Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 01:35
Static task
static1
Behavioral task
behavioral1
Sample
PI 09007.exe
Resource
win7-20240221-en
General
-
Target
PI 09007.exe
-
Size
1.2MB
-
MD5
488b62ebafa8cf690c5bbc6654b90371
-
SHA1
f823d4862173d5e9f8745a31bc6620839126e6bb
-
SHA256
d30a0a4160b520aa94e2aacbc0f016d1f31a3168130b5d83c0ed3356eff4439b
-
SHA512
20f05e5de74cfe36a6d7ffc6903ed29f25f29c606e90c1d8e98f0a3e0cdc2f4e78211591d89d07f32f90cbafc6644c14e4a3faad58d2417624841c2b31506806
-
SSDEEP
24576:EqDEvCTbMWu7rQYlBQcBiT6rprG8a6EBlHDZKcW:ETvC/MTQYxsWR7a6EBlHDZKc
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1 33 IoCs
resource yara_rule behavioral1/memory/2368-18-0x00000000003B0000-0x0000000000404000-memory.dmp family_zgrat_v1 behavioral1/memory/2368-19-0x00000000023F0000-0x0000000002442000-memory.dmp family_zgrat_v1 behavioral1/memory/2368-71-0x00000000023F0000-0x000000000243D000-memory.dmp family_zgrat_v1 behavioral1/memory/2368-53-0x00000000023F0000-0x000000000243D000-memory.dmp family_zgrat_v1 behavioral1/memory/2368-81-0x00000000023F0000-0x000000000243D000-memory.dmp family_zgrat_v1 behavioral1/memory/2368-79-0x00000000023F0000-0x000000000243D000-memory.dmp family_zgrat_v1 behavioral1/memory/2368-77-0x00000000023F0000-0x000000000243D000-memory.dmp family_zgrat_v1 behavioral1/memory/2368-75-0x00000000023F0000-0x000000000243D000-memory.dmp family_zgrat_v1 behavioral1/memory/2368-73-0x00000000023F0000-0x000000000243D000-memory.dmp family_zgrat_v1 behavioral1/memory/2368-69-0x00000000023F0000-0x000000000243D000-memory.dmp family_zgrat_v1 behavioral1/memory/2368-67-0x00000000023F0000-0x000000000243D000-memory.dmp family_zgrat_v1 behavioral1/memory/2368-65-0x00000000023F0000-0x000000000243D000-memory.dmp family_zgrat_v1 behavioral1/memory/2368-63-0x00000000023F0000-0x000000000243D000-memory.dmp family_zgrat_v1 behavioral1/memory/2368-61-0x00000000023F0000-0x000000000243D000-memory.dmp family_zgrat_v1 behavioral1/memory/2368-59-0x00000000023F0000-0x000000000243D000-memory.dmp family_zgrat_v1 behavioral1/memory/2368-57-0x00000000023F0000-0x000000000243D000-memory.dmp family_zgrat_v1 behavioral1/memory/2368-55-0x00000000023F0000-0x000000000243D000-memory.dmp family_zgrat_v1 behavioral1/memory/2368-51-0x00000000023F0000-0x000000000243D000-memory.dmp family_zgrat_v1 behavioral1/memory/2368-49-0x00000000023F0000-0x000000000243D000-memory.dmp family_zgrat_v1 behavioral1/memory/2368-47-0x00000000023F0000-0x000000000243D000-memory.dmp family_zgrat_v1 behavioral1/memory/2368-45-0x00000000023F0000-0x000000000243D000-memory.dmp family_zgrat_v1 behavioral1/memory/2368-43-0x00000000023F0000-0x000000000243D000-memory.dmp family_zgrat_v1 behavioral1/memory/2368-41-0x00000000023F0000-0x000000000243D000-memory.dmp family_zgrat_v1 behavioral1/memory/2368-39-0x00000000023F0000-0x000000000243D000-memory.dmp family_zgrat_v1 behavioral1/memory/2368-37-0x00000000023F0000-0x000000000243D000-memory.dmp family_zgrat_v1 behavioral1/memory/2368-35-0x00000000023F0000-0x000000000243D000-memory.dmp family_zgrat_v1 behavioral1/memory/2368-33-0x00000000023F0000-0x000000000243D000-memory.dmp family_zgrat_v1 behavioral1/memory/2368-31-0x00000000023F0000-0x000000000243D000-memory.dmp family_zgrat_v1 behavioral1/memory/2368-29-0x00000000023F0000-0x000000000243D000-memory.dmp family_zgrat_v1 behavioral1/memory/2368-27-0x00000000023F0000-0x000000000243D000-memory.dmp family_zgrat_v1 behavioral1/memory/2368-25-0x00000000023F0000-0x000000000243D000-memory.dmp family_zgrat_v1 behavioral1/memory/2368-23-0x00000000023F0000-0x000000000243D000-memory.dmp family_zgrat_v1 behavioral1/memory/2368-22-0x00000000023F0000-0x000000000243D000-memory.dmp family_zgrat_v1 -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2100-11-0x0000000000360000-0x0000000000495000-memory.dmp autoit_exe behavioral1/memory/2100-16-0x0000000000360000-0x0000000000495000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2100 set thread context of 2368 2100 PI 09007.exe 28 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2368 RegSvcs.exe 2368 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2100 PI 09007.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2368 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2100 PI 09007.exe 2100 PI 09007.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2100 PI 09007.exe 2100 PI 09007.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2100 wrote to memory of 2368 2100 PI 09007.exe 28 PID 2100 wrote to memory of 2368 2100 PI 09007.exe 28 PID 2100 wrote to memory of 2368 2100 PI 09007.exe 28 PID 2100 wrote to memory of 2368 2100 PI 09007.exe 28 PID 2100 wrote to memory of 2368 2100 PI 09007.exe 28 PID 2100 wrote to memory of 2368 2100 PI 09007.exe 28 PID 2100 wrote to memory of 2368 2100 PI 09007.exe 28 PID 2100 wrote to memory of 2368 2100 PI 09007.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\PI 09007.exe"C:\Users\Admin\AppData\Local\Temp\PI 09007.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\PI 09007.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2368
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
262KB
MD55f3af2273e242e1c9e41da8da9e620e7
SHA1988d95dfa28a4ceec57b0011d4a8514554b5fcc1
SHA256c41aca818739b0ddeb57afd092dca6277ad03df2adaeb714f072865bed5b1b26
SHA512e632c5bdf505118f770944d201da47b289c7e53517c395d66e2f5b2d717be8a7d67bdd760af1735e6ad1dce03225bfbc0b2e3c7073eb8b7bc77c4db5c1df262a