Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    09/05/2024, 01:35

General

  • Target

    PI 09007.exe

  • Size

    1.2MB

  • MD5

    488b62ebafa8cf690c5bbc6654b90371

  • SHA1

    f823d4862173d5e9f8745a31bc6620839126e6bb

  • SHA256

    d30a0a4160b520aa94e2aacbc0f016d1f31a3168130b5d83c0ed3356eff4439b

  • SHA512

    20f05e5de74cfe36a6d7ffc6903ed29f25f29c606e90c1d8e98f0a3e0cdc2f4e78211591d89d07f32f90cbafc6644c14e4a3faad58d2417624841c2b31506806

  • SSDEEP

    24576:EqDEvCTbMWu7rQYlBQcBiT6rprG8a6EBlHDZKcW:ETvC/MTQYxsWR7a6EBlHDZKc

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Detect ZGRat V1 33 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PI 09007.exe
    "C:\Users\Admin\AppData\Local\Temp\PI 09007.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2100
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\PI 09007.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\unnervousness

    Filesize

    262KB

    MD5

    5f3af2273e242e1c9e41da8da9e620e7

    SHA1

    988d95dfa28a4ceec57b0011d4a8514554b5fcc1

    SHA256

    c41aca818739b0ddeb57afd092dca6277ad03df2adaeb714f072865bed5b1b26

    SHA512

    e632c5bdf505118f770944d201da47b289c7e53517c395d66e2f5b2d717be8a7d67bdd760af1735e6ad1dce03225bfbc0b2e3c7073eb8b7bc77c4db5c1df262a

  • memory/2100-16-0x0000000000360000-0x0000000000495000-memory.dmp

    Filesize

    1.2MB

  • memory/2100-11-0x0000000000360000-0x0000000000495000-memory.dmp

    Filesize

    1.2MB

  • memory/2368-61-0x00000000023F0000-0x000000000243D000-memory.dmp

    Filesize

    308KB

  • memory/2368-15-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

  • memory/2368-14-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

  • memory/2368-17-0x0000000073C8E000-0x0000000073C8F000-memory.dmp

    Filesize

    4KB

  • memory/2368-18-0x00000000003B0000-0x0000000000404000-memory.dmp

    Filesize

    336KB

  • memory/2368-19-0x00000000023F0000-0x0000000002442000-memory.dmp

    Filesize

    328KB

  • memory/2368-20-0x0000000073C80000-0x000000007436E000-memory.dmp

    Filesize

    6.9MB

  • memory/2368-21-0x0000000073C80000-0x000000007436E000-memory.dmp

    Filesize

    6.9MB

  • memory/2368-71-0x00000000023F0000-0x000000000243D000-memory.dmp

    Filesize

    308KB

  • memory/2368-53-0x00000000023F0000-0x000000000243D000-memory.dmp

    Filesize

    308KB

  • memory/2368-81-0x00000000023F0000-0x000000000243D000-memory.dmp

    Filesize

    308KB

  • memory/2368-79-0x00000000023F0000-0x000000000243D000-memory.dmp

    Filesize

    308KB

  • memory/2368-77-0x00000000023F0000-0x000000000243D000-memory.dmp

    Filesize

    308KB

  • memory/2368-75-0x00000000023F0000-0x000000000243D000-memory.dmp

    Filesize

    308KB

  • memory/2368-73-0x00000000023F0000-0x000000000243D000-memory.dmp

    Filesize

    308KB

  • memory/2368-69-0x00000000023F0000-0x000000000243D000-memory.dmp

    Filesize

    308KB

  • memory/2368-67-0x00000000023F0000-0x000000000243D000-memory.dmp

    Filesize

    308KB

  • memory/2368-65-0x00000000023F0000-0x000000000243D000-memory.dmp

    Filesize

    308KB

  • memory/2368-63-0x00000000023F0000-0x000000000243D000-memory.dmp

    Filesize

    308KB

  • memory/2368-12-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

  • memory/2368-55-0x00000000023F0000-0x000000000243D000-memory.dmp

    Filesize

    308KB

  • memory/2368-59-0x00000000023F0000-0x000000000243D000-memory.dmp

    Filesize

    308KB

  • memory/2368-57-0x00000000023F0000-0x000000000243D000-memory.dmp

    Filesize

    308KB

  • memory/2368-51-0x00000000023F0000-0x000000000243D000-memory.dmp

    Filesize

    308KB

  • memory/2368-49-0x00000000023F0000-0x000000000243D000-memory.dmp

    Filesize

    308KB

  • memory/2368-47-0x00000000023F0000-0x000000000243D000-memory.dmp

    Filesize

    308KB

  • memory/2368-45-0x00000000023F0000-0x000000000243D000-memory.dmp

    Filesize

    308KB

  • memory/2368-43-0x00000000023F0000-0x000000000243D000-memory.dmp

    Filesize

    308KB

  • memory/2368-41-0x00000000023F0000-0x000000000243D000-memory.dmp

    Filesize

    308KB

  • memory/2368-39-0x00000000023F0000-0x000000000243D000-memory.dmp

    Filesize

    308KB

  • memory/2368-37-0x00000000023F0000-0x000000000243D000-memory.dmp

    Filesize

    308KB

  • memory/2368-35-0x00000000023F0000-0x000000000243D000-memory.dmp

    Filesize

    308KB

  • memory/2368-33-0x00000000023F0000-0x000000000243D000-memory.dmp

    Filesize

    308KB

  • memory/2368-31-0x00000000023F0000-0x000000000243D000-memory.dmp

    Filesize

    308KB

  • memory/2368-29-0x00000000023F0000-0x000000000243D000-memory.dmp

    Filesize

    308KB

  • memory/2368-27-0x00000000023F0000-0x000000000243D000-memory.dmp

    Filesize

    308KB

  • memory/2368-25-0x00000000023F0000-0x000000000243D000-memory.dmp

    Filesize

    308KB

  • memory/2368-23-0x00000000023F0000-0x000000000243D000-memory.dmp

    Filesize

    308KB

  • memory/2368-22-0x00000000023F0000-0x000000000243D000-memory.dmp

    Filesize

    308KB

  • memory/2368-107-0x0000000073C80000-0x000000007436E000-memory.dmp

    Filesize

    6.9MB

  • memory/2368-1053-0x0000000073C80000-0x000000007436E000-memory.dmp

    Filesize

    6.9MB

  • memory/2368-1054-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

  • memory/2368-1055-0x0000000073C8E000-0x0000000073C8F000-memory.dmp

    Filesize

    4KB

  • memory/2368-1056-0x0000000073C80000-0x000000007436E000-memory.dmp

    Filesize

    6.9MB