Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
31s -
max time network
110s -
platform
windows7_x64 -
resource
win7-20230621-en -
resource tags
arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system -
submitted
28/06/2023, 20:08
Static task
static1
Behavioral task
behavioral1
Sample
boost-bo.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
boost-bo.exe
Resource
win10v2004-20230621-en
General
-
Target
boost-bo.exe
-
Size
4.6MB
-
MD5
cfd6e46ebad87e50cd5aa8d6b874d409
-
SHA1
e2adb61cd2c84a6d00f6b646c0fc50d2065ef382
-
SHA256
aa203ad2aac0bf8b392ec2add640ba020c2ed9938bea18dbf26631e9faa70f9d
-
SHA512
679eb63a890cd85c24e94d96a1af7f6b125f0818eb1652626da7e99144e6378ee89f2949bc812c40b0761db84fb3f2b5a389ccad6cd192ff02a74d7e67d8ec1a
-
SSDEEP
98304:z6+CSZXttEB+1r2oid4wr3v5wvVeqgkqXf0FGIrjMW94z9OUj:aSZnl1Coid4w34gkSIrYW94
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
resource yara_rule behavioral1/memory/1984-57-0x0000000005480000-0x0000000005728000-memory.dmp family_agenttesla -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule behavioral1/memory/1984-55-0x00000000009F0000-0x0000000000A3E000-memory.dmp agile_net -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS boost-bo.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer boost-bo.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion boost-bo.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1984 boost-bo.exe