Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    07/12/2024, 08:13

General

  • Target

    45ffec583228c67b90d4f5f62fd0b81747981d70e57a442512f7ba6d7fec4161.exe

  • Size

    23KB

  • MD5

    9af9dc6b6787589a73fba155df60ea58

  • SHA1

    aaa09d8ec60b634667e067967874a7595e651675

  • SHA256

    45ffec583228c67b90d4f5f62fd0b81747981d70e57a442512f7ba6d7fec4161

  • SHA512

    6ac0eb1763f700bea75beb170272d0cf2416442bdeb3ef7ec149619a2eeeccfa59f0dc4cac8b13821f958b2976c1e83a504a1156466b7a57a596af4015cb340e

  • SSDEEP

    384:hX+cGRQBELW2Fb7RhAu/o8AE70nYdsxvBg7gJR:nGRQUh7RhN02sxvBp

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

192.168.196.144:456

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Metasploit family

Processes

  • C:\Users\Admin\AppData\Local\Temp\45ffec583228c67b90d4f5f62fd0b81747981d70e57a442512f7ba6d7fec4161.exe
    "C:\Users\Admin\AppData\Local\Temp\45ffec583228c67b90d4f5f62fd0b81747981d70e57a442512f7ba6d7fec4161.exe"
    1⤵
      PID:1292

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1292-0-0x0000000000030000-0x0000000000031000-memory.dmp

      Filesize

      4KB

    • memory/1292-2-0x0000000000030000-0x0000000000031000-memory.dmp

      Filesize

      4KB

    • memory/1292-3-0x0000000000400000-0x000000000040C000-memory.dmp

      Filesize

      48KB