Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11/12/2024, 23:06
Behavioral task
behavioral1
Sample
6f4b311f3d02f380f9160bf3675a2e3661cc7fbc942fa48c9a6f6f2c2a27661c.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
6f4b311f3d02f380f9160bf3675a2e3661cc7fbc942fa48c9a6f6f2c2a27661c.exe
Resource
win10v2004-20241007-en
General
-
Target
6f4b311f3d02f380f9160bf3675a2e3661cc7fbc942fa48c9a6f6f2c2a27661c.exe
-
Size
72KB
-
MD5
ae26f70cf670cbb1dff3afca0efae5e4
-
SHA1
580bed31f6489d6a81200439b04e24a3b09acb96
-
SHA256
6f4b311f3d02f380f9160bf3675a2e3661cc7fbc942fa48c9a6f6f2c2a27661c
-
SHA512
8844265b2db37b2cee1fceb4c9080e4482ca71ec031932a88befb57188e04a82e95496bf4a2687ec51e7ae6170e436a12d65733c4fc2850529f9e3a88318dfca
-
SSDEEP
1536:InHzAUETNba2/2OT9eyyFUBMb+KR0Nc8QsJq39:2ETRDtT9He0Nc8QsC9
Malware Config
Extracted
metasploit
windows/reverse_http
http://102.90.102.24:8080/GmxwDtt-k5HRo9CitvBkOgDRmf2xQysSD_gjvjyRi-TMDWda-4d3bzC_fgn4npb4zi6x7dmXu6NazVkmpKo3I1tNa8Iadnu2KfQWiRyvssogotqm3ttQez2xe7xVCicvrUt8eAxf72juJP_K7KT-CE95cmoKx2IZeSn-Yigb4rkicK276YR6N
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6f4b311f3d02f380f9160bf3675a2e3661cc7fbc942fa48c9a6f6f2c2a27661c.exe