Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    08/05/2024, 03:40

General

  • Target

    Mt103.exe

  • Size

    1.2MB

  • MD5

    488b62ebafa8cf690c5bbc6654b90371

  • SHA1

    f823d4862173d5e9f8745a31bc6620839126e6bb

  • SHA256

    d30a0a4160b520aa94e2aacbc0f016d1f31a3168130b5d83c0ed3356eff4439b

  • SHA512

    20f05e5de74cfe36a6d7ffc6903ed29f25f29c606e90c1d8e98f0a3e0cdc2f4e78211591d89d07f32f90cbafc6644c14e4a3faad58d2417624841c2b31506806

  • SSDEEP

    24576:EqDEvCTbMWu7rQYlBQcBiT6rprG8a6EBlHDZKcW:ETvC/MTQYxsWR7a6EBlHDZKc

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Detect ZGRat V1 33 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Mt103.exe
    "C:\Users\Admin\AppData\Local\Temp\Mt103.exe"
    1⤵
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2888
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\Mt103.exe"
      2⤵
        PID:1744
      • C:\Users\Admin\AppData\Local\Temp\Mt103.exe
        "C:\Users\Admin\AppData\Local\Temp\Mt103.exe"
        2⤵
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:1960
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "C:\Users\Admin\AppData\Local\Temp\Mt103.exe"
          3⤵
            PID:2616
          • C:\Users\Admin\AppData\Local\Temp\Mt103.exe
            "C:\Users\Admin\AppData\Local\Temp\Mt103.exe"
            3⤵
            • Suspicious use of SetThreadContext
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:2640
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
              "C:\Users\Admin\AppData\Local\Temp\Mt103.exe"
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2632

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\aut9C7F.tmp

        Filesize

        9KB

        MD5

        8a22c71a58deb6a793ac4155ef7d7900

        SHA1

        35eb50f815a46c37a5d9cb5e821039d13758235a

        SHA256

        aabfa7c455a859be247fe2e4bf233a2c5189e8fa3084d9c9186e59572681026e

        SHA512

        8980d84d1dea6225693d692a351b728109f57fb0b9434559f3230f1344d39b88f1e7340e872b8a91969138fc88508c18715c83358f35e0c24b5ca98be411e6d6

      • C:\Users\Admin\AppData\Local\Temp\semispinalis

        Filesize

        29KB

        MD5

        32e645d0a3a593441900412075bfc1a5

        SHA1

        03f23b6c559860efe88169fcfb234b71d0d15641

        SHA256

        122851ece836072678a6c6a650b1ee8c3dd38d988ee202e3bf634d9dd56d20c3

        SHA512

        b0c919a4b551b6bbfc65a85f7c2ea2104953eda849b504f942c5d57874e053b715a05ed9c64d1ae5a73d06d56a0b02645fe3398c894ff2e50425b34e473fc9f0

      • C:\Users\Admin\AppData\Local\Temp\unnervousness

        Filesize

        262KB

        MD5

        5f3af2273e242e1c9e41da8da9e620e7

        SHA1

        988d95dfa28a4ceec57b0011d4a8514554b5fcc1

        SHA256

        c41aca818739b0ddeb57afd092dca6277ad03df2adaeb714f072865bed5b1b26

        SHA512

        e632c5bdf505118f770944d201da47b289c7e53517c395d66e2f5b2d717be8a7d67bdd760af1735e6ad1dce03225bfbc0b2e3c7073eb8b7bc77c4db5c1df262a

      • memory/2632-94-0x0000000000DA0000-0x0000000000DED000-memory.dmp

        Filesize

        308KB

      • memory/2632-38-0x0000000000400000-0x0000000000446000-memory.dmp

        Filesize

        280KB

      • memory/2632-41-0x0000000000400000-0x0000000000446000-memory.dmp

        Filesize

        280KB

      • memory/2632-40-0x0000000000400000-0x0000000000446000-memory.dmp

        Filesize

        280KB

      • memory/2632-42-0x00000000742CE000-0x00000000742CF000-memory.dmp

        Filesize

        4KB

      • memory/2632-43-0x0000000000350000-0x00000000003A4000-memory.dmp

        Filesize

        336KB

      • memory/2632-44-0x00000000742C0000-0x00000000749AE000-memory.dmp

        Filesize

        6.9MB

      • memory/2632-45-0x00000000742C0000-0x00000000749AE000-memory.dmp

        Filesize

        6.9MB

      • memory/2632-46-0x0000000000DA0000-0x0000000000DF2000-memory.dmp

        Filesize

        328KB

      • memory/2632-66-0x0000000000DA0000-0x0000000000DED000-memory.dmp

        Filesize

        308KB

      • memory/2632-70-0x0000000000DA0000-0x0000000000DED000-memory.dmp

        Filesize

        308KB

      • memory/2632-78-0x0000000000DA0000-0x0000000000DED000-memory.dmp

        Filesize

        308KB

      • memory/2632-90-0x0000000000DA0000-0x0000000000DED000-memory.dmp

        Filesize

        308KB

      • memory/2632-106-0x0000000000DA0000-0x0000000000DED000-memory.dmp

        Filesize

        308KB

      • memory/2632-104-0x0000000000DA0000-0x0000000000DED000-memory.dmp

        Filesize

        308KB

      • memory/2632-102-0x0000000000DA0000-0x0000000000DED000-memory.dmp

        Filesize

        308KB

      • memory/2632-100-0x0000000000DA0000-0x0000000000DED000-memory.dmp

        Filesize

        308KB

      • memory/2632-98-0x0000000000DA0000-0x0000000000DED000-memory.dmp

        Filesize

        308KB

      • memory/2632-96-0x0000000000DA0000-0x0000000000DED000-memory.dmp

        Filesize

        308KB

      • memory/2632-1080-0x00000000742C0000-0x00000000749AE000-memory.dmp

        Filesize

        6.9MB

      • memory/2632-86-0x0000000000DA0000-0x0000000000DED000-memory.dmp

        Filesize

        308KB

      • memory/2632-92-0x0000000000DA0000-0x0000000000DED000-memory.dmp

        Filesize

        308KB

      • memory/2632-88-0x0000000000DA0000-0x0000000000DED000-memory.dmp

        Filesize

        308KB

      • memory/2632-84-0x0000000000DA0000-0x0000000000DED000-memory.dmp

        Filesize

        308KB

      • memory/2632-82-0x0000000000DA0000-0x0000000000DED000-memory.dmp

        Filesize

        308KB

      • memory/2632-80-0x0000000000DA0000-0x0000000000DED000-memory.dmp

        Filesize

        308KB

      • memory/2632-76-0x0000000000DA0000-0x0000000000DED000-memory.dmp

        Filesize

        308KB

      • memory/2632-74-0x0000000000DA0000-0x0000000000DED000-memory.dmp

        Filesize

        308KB

      • memory/2632-68-0x0000000000DA0000-0x0000000000DED000-memory.dmp

        Filesize

        308KB

      • memory/2632-64-0x0000000000DA0000-0x0000000000DED000-memory.dmp

        Filesize

        308KB

      • memory/2632-62-0x0000000000DA0000-0x0000000000DED000-memory.dmp

        Filesize

        308KB

      • memory/2632-60-0x0000000000DA0000-0x0000000000DED000-memory.dmp

        Filesize

        308KB

      • memory/2632-58-0x0000000000DA0000-0x0000000000DED000-memory.dmp

        Filesize

        308KB

      • memory/2632-56-0x0000000000DA0000-0x0000000000DED000-memory.dmp

        Filesize

        308KB

      • memory/2632-52-0x0000000000DA0000-0x0000000000DED000-memory.dmp

        Filesize

        308KB

      • memory/2632-48-0x0000000000DA0000-0x0000000000DED000-memory.dmp

        Filesize

        308KB

      • memory/2632-72-0x0000000000DA0000-0x0000000000DED000-memory.dmp

        Filesize

        308KB

      • memory/2632-47-0x0000000000DA0000-0x0000000000DED000-memory.dmp

        Filesize

        308KB

      • memory/2632-55-0x0000000000DA0000-0x0000000000DED000-memory.dmp

        Filesize

        308KB

      • memory/2632-50-0x0000000000DA0000-0x0000000000DED000-memory.dmp

        Filesize

        308KB

      • memory/2632-1077-0x00000000742C0000-0x00000000749AE000-memory.dmp

        Filesize

        6.9MB

      • memory/2632-1078-0x0000000000400000-0x0000000000446000-memory.dmp

        Filesize

        280KB

      • memory/2632-1079-0x00000000742CE000-0x00000000742CF000-memory.dmp

        Filesize

        4KB

      • memory/2888-11-0x0000000000120000-0x0000000000124000-memory.dmp

        Filesize

        16KB