Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
16/09/2024, 09:54
General
-
Target
$R9/Plugins/tftp.exe
-
Size
95KB
-
MD5
21e42b4fdb800644335dd8cc95826c7b
-
SHA1
23ec304fab33af1cacf0a167aeb7465631286128
-
SHA256
73ddf0df4e9e3866511ef9eae421b11615b81491d0db1d4a7ed19441e368ecef
-
SHA512
7fe97cc38afea51b8b8776c860d49d3cac92df63f6acd4f647056a6210288ac387d499e8f6f281cdd31d73e6f1218bc08baa696b0c7c8d33d55543875c1be7b6
-
SSDEEP
1536:NW7lchydMBUxt/lP8KB1R88EKaoLQWAmcTGI7Unt:MChye+x38KrRLMUnt
Score
10/10
Malware Config
Extracted
Credentials
Protocol: ftp- Host:
5.56.60.2 - Port:
21 - Username:
user - Password:
chocolat
Extracted
Credentials
Protocol: ftp- Host:
68.233.246.4 - Port:
21 - Username:
root - Password:
asdf
Extracted
Credentials
Protocol: ftp- Host:
185.146.22.4 - Port:
21 - Username:
root - Password:
tudelft
Extracted
Credentials
Protocol: ftp- Host:
77.72.82.8 - Port:
21 - Username:
ftp
Extracted
Credentials
Protocol: ftp- Host:
212.96.133.11 - Port:
21 - Username:
user - Password:
11111111
Signatures
-
Contacts a large (1080) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\$R9\Plugins\tftp.exe"C:\Users\Admin\AppData\Local\Temp\$R9\Plugins\tftp.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
132KB