Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17/09/2024, 07:34 UTC
Behavioral task
behavioral1
Sample
dca83a92fde0e4b5ab2bad0f6f8011ad.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dca83a92fde0e4b5ab2bad0f6f8011ad.exe
Resource
win10v2004-20240802-en
General
-
Target
dca83a92fde0e4b5ab2bad0f6f8011ad.exe
-
Size
7KB
-
MD5
dca83a92fde0e4b5ab2bad0f6f8011ad
-
SHA1
e6fc2a7fa068f856da1a9f73f04c5398f2ae3cdf
-
SHA256
f32c192e70453d2c04279a33ec3c217211f67009accf0de02e9e51e59d8f4a43
-
SHA512
2f4667e9651a2bf74e2c055c21c8033f4cf60950d216c49f07662ebe680cb0f074257266ee1029bd2f9896bae7b949b295fcc55a9bfebfd42dd91485ddc906c8
-
SSDEEP
24:eFGStrJ9u0/6u2nZdkBQAV2HaYNq9KZq6eNDMSCvOXpmB:is0LOkBQ3ts90SD9C2kB
Malware Config
Extracted
metasploit
metasploit_stager
192.168.0.3:4444
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
Processes
Network
-
Remote address:8.8.8.8:53Request196.249.167.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request134.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request228.249.119.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request209.205.72.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request103.169.127.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request198.187.3.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request30.243.111.52.in-addr.arpaIN PTRResponse
-
73 B 147 B 1 1
DNS Request
196.249.167.52.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
134.32.126.40.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
73 B 159 B 1 1
DNS Request
228.249.119.40.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
209.205.72.20.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
103.169.127.40.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
198.187.3.20.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.214.232.199.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
30.243.111.52.in-addr.arpa