Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 03:40
Static task
static1
Behavioral task
behavioral1
Sample
Mt103.exe
Resource
win7-20240221-en
General
-
Target
Mt103.exe
-
Size
1.2MB
-
MD5
488b62ebafa8cf690c5bbc6654b90371
-
SHA1
f823d4862173d5e9f8745a31bc6620839126e6bb
-
SHA256
d30a0a4160b520aa94e2aacbc0f016d1f31a3168130b5d83c0ed3356eff4439b
-
SHA512
20f05e5de74cfe36a6d7ffc6903ed29f25f29c606e90c1d8e98f0a3e0cdc2f4e78211591d89d07f32f90cbafc6644c14e4a3faad58d2417624841c2b31506806
-
SSDEEP
24576:EqDEvCTbMWu7rQYlBQcBiT6rprG8a6EBlHDZKcW:ETvC/MTQYxsWR7a6EBlHDZKc
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1 33 IoCs
resource yara_rule behavioral1/memory/2632-43-0x0000000000350000-0x00000000003A4000-memory.dmp family_zgrat_v1 behavioral1/memory/2632-46-0x0000000000DA0000-0x0000000000DF2000-memory.dmp family_zgrat_v1 behavioral1/memory/2632-66-0x0000000000DA0000-0x0000000000DED000-memory.dmp family_zgrat_v1 behavioral1/memory/2632-70-0x0000000000DA0000-0x0000000000DED000-memory.dmp family_zgrat_v1 behavioral1/memory/2632-78-0x0000000000DA0000-0x0000000000DED000-memory.dmp family_zgrat_v1 behavioral1/memory/2632-90-0x0000000000DA0000-0x0000000000DED000-memory.dmp family_zgrat_v1 behavioral1/memory/2632-106-0x0000000000DA0000-0x0000000000DED000-memory.dmp family_zgrat_v1 behavioral1/memory/2632-104-0x0000000000DA0000-0x0000000000DED000-memory.dmp family_zgrat_v1 behavioral1/memory/2632-102-0x0000000000DA0000-0x0000000000DED000-memory.dmp family_zgrat_v1 behavioral1/memory/2632-100-0x0000000000DA0000-0x0000000000DED000-memory.dmp family_zgrat_v1 behavioral1/memory/2632-98-0x0000000000DA0000-0x0000000000DED000-memory.dmp family_zgrat_v1 behavioral1/memory/2632-96-0x0000000000DA0000-0x0000000000DED000-memory.dmp family_zgrat_v1 behavioral1/memory/2632-94-0x0000000000DA0000-0x0000000000DED000-memory.dmp family_zgrat_v1 behavioral1/memory/2632-92-0x0000000000DA0000-0x0000000000DED000-memory.dmp family_zgrat_v1 behavioral1/memory/2632-88-0x0000000000DA0000-0x0000000000DED000-memory.dmp family_zgrat_v1 behavioral1/memory/2632-86-0x0000000000DA0000-0x0000000000DED000-memory.dmp family_zgrat_v1 behavioral1/memory/2632-84-0x0000000000DA0000-0x0000000000DED000-memory.dmp family_zgrat_v1 behavioral1/memory/2632-82-0x0000000000DA0000-0x0000000000DED000-memory.dmp family_zgrat_v1 behavioral1/memory/2632-80-0x0000000000DA0000-0x0000000000DED000-memory.dmp family_zgrat_v1 behavioral1/memory/2632-76-0x0000000000DA0000-0x0000000000DED000-memory.dmp family_zgrat_v1 behavioral1/memory/2632-74-0x0000000000DA0000-0x0000000000DED000-memory.dmp family_zgrat_v1 behavioral1/memory/2632-68-0x0000000000DA0000-0x0000000000DED000-memory.dmp family_zgrat_v1 behavioral1/memory/2632-64-0x0000000000DA0000-0x0000000000DED000-memory.dmp family_zgrat_v1 behavioral1/memory/2632-62-0x0000000000DA0000-0x0000000000DED000-memory.dmp family_zgrat_v1 behavioral1/memory/2632-60-0x0000000000DA0000-0x0000000000DED000-memory.dmp family_zgrat_v1 behavioral1/memory/2632-58-0x0000000000DA0000-0x0000000000DED000-memory.dmp family_zgrat_v1 behavioral1/memory/2632-56-0x0000000000DA0000-0x0000000000DED000-memory.dmp family_zgrat_v1 behavioral1/memory/2632-52-0x0000000000DA0000-0x0000000000DED000-memory.dmp family_zgrat_v1 behavioral1/memory/2632-48-0x0000000000DA0000-0x0000000000DED000-memory.dmp family_zgrat_v1 behavioral1/memory/2632-72-0x0000000000DA0000-0x0000000000DED000-memory.dmp family_zgrat_v1 behavioral1/memory/2632-47-0x0000000000DA0000-0x0000000000DED000-memory.dmp family_zgrat_v1 behavioral1/memory/2632-55-0x0000000000DA0000-0x0000000000DED000-memory.dmp family_zgrat_v1 behavioral1/memory/2632-50-0x0000000000DA0000-0x0000000000DED000-memory.dmp family_zgrat_v1 -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2640 set thread context of 2632 2640 Mt103.exe 32 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2632 RegSvcs.exe 2632 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 2888 Mt103.exe 1960 Mt103.exe 2640 Mt103.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2632 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 2888 Mt103.exe 2888 Mt103.exe 1960 Mt103.exe 1960 Mt103.exe 2640 Mt103.exe 2640 Mt103.exe -
Suspicious use of SendNotifyMessage 6 IoCs
pid Process 2888 Mt103.exe 2888 Mt103.exe 1960 Mt103.exe 1960 Mt103.exe 2640 Mt103.exe 2640 Mt103.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2888 wrote to memory of 1744 2888 Mt103.exe 28 PID 2888 wrote to memory of 1744 2888 Mt103.exe 28 PID 2888 wrote to memory of 1744 2888 Mt103.exe 28 PID 2888 wrote to memory of 1744 2888 Mt103.exe 28 PID 2888 wrote to memory of 1744 2888 Mt103.exe 28 PID 2888 wrote to memory of 1744 2888 Mt103.exe 28 PID 2888 wrote to memory of 1744 2888 Mt103.exe 28 PID 2888 wrote to memory of 1960 2888 Mt103.exe 29 PID 2888 wrote to memory of 1960 2888 Mt103.exe 29 PID 2888 wrote to memory of 1960 2888 Mt103.exe 29 PID 2888 wrote to memory of 1960 2888 Mt103.exe 29 PID 1960 wrote to memory of 2616 1960 Mt103.exe 30 PID 1960 wrote to memory of 2616 1960 Mt103.exe 30 PID 1960 wrote to memory of 2616 1960 Mt103.exe 30 PID 1960 wrote to memory of 2616 1960 Mt103.exe 30 PID 1960 wrote to memory of 2616 1960 Mt103.exe 30 PID 1960 wrote to memory of 2616 1960 Mt103.exe 30 PID 1960 wrote to memory of 2616 1960 Mt103.exe 30 PID 1960 wrote to memory of 2640 1960 Mt103.exe 31 PID 1960 wrote to memory of 2640 1960 Mt103.exe 31 PID 1960 wrote to memory of 2640 1960 Mt103.exe 31 PID 1960 wrote to memory of 2640 1960 Mt103.exe 31 PID 2640 wrote to memory of 2632 2640 Mt103.exe 32 PID 2640 wrote to memory of 2632 2640 Mt103.exe 32 PID 2640 wrote to memory of 2632 2640 Mt103.exe 32 PID 2640 wrote to memory of 2632 2640 Mt103.exe 32 PID 2640 wrote to memory of 2632 2640 Mt103.exe 32 PID 2640 wrote to memory of 2632 2640 Mt103.exe 32 PID 2640 wrote to memory of 2632 2640 Mt103.exe 32 PID 2640 wrote to memory of 2632 2640 Mt103.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\Mt103.exe"C:\Users\Admin\AppData\Local\Temp\Mt103.exe"1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\Mt103.exe"2⤵PID:1744
-
-
C:\Users\Admin\AppData\Local\Temp\Mt103.exe"C:\Users\Admin\AppData\Local\Temp\Mt103.exe"2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\Mt103.exe"3⤵PID:2616
-
-
C:\Users\Admin\AppData\Local\Temp\Mt103.exe"C:\Users\Admin\AppData\Local\Temp\Mt103.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\Mt103.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2632
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD58a22c71a58deb6a793ac4155ef7d7900
SHA135eb50f815a46c37a5d9cb5e821039d13758235a
SHA256aabfa7c455a859be247fe2e4bf233a2c5189e8fa3084d9c9186e59572681026e
SHA5128980d84d1dea6225693d692a351b728109f57fb0b9434559f3230f1344d39b88f1e7340e872b8a91969138fc88508c18715c83358f35e0c24b5ca98be411e6d6
-
Filesize
29KB
MD532e645d0a3a593441900412075bfc1a5
SHA103f23b6c559860efe88169fcfb234b71d0d15641
SHA256122851ece836072678a6c6a650b1ee8c3dd38d988ee202e3bf634d9dd56d20c3
SHA512b0c919a4b551b6bbfc65a85f7c2ea2104953eda849b504f942c5d57874e053b715a05ed9c64d1ae5a73d06d56a0b02645fe3398c894ff2e50425b34e473fc9f0
-
Filesize
262KB
MD55f3af2273e242e1c9e41da8da9e620e7
SHA1988d95dfa28a4ceec57b0011d4a8514554b5fcc1
SHA256c41aca818739b0ddeb57afd092dca6277ad03df2adaeb714f072865bed5b1b26
SHA512e632c5bdf505118f770944d201da47b289c7e53517c395d66e2f5b2d717be8a7d67bdd760af1735e6ad1dce03225bfbc0b2e3c7073eb8b7bc77c4db5c1df262a