Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

07fb7b42fe...35.exe

windows7-x64

1

07fb7b42fe...35.exe

windows10-2004-x64

8

4fa565cc2e...af.exe

windows7-x64

1

4fa565cc2e...af.exe

windows10-2004-x64

3

949c262359...70.ps1

windows7-x64

3

949c262359...70.ps1

windows10-2004-x64

3

b3b66f7e70...62.exe

windows7-x64

10

b3b66f7e70...62.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_9f7d7e4003c915993d80e9a126cf9f458fc65b3ee8da0617ee1ae7b6f23754ca

  • Size

    166KB

  • Sample

    241226-wg49wstjfy

  • MD5

    1d673c09da0971c6273ffe215c19e8e0

  • SHA1

    ef93e160117ea7c35ca6ac60b1696e70a1543aa1

  • SHA256

    9f7d7e4003c915993d80e9a126cf9f458fc65b3ee8da0617ee1ae7b6f23754ca

  • SHA512

    4ee6671ae54f0da9f886e5a21b414afb073a7037b4f1b710eb552295ad047f17662c7070dc6c1cf33073abea5529b444526341f3b575b75bbc72a7ce9b13489e

  • SSDEEP

    3072:qD1uYAro6WOyp4NziKo8vYzn70mm8AhJLlTA2undWkh324JbriCaW4qq:eJIo5OypAzioAv0mXEfwE14Ja5

Score
10/10
metasploitbackdoordiscoveryexecutiontrojan

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

185.219.52.229:6666

Targets

    • Target

      07fb7b42fe8d4a2125df459efd86de0f27b91b59d82b85b530c1e7c552c9e235

    • Size

      131KB

    • MD5

      17eb8fa4b86a2f5ec5cb789545902181

    • SHA1

      cb40cc63b23bc335aa095606c07b56f2d2d71bb9

    • SHA256

      07fb7b42fe8d4a2125df459efd86de0f27b91b59d82b85b530c1e7c552c9e235

    • SHA512

      cce3789d6e5395f701c9ff10467c3352568f7a3cea13cfd55e6b6f1bade8f01a56a8c1a433940fa1ccdce201941788717f6d486cef40f59d2bac075eaf696573

    • SSDEEP

      1536:j/tSikO5ssRyJmapXRQVO6eWkYolZPt1AUvMFMQiNwRVRky3es:xSWqLQAYolZPt1oJRfky3es

    Score
    8/10

    • Blocklisted process makes network request

    behavioral1behavioral2

    • Target

      4fa565cc2ebfe97b996786facdb454e4328a28792e27e80e8b46fe24b44781af

    • Size

      121KB

    • MD5

      5dfa998f62612e10d5d28d26948dd50f

    • SHA1

      05618b47ccf5aba595fba60feb30969b5500abb3

    • SHA256

      4fa565cc2ebfe97b996786facdb454e4328a28792e27e80e8b46fe24b44781af

    • SHA512

      83a0f6b9b43d88ea704f0d006937e020a2dd7c207bc84937d2ca6d80f808b0b583a555082eb529c902f2194cb872a23d5666302908f3ed0418f061e50c56defa

    • SSDEEP

      3072:FGLXPggYI4tRE/UAhW9SOsRHor5bHVZ3D1Lowg0p53NTz0cKzWZH28wjJ5Pq+ZoR:F2XIgYxZxPT53NjK2H6PSDlu9sYtC0gF

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      949c262359f87c8a0e8747f28a89cf3d519b35fbc5a8be81b2cd9e6adc830370

    • Size

      37KB

    • MD5

      a6a766fd8efeea07b329c021d0bc09d5

    • SHA1

      891de74f70bfa1287e9571b08fcc45b10b198ccc

    • SHA256

      949c262359f87c8a0e8747f28a89cf3d519b35fbc5a8be81b2cd9e6adc830370

    • SHA512

      0d5e7d6633fe2d001cf518b503a922151e73fcc7969eafff998be928f6a2eba37f3d8d1e68248661df8142459a0c7cfb3ea9b4df6d255f95aad12bc1b1bdf187

    • SSDEEP

      384:vPNNx1zN7un9F350gb2swSaCIeMMI4RqqRfhIVnOicCfKsBnLTSLYBFo/WU8wWmO:vx3u33XqqaRiUflhfp9JR6jKOK+UNDVL

    Score
    3/10
    execution
    behavioral5behavioral6

    • Target

      b3b66f7e70f1e1b1494677d0ed79fcc7d4901ffae53d89fd023c8b789bb0fe62

    • Size

      72KB

    • MD5

      40cb99cdde860d159793e217d9e63eeb

    • SHA1

      a243f2226a6db344c0633bd8b55311df19317887

    • SHA256

      b3b66f7e70f1e1b1494677d0ed79fcc7d4901ffae53d89fd023c8b789bb0fe62

    • SHA512

      cb30a76fe94a1028602d156475bb2a923fda77880256e5b9519b9e4228dba6e143f07d138410c64844e2dfb279fee3c776a02ac83d781e19cfd38b4fb34bab5c

    • SSDEEP

      1536:IJDXZcEooqufiH37Mt1f0jGubeJxsoMb+KR0Nc8QsJq39:KzZc8fiH37Mt1fGGpJaoe0Nc8QsC9

    Score
    10/10
    metasploitbackdoordiscoverytrojan

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit

    • Metasploit family

      metasploit
    behavioral7behavioral8

MITRE ATT&CK Enterprise v15

Tasks