Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

876b43151e...98.exe

windows7-x64

7

876b43151e...98.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    29/04/2024, 10:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    876b43151ede0039bebcce58b34aa398.exe

  • Size

    69KB

  • MD5

    876b43151ede0039bebcce58b34aa398

  • SHA1

    ad2c2c038119b8aa790d72f611749e69ea288399

  • SHA256

    da6829c523e4b2424fe244f3d30c7ac8b67a775c00f9eee2bf1c148889dee7cc

  • SHA512

    5faff6a8ab0fb0bc7f78b8772d2a14b9379663727c67e97c977d9b19a7c6970c2c219202cc513f4690a0313b13f71162b3d3c3ef6dd48f09f05c03a1a4be187f

  • SSDEEP

    768:hZZ6Zyf96vmAziy5BoC9wpS+d3Bj1ChBuQKKRedCSG7AGvMpe2GXnvjLhlfl9u/9:1Q9Cdp1VmBubDdvGwpRGXnv3h4CAX

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\876b43151ede0039bebcce58b34aa398.exe
    "C:\Users\Admin\AppData\Local\Temp\876b43151ede0039bebcce58b34aa398.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    PID:2088
    • C:\WINDOWS\SysWOW64\agtadah.exe
      "C:\WINDOWS\system32\agtadah.exe"
      2⤵
      • Executes dropped EXE
      PID:1744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Windows\SysWOW64\agtadah.exe
    Filesize

    66KB

    MD5

    7e10f3a30bb325353646fe8e2aee359b

    SHA1

    81f075ceab65ec4ebd2ff3ee80af245639d94eaa

    SHA256

    e7c22aae6dc74b7ac4a8f4e8bbe15e9354d25361df153394fee043133cbae1e5

    SHA512

    fd7ccdd7507eec9c737edf9d3fc5e26439686e4890c2828ca9fb28c765e127c67ab88ecc34516e7a9de2a677561caa0af5b2d0e2b2b56146ea0af3a9b8e15234

    Download Submit

  • memory/2088-5-0x0000000000400000-0x0000000000403000-memory.dmp

    Filesize

    12KB

    Download