Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
12/02/2024, 12:00
Static task
static1
Behavioral task
behavioral1
Sample
ros88477566tyyfh.exe
Resource
win7-20231215-en
General
-
Target
ros88477566tyyfh.exe
-
Size
986KB
-
MD5
72d6251a4815e987ed734c5143773782
-
SHA1
a2090227c03e4b034d2304f547c0b2117cf8a06f
-
SHA256
2f252c0eac5c48177618c5aa351f6fe40105c25ffae42ca0e844c8543d06d768
-
SHA512
a4d969918292ffe8d8c2daff7521a418b806311c353458c083eb0789b3d7f2baf9bffc8282101ce98f6923e5ad2d73c59a48a83f7880cf31b13b2e1ce4eda49a
-
SSDEEP
24576:pRmJkcoQricOIQxiZY1iaUGb8fbMxwkrzzUCP3fkDyGS:mJZoQrbTFZY1iaUGb8fbMuyH
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1 33 IoCs
resource yara_rule behavioral1/memory/844-17-0x00000000003A0000-0x00000000003F6000-memory.dmp family_zgrat_v1 behavioral1/memory/844-20-0x0000000000530000-0x0000000000584000-memory.dmp family_zgrat_v1 behavioral1/memory/844-21-0x0000000000530000-0x000000000057E000-memory.dmp family_zgrat_v1 behavioral1/memory/844-32-0x0000000000530000-0x000000000057E000-memory.dmp family_zgrat_v1 behavioral1/memory/844-46-0x0000000000530000-0x000000000057E000-memory.dmp family_zgrat_v1 behavioral1/memory/844-56-0x0000000000530000-0x000000000057E000-memory.dmp family_zgrat_v1 behavioral1/memory/844-58-0x0000000000530000-0x000000000057E000-memory.dmp family_zgrat_v1 behavioral1/memory/844-60-0x0000000000530000-0x000000000057E000-memory.dmp family_zgrat_v1 behavioral1/memory/844-66-0x0000000000530000-0x000000000057E000-memory.dmp family_zgrat_v1 behavioral1/memory/844-64-0x0000000000530000-0x000000000057E000-memory.dmp family_zgrat_v1 behavioral1/memory/844-70-0x0000000000530000-0x000000000057E000-memory.dmp family_zgrat_v1 behavioral1/memory/844-72-0x0000000000530000-0x000000000057E000-memory.dmp family_zgrat_v1 behavioral1/memory/844-78-0x0000000000530000-0x000000000057E000-memory.dmp family_zgrat_v1 behavioral1/memory/844-80-0x0000000000530000-0x000000000057E000-memory.dmp family_zgrat_v1 behavioral1/memory/844-76-0x0000000000530000-0x000000000057E000-memory.dmp family_zgrat_v1 behavioral1/memory/844-74-0x0000000000530000-0x000000000057E000-memory.dmp family_zgrat_v1 behavioral1/memory/844-68-0x0000000000530000-0x000000000057E000-memory.dmp family_zgrat_v1 behavioral1/memory/844-62-0x0000000000530000-0x000000000057E000-memory.dmp family_zgrat_v1 behavioral1/memory/844-54-0x0000000000530000-0x000000000057E000-memory.dmp family_zgrat_v1 behavioral1/memory/844-52-0x0000000000530000-0x000000000057E000-memory.dmp family_zgrat_v1 behavioral1/memory/844-50-0x0000000000530000-0x000000000057E000-memory.dmp family_zgrat_v1 behavioral1/memory/844-48-0x0000000000530000-0x000000000057E000-memory.dmp family_zgrat_v1 behavioral1/memory/844-44-0x0000000000530000-0x000000000057E000-memory.dmp family_zgrat_v1 behavioral1/memory/844-42-0x0000000000530000-0x000000000057E000-memory.dmp family_zgrat_v1 behavioral1/memory/844-40-0x0000000000530000-0x000000000057E000-memory.dmp family_zgrat_v1 behavioral1/memory/844-38-0x0000000000530000-0x000000000057E000-memory.dmp family_zgrat_v1 behavioral1/memory/844-36-0x0000000000530000-0x000000000057E000-memory.dmp family_zgrat_v1 behavioral1/memory/844-34-0x0000000000530000-0x000000000057E000-memory.dmp family_zgrat_v1 behavioral1/memory/844-30-0x0000000000530000-0x000000000057E000-memory.dmp family_zgrat_v1 behavioral1/memory/844-28-0x0000000000530000-0x000000000057E000-memory.dmp family_zgrat_v1 behavioral1/memory/844-26-0x0000000000530000-0x000000000057E000-memory.dmp family_zgrat_v1 behavioral1/memory/844-24-0x0000000000530000-0x000000000057E000-memory.dmp family_zgrat_v1 behavioral1/memory/844-22-0x0000000000530000-0x000000000057E000-memory.dmp family_zgrat_v1 -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2220 set thread context of 844 2220 ros88477566tyyfh.exe 28 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 844 RegSvcs.exe 844 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2220 ros88477566tyyfh.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 844 RegSvcs.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2220 wrote to memory of 844 2220 ros88477566tyyfh.exe 28 PID 2220 wrote to memory of 844 2220 ros88477566tyyfh.exe 28 PID 2220 wrote to memory of 844 2220 ros88477566tyyfh.exe 28 PID 2220 wrote to memory of 844 2220 ros88477566tyyfh.exe 28 PID 2220 wrote to memory of 844 2220 ros88477566tyyfh.exe 28 PID 2220 wrote to memory of 844 2220 ros88477566tyyfh.exe 28 PID 2220 wrote to memory of 844 2220 ros88477566tyyfh.exe 28 PID 2220 wrote to memory of 844 2220 ros88477566tyyfh.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\ros88477566tyyfh.exe"C:\Users\Admin\AppData\Local\Temp\ros88477566tyyfh.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\ros88477566tyyfh.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:844
-