Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/12/2024, 08:59 UTC
Behavioral task
behavioral1
Sample
1d4f27ea1bdf9ab533fbe450297d218246109d657cb5a3a5f62ae65ce6413b29.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
1d4f27ea1bdf9ab533fbe450297d218246109d657cb5a3a5f62ae65ce6413b29.exe
Resource
win10v2004-20241007-en
General
-
Target
1d4f27ea1bdf9ab533fbe450297d218246109d657cb5a3a5f62ae65ce6413b29.exe
-
Size
72KB
-
MD5
0249cce8c47ef7fc7955f6d457354417
-
SHA1
fc9c9ca587a8bf9c061b81d72d5454ee5d3a03ec
-
SHA256
1d4f27ea1bdf9ab533fbe450297d218246109d657cb5a3a5f62ae65ce6413b29
-
SHA512
4bc32bec26cbd56ab0d08371d3f84fd34edca478954ae703fc642d51c72dd77bf7ac7ca352f95d8febb9f39b2ec58c2e53e1b8b577ac18bfc390111178b604e0
-
SSDEEP
1536:Iyg63UO8YEe6av68p3kPeywfsVXnMb+KR0Nc8QsJq3F:RgWUO8YEe6avHmBwfsxne0Nc8QsCF
Malware Config
Extracted
metasploit
windows/reverse_tcp
10.10.100.148:8888
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1d4f27ea1bdf9ab533fbe450297d218246109d657cb5a3a5f62ae65ce6413b29.exe
Processes
Network
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Request154.239.44.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request86.49.80.91.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request2.159.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request241.150.49.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request212.20.149.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request241.42.69.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request19.229.111.52.in-addr.arpaIN PTRResponse
-
66 B 90 B 1 1
DNS Request
8.8.8.8.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
154.239.44.20.in-addr.arpa
-
70 B 145 B 1 1
DNS Request
86.49.80.91.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
2.159.190.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
241.150.49.20.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
212.20.149.52.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
241.42.69.40.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.214.232.199.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.210.232.199.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
19.229.111.52.in-addr.arpa