Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    102s
  • max time network
    105s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/05/2024, 07:50

General

  • Target

    27896043c515b704ea8c7bfa6bed64e2a8b09cc820205c3ee3c4cdc8988c3f91.exe

  • Size

    236KB

  • MD5

    d29c16478acb56861e08e9c0c2eca08f

  • SHA1

    33257ba2e66b429932b8b8012b8188a7cc8c004c

  • SHA256

    27896043c515b704ea8c7bfa6bed64e2a8b09cc820205c3ee3c4cdc8988c3f91

  • SHA512

    41596107be4287a7864586129b2106a588f93adc65627fb07cd26e895d4293bbaa7e053989f084ee420de71c44f3887759d0094c2db21b3a296af61e2a7c78a3

  • SSDEEP

    3072:72HCph6dLHS1ZTbLTDaSeXYmRpTXAMneEIKhU5f3lFhvt:7rh6dLy1ZTbLTDaSsRD1eEIKh6VFp

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\27896043c515b704ea8c7bfa6bed64e2a8b09cc820205c3ee3c4cdc8988c3f91.exe
    "C:\Users\Admin\AppData\Local\Temp\27896043c515b704ea8c7bfa6bed64e2a8b09cc820205c3ee3c4cdc8988c3f91.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4920

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4920-0-0x0000000074B2E000-0x0000000074B2F000-memory.dmp

    Filesize

    4KB

  • memory/4920-1-0x0000000000C60000-0x0000000000CA2000-memory.dmp

    Filesize

    264KB

  • memory/4920-2-0x0000000005E60000-0x0000000006404000-memory.dmp

    Filesize

    5.6MB

  • memory/4920-3-0x0000000005790000-0x00000000057F6000-memory.dmp

    Filesize

    408KB

  • memory/4920-4-0x0000000074B20000-0x00000000752D0000-memory.dmp

    Filesize

    7.7MB

  • memory/4920-6-0x0000000006D10000-0x0000000006D60000-memory.dmp

    Filesize

    320KB

  • memory/4920-7-0x0000000006E00000-0x0000000006E9C000-memory.dmp

    Filesize

    624KB

  • memory/4920-8-0x0000000074B2E000-0x0000000074B2F000-memory.dmp

    Filesize

    4KB

  • memory/4920-9-0x0000000074B20000-0x00000000752D0000-memory.dmp

    Filesize

    7.7MB

  • memory/4920-10-0x0000000006F40000-0x0000000006FD2000-memory.dmp

    Filesize

    584KB

  • memory/4920-11-0x0000000006EE0000-0x0000000006EEA000-memory.dmp

    Filesize

    40KB