Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10/03/2024, 16:47

General

  • Target

    niggerspoofa.exe

  • Size

    179KB

  • MD5

    6407d82ff6635e7332d0b38b34bd389b

  • SHA1

    b68a5d70bb8348bdbeaf9beda5ecb5a131809d45

  • SHA256

    7d2465a5912fac5f2950156aa608e32fdeaace6176ebfcfb0c99049be6cbd58c

  • SHA512

    1bbbf962bbfa7315cc3c2d406ada6a94fcd9c31bf794d473d7102fe2ffcd6b49e4bda0b81f1d7e78cac5d5e9f3d1eeea5c0b272627bc72d91f46ea7c4ba6a804

  • SSDEEP

    3072:aR9wrCMT9szA4tOicW7t9m4WJE7aYgpTS5G8WqhbJyOyx7aYgY7aYgORqY:aDwWlAiLcW7tBWJE7IkJfS7IY7IKq

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla payload 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\niggerspoofa.exe
    "C:\Users\Admin\AppData\Local\Temp\niggerspoofa.exe"
    1⤵
    • Enumerates system info in registry
    PID:1252

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1252-0-0x00000000010E0000-0x0000000001112000-memory.dmp

    Filesize

    200KB

  • memory/1252-1-0x00000000745C0000-0x0000000074CAE000-memory.dmp

    Filesize

    6.9MB

  • memory/1252-2-0x0000000004CA0000-0x0000000004CE0000-memory.dmp

    Filesize

    256KB

  • memory/1252-3-0x0000000004CE0000-0x0000000004EF4000-memory.dmp

    Filesize

    2.1MB

  • memory/1252-4-0x0000000004CA0000-0x0000000004CE0000-memory.dmp

    Filesize

    256KB

  • memory/1252-5-0x00000000745C0000-0x0000000074CAE000-memory.dmp

    Filesize

    6.9MB

  • memory/1252-6-0x0000000004CA0000-0x0000000004CE0000-memory.dmp

    Filesize

    256KB