Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10up.zip
windows7-x64
1up.zip
windows10-2004-x64
1Cloakedbgf...so.iso
windows7-x64
3Cloakedbgf...so.iso
windows10-2004-x64
3Information.lnk
windows7-x64
3Information.lnk
windows10-2004-x64
6_
windows7-x64
1_
windows10-2004-x64
1agenda.exe
windows7-x64
1agenda.exe
windows10-2004-x64
6vcruntime140.dll
windows7-x64
1vcruntime140.dll
windows10-2004-x64
8vctool140.dll
windows7-x64
1vctool140.dll
windows10-2004-x64
8Guloaderbg...so.iso
windows7-x64
3Guloaderbg...so.iso
windows10-2004-x64
3Iisbgfhaci...ll.dll
windows7-x64
3Iisbgfhaci...ll.dll
windows10-2004-x64
3Iranbggaia...xe.exe
windows7-x64
7Iranbggaia...xe.exe
windows10-2004-x64
7Knotweedbg...ll.dll
windows7-x64
1Knotweedbg...ll.dll
windows10-2004-x64
1Magicratbg...xe.exe
windows7-x64
10Magicratbg...xe.exe
windows10-2004-x64
10Newcoppers...xe.exe
windows7-x64
4Newcoppers...xe.exe
windows10-2004-x64
4Newlogfors...xe.exe
windows7-x64
4Newlogfors...xe.exe
windows10-2004-x64
4Purecrypte...xe.dll
windows7-x64
1Purecrypte...xe.dll
windows10-2004-x64
1Purecrypte...xe.dll
windows7-x64
1Purecrypte...xe.dll
windows10-2004-x64
1Analysis
-
max time kernel
144s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
01/08/2023, 19:38
Behavioral task
behavioral1
Sample
up.zip
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
up.zip
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
Cloakedbgfjfjjaea5_browsingIso.iso
Resource
win7-20230712-en
Behavioral task
behavioral4
Sample
Cloakedbgfjfjjaea5_browsingIso.iso
Resource
win10v2004-20230703-en
Behavioral task
behavioral5
Sample
Information.lnk
Resource
win7-20230712-en
Behavioral task
behavioral6
Sample
Information.lnk
Resource
win10v2004-20230703-en
Behavioral task
behavioral7
Sample
_
Resource
win7-20230712-en
Behavioral task
behavioral8
Sample
_
Resource
win10v2004-20230703-en
Behavioral task
behavioral9
Sample
agenda.exe
Resource
win7-20230712-en
Behavioral task
behavioral10
Sample
agenda.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral11
Sample
vcruntime140.dll
Resource
win7-20230712-en
Behavioral task
behavioral12
Sample
vcruntime140.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral13
Sample
vctool140.dll
Resource
win7-20230712-en
Behavioral task
behavioral14
Sample
vctool140.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral15
Sample
Guloaderbgghjjdjcc1_browsingIso.iso
Resource
win7-20230712-en
Behavioral task
behavioral16
Sample
Guloaderbgghjjdjcc1_browsingIso.iso
Resource
win10v2004-20230703-en
Behavioral task
behavioral17
Sample
Iisbgfhaciadc2_browsingDll.dll
Resource
win7-20230712-en
Behavioral task
behavioral18
Sample
Iisbgfhaciadc2_browsingDll.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral19
Sample
Iranbggaiajfbi13_browsingExe.exe
Resource
win7-20230712-en
Behavioral task
behavioral20
Sample
Iranbggaiajfbi13_browsingExe.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral21
Sample
Knotweedbgfjcfhafh13_browsingDll.dll
Resource
win7-20230712-en
Behavioral task
behavioral22
Sample
Knotweedbgfjcfhafh13_browsingDll.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral23
Sample
Magicratbggdhgejff1_browsingExe.exe
Resource
win7-20230712-en
Behavioral task
behavioral24
Sample
Magicratbggdhgejff1_browsingExe.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral25
Sample
Newcopperstealer10_browsingExe.exe
Resource
win7-20230712-en
Behavioral task
behavioral26
Sample
Newcopperstealer10_browsingExe.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral27
Sample
Newlogforshell18_browsingExe.exe
Resource
win7-20230712-en
Behavioral task
behavioral28
Sample
Newlogforshell18_browsingExe.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral29
Sample
Purecrypter12_browsingExe.dll
Resource
win7-20230712-en
Behavioral task
behavioral30
Sample
Purecrypter12_browsingExe.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral31
Sample
Purecrypter16_browsingExe.dll
Resource
win7-20230712-en
Behavioral task
behavioral32
Sample
Purecrypter16_browsingExe.dll
Resource
win10v2004-20230703-en
General
-
Target
Information.lnk
-
Size
1KB
-
MD5
8fd497870926cbca338475287214572e
-
SHA1
2626e891b55d0132eda86841ab648e47dd0d6bae
-
SHA256
32e1eebf2af8d36857b3a9ea3a2653e8e7ad6b6eab8ca4665b252b5fb609d993
-
SHA512
43ea429f8e5bf8a623d28034cc1e287534fc347322339e0a633121d88a4188a8f07a53f9f587d72d78bc61a6a297a7de8db6769c2c6b0a6f41d546a0f44fd4cb
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AgendaE = "\"C:\\Users\\Admin\\AppData\\Roaming\\agenda.exe\"" agenda.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 4916 agenda.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4916 agenda.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3872 wrote to memory of 5012 3872 cmd.exe 86 PID 3872 wrote to memory of 5012 3872 cmd.exe 86 PID 5012 wrote to memory of 4916 5012 cmd.exe 87 PID 5012 wrote to memory of 4916 5012 cmd.exe 87
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Information.lnk1⤵
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /k start agenda.exe2⤵
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\agenda.exeagenda.exe3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4916
-
-