0007000000023485-23.dat upx behavioral2/files/0x000700000002347f-20.dat upx behavioral2/memory/4732-35-0x00007FFCDAF20000-0x00007FFCDAF43000-memory.dmp upx behavioral2/memory/4732-34-0x00007FFCC9F30000-0x00007FFCCA519000-memory.dmp upx -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4132 wrote to memory of 4732 4132 cad274c5c0130cf5a21aa44914bbee5fa1b8205c7b19843ea2ee1054e671c3cd.exe 86 PID 4132 wrote to memory of 4732 4132 cad274c5c0130cf5a21aa44914bbee5fa1b8205c7b19843ea2ee1054e671c3cd.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\cad274c5c0130cf5a21aa44914bbee5fa1b8205c7b19843ea2ee1054e671c3cd.exe"C:\Users\Admin\AppData\Local\Temp\cad274c5c0130cf5a21aa44914bbee5fa1b8205c7b19843ea2ee1054e671c3cd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\cad274c5c0130cf5a21aa44914bbee5fa1b8205c7b19843ea2ee1054e671c3cd.exe"C:\Users\Admin\AppData\Local\Temp\cad274c5c0130cf5a21aa44914bbee5fa1b8205c7b19843ea2ee1054e671c3cd.exe"2⤵
- Loads dropped DLL
PID:4732
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
106KB
MD549c96cecda5c6c660a107d378fdfc3d4
SHA100149b7a66723e3f0310f139489fe172f818ca8e
SHA25669320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc
SHA512e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d
-
Filesize
48KB
MD5074658809b7739daf9962894ce337a17
SHA163eadec06727c7064fb2c65ffa2ece8b54190ff6
SHA2565a9ebf3c91c7330fd2cc49a05fcae7cd228e860bf0f16d230ec3f644941d826d
SHA512781f4768ee9509f682e48cac57002d820bb8be475227fb507964f3ea38b533b1604bc7939ce2bfef7244d14f94898e9ea39e1ba46884561bd802a3f01d2d40b6
-
Filesize
58KB
MD5696c720001b6087f5a95a0cbc4c2bcca
SHA10b964ef70c8bf24142ab35d4b9a72f54e7ec62d1
SHA2562f77772b466d50d6ea4f644d7238769468578dfad2001256544d81491257fa3a
SHA51276e922f7f78c718f10f59a5b7c78aa0cf429d62d088b5c912563f3448f319240050b7401302ea602f1ec1214d721f910dacc7b5fc94b725ad4a5dab3bd560ede
-
Filesize
106KB
MD5dca1d61090e4bf630c69295c3f73aeb4
SHA1309094a642c80dcec5b550d90e888d3891e436cb
SHA256ed1608a8bfb5758efe2bec77eebe82c42dbd26f9a1941a5bff853579cf94d7d8
SHA5125baa0bac70b9c3ff81c371606ae8d1e2111ed50c3c9e8fcde8eb0fdfc3b6cb3d281317629b85d4f7d0fa762acece47f6b19b080637365b815f8f1ad41ba5c282
-
Filesize
35KB
MD5deefb50bf92caa14407de92f63d97316
SHA10dccd6925d4171e88f395354486205abcc244333
SHA256f7ede0240a02e20af7c852640cd835cf64229785ebef9d10f16ab42a17334fbd
SHA5123221f88252358fd0eb7efd194a57f101817bfc69f01f0e5116d08d041a188d03b832d8802be2389bee1facc55cc7b26ce299211c70175c4caa7d2f83cd049774
-
Filesize
85KB
MD5308723d2713e45a9412827321930939e
SHA19d2ca209064e09fc68f5fe76e11f03eb99921fdf
SHA2561cda1402b090d18537d50c36123ad84e856983fcc5e7892c0fdf1343bc3b0942
SHA5127664fc39a562b7c038a087e5f13b16923a93c4df2a21702746a8686fd25e4c75357147cac334afbbd23a3b875f91322070c370c3cfed46b39e63beeb5a80231d
-
Filesize
43KB
MD5d93c08f62c60c9aaa9a5f729f097e29a
SHA1e7c14670c0738b6620daf28010cece947048defe
SHA256140670f377873d74d4ec32fd0cedc9c92baa725bdaa159a672e5d446a0cb3fd3
SHA512843f427cd19b0700fff6f52a69a6a3bdde10e8ff3c12db837bae4d749e00a0d557a0ba348ccbab3201418fd55ba71730b52a036053a0c7ba7ca73251968d74d0
-
Filesize
1.4MB
MD532ede00817b1d74ce945dcd1e8505ad0
SHA151b5390db339feeed89bffca925896aff49c63fb
SHA2564a73d461851b484d213684f0aadf59d537cba6fe7e75497e609d54c9f2ba5d4a
SHA512a0e070b2ee1347e85f37e9fd589bc8484f206fa9c8f4020de147b815d2041293551e3a14a09a6eb4050cfa1f74843525377e1a99bbdcfb867b61ebddb89f21f7
-
Filesize
1.6MB
MD559a466b472e27156bfd20a3fef7ef0d9
SHA1b8a082bc0e2a2e83f35b507865abc4ff4b59d636
SHA2567bbf883c8b6c7240277444366bc50a239b250ef2c228d148a3bfb6318f23c1f4
SHA512e977211288c2d43031661150fa44d037f9e690faa63cabfd207a967050baa73cf86e14e8d6b29f1efcef2177e034ebb829948ebdf21652851213ec10b5142771
-
Filesize
29KB
MD50aac034efb1509907c8d580b51ad3c4a
SHA1d5d69211c79ec30a932d0945e776b8fc4c42e383
SHA256a174a301f6de532aa75bcae9bb038efa29debcc02e70b283bf87ae54d55a729b
SHA512417c8c1c5e3d2fdf9af4e7585e4eb47a8ff22cdfda91124885406f04137ead8099b1fd70df293eaa5ea251568aad753fc4cdbe5b83420ae9d11af176901ff6be
-
Filesize
1.6MB
MD50530156b6dabd7c2148bcc721eb4449f
SHA19ccafc5a17d3a25951ee14806241e8e38236d767
SHA256739c60648ee4a3ac7ea7f37ec730e67898b149fc5b9f4cdef5ab0b69c5664170
SHA512d919f92bd7a2c385fd77e58678aaaad5261d8ccad1fd84b42412acd275959efa7926ff85ef44f98a59199fbbf1bcdc6a1efef1516decf102c263c7311a3faf01
-
Filesize
25KB
MD58792eef650ba2cbb32f809457643c62f
SHA1eda4f2aa9b457ac807597e774baf15b31f1e8a5d
SHA256f248e68487ea30bea29b62a8bb5d6f06ddaf14dca6afafe33ef48f6ea62adaf0
SHA5128b5d122eaacf4f7e5baecf6045fc76e6976abfef8c0437bb2c8dc344159423bfd665970a822257c646216b3771d916d2cacf9f9cca580e060fd77fb247f2fa4f
-
Filesize
295KB
MD5b6d15bfb270bee9dd2916b42dc3947ff
SHA1ef3383ab8764bf8caa5bae0fd6d06fb3d55f23ec
SHA2561a65fa67ba1a9ef5d29ba3db6ffe2e785590b684d1afa6f5b32e74d1ae6dfcad
SHA5127cf5a2ea1cbb90eee84fc4764dab4fa72bb240e4fb40cb0f99f0e5aff9ef912796fab264163c1f95a15b8a57aae8aca91838454136c8f8b98bce503e3453addf