Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/08/2024, 19:39
Static task
static1
Behavioral task
behavioral1
Sample
deb336e0992d49f57fcc9966485dee718b8da4e178ad3bb618984f59e343dd91.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
deb336e0992d49f57fcc9966485dee718b8da4e178ad3bb618984f59e343dd91.exe
Resource
win10v2004-20240802-en
General
-
Target
deb336e0992d49f57fcc9966485dee718b8da4e178ad3bb618984f59e343dd91.exe
-
Size
165KB
-
MD5
cd2cdb25acacebc2664ea201138cfefe
-
SHA1
8c0109d840fbfde8ed7924f652b5d5b98aac9ebd
-
SHA256
deb336e0992d49f57fcc9966485dee718b8da4e178ad3bb618984f59e343dd91
-
SHA512
39183b8c166c9d755ba945b0a661e573d604e1e972483f5e5ceae065024d4451425a8a5de59ac1fb6fc9c9853ca4428cdd0e0ceabc3192715e65f93d0df3d220
-
SSDEEP
3072:Yf+GYrgxI0c5XI/NklH0iNL2Sl8BJoNEWoY46UolkeERh:ndr0I0c5XICuiNLnluOdohPolWR
Malware Config
Extracted
metasploit
metasploit_stager
192.168.248.128:4444
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Executes dropped EXE 1 IoCs
pid Process 3000 irfrg.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3268 wrote to memory of 3000 3268 deb336e0992d49f57fcc9966485dee718b8da4e178ad3bb618984f59e343dd91.exe PID 3268 wrote to memory of 3000 3268 deb336e0992d49f57fcc9966485dee718b8da4e178ad3bb618984f59e343dd91.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\deb336e0992d49f57fcc9966485dee718b8da4e178ad3bb618984f59e343dd91.exe"C:\Users\Admin\AppData\Local\Temp\deb336e0992d49f57fcc9966485dee718b8da4e178ad3bb618984f59e343dd91.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3268 -
\Users\Admin\AppData\Local\Temp\irfrg.exe2⤵
- Executes dropped EXE
PID:3000
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
27KB
MD55da8c98136d98dfec4716edd79c7145f
SHA1ed13af4a0a754b8daee4929134d2ff15ebe053cd
SHA25658189cbd4e6dc0c7d8e66b6a6f75652fc9f4afc7ce0eba7d67d8c3feb0d5381f
SHA5126e2b067760ec178cdcc4df04c541ce6940fc2a0cdd36f57f4d6332e38119dbc5e24eb67c11d2c8c8ffeed43533c2dd8b642d2c7c997c392928091b5ccce7582a