Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    14/05/2024, 01:48 UTC

General

  • Target

    f7c0471a702e24c7de7f214a24905704c6783043eab48c4b5a1eb347d846e952.exe

  • Size

    664KB

  • MD5

    ab7958eb77b1cb9aadfe366da2092027

  • SHA1

    0399ef1e6468abea364ba97fc2ce58a20617b764

  • SHA256

    f7c0471a702e24c7de7f214a24905704c6783043eab48c4b5a1eb347d846e952

  • SHA512

    aae1bffd4c3652d4800e5939c8a19c02e89335353a6ff891a88e3cbaad7db36a99c5e8d64df0f44857ff464cddda05afe971630ab0c92522d9656f8763b77901

  • SSDEEP

    12288:/Xe9PPlowWX0t6mOQwg1Qd15CcYk0We1FTjp7rBHguWJq/GuY4C0qZivK539a5ZP:GhloDX0XOf4X5BxWJq8Cxu9a5Z9WFm

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot6706700909:AAF84XSqJERRA6jKqejEqGMhCkiDguB_-5E/

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Detect ZGRat V1 33 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f7c0471a702e24c7de7f214a24905704c6783043eab48c4b5a1eb347d846e952.exe
    "C:\Users\Admin\AppData\Local\Temp\f7c0471a702e24c7de7f214a24905704c6783043eab48c4b5a1eb347d846e952.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3056
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\f7c0471a702e24c7de7f214a24905704c6783043eab48c4b5a1eb347d846e952.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1932

Network

  • flag-us
    DNS
    api.ipify.org
    RegSvcs.exe
    Remote address:
    8.8.8.8:53
    Request
    api.ipify.org
    IN A
    Response
    api.ipify.org
    IN A
    104.26.12.205
    api.ipify.org
    IN A
    104.26.13.205
    api.ipify.org
    IN A
    172.67.74.152
  • flag-us
    GET
    https://api.ipify.org/
    RegSvcs.exe
    Remote address:
    104.26.12.205:443
    Request
    GET / HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
    Host: api.ipify.org
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Tue, 14 May 2024 01:49:40 GMT
    Content-Type: text/plain
    Content-Length: 14
    Connection: keep-alive
    Vary: Origin
    CF-Cache-Status: DYNAMIC
    Server: cloudflare
    CF-RAY: 88373ba908663da0-LHR
  • 104.26.12.205:443
    https://api.ipify.org/
    tls, http
    RegSvcs.exe
    950 B
    5.4kB
    10
    10

    HTTP Request

    GET https://api.ipify.org/

    HTTP Response

    200
  • 8.8.8.8:53
    api.ipify.org
    dns
    RegSvcs.exe
    59 B
    107 B
    1
    1

    DNS Request

    api.ipify.org

    DNS Response

    104.26.12.205
    104.26.13.205
    172.67.74.152

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Prober

    Filesize

    261KB

    MD5

    92bf5c932c8e6fb630d70fcd8ce9cb60

    SHA1

    dcf0c7f342c238a2d9f0bd0e8c87c413dd9e85b2

    SHA256

    95cb577726c0f4ce99819e0224a933805ac27b2f02c109d76f8e7999f170ad93

    SHA512

    19739f6f1d564be453975d614e2a7cbf4bfe9ab28666c463e260d93e2372b4a262533a362806770714d4c0a8d02170c55bd4bfa797dd22ae2e362e4a7f19f621

  • memory/1932-63-0x00000000009F0000-0x0000000000A3D000-memory.dmp

    Filesize

    308KB

  • memory/1932-77-0x00000000009F0000-0x0000000000A3D000-memory.dmp

    Filesize

    308KB

  • memory/1932-13-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

  • memory/1932-16-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

  • memory/1932-1059-0x0000000074530000-0x0000000074C1E000-memory.dmp

    Filesize

    6.9MB

  • memory/1932-18-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

  • memory/1932-19-0x000000007453E000-0x000000007453F000-memory.dmp

    Filesize

    4KB

  • memory/1932-20-0x0000000000720000-0x0000000000774000-memory.dmp

    Filesize

    336KB

  • memory/1932-21-0x0000000074530000-0x0000000074C1E000-memory.dmp

    Filesize

    6.9MB

  • memory/1932-22-0x00000000009F0000-0x0000000000A42000-memory.dmp

    Filesize

    328KB

  • memory/1932-23-0x0000000074530000-0x0000000074C1E000-memory.dmp

    Filesize

    6.9MB

  • memory/1932-41-0x00000000009F0000-0x0000000000A3D000-memory.dmp

    Filesize

    308KB

  • memory/1932-83-0x00000000009F0000-0x0000000000A3D000-memory.dmp

    Filesize

    308KB

  • memory/1932-81-0x00000000009F0000-0x0000000000A3D000-memory.dmp

    Filesize

    308KB

  • memory/1932-79-0x00000000009F0000-0x0000000000A3D000-memory.dmp

    Filesize

    308KB

  • memory/1932-59-0x00000000009F0000-0x0000000000A3D000-memory.dmp

    Filesize

    308KB

  • memory/1932-75-0x00000000009F0000-0x0000000000A3D000-memory.dmp

    Filesize

    308KB

  • memory/1932-73-0x00000000009F0000-0x0000000000A3D000-memory.dmp

    Filesize

    308KB

  • memory/1932-71-0x00000000009F0000-0x0000000000A3D000-memory.dmp

    Filesize

    308KB

  • memory/1932-69-0x00000000009F0000-0x0000000000A3D000-memory.dmp

    Filesize

    308KB

  • memory/1932-65-0x00000000009F0000-0x0000000000A3D000-memory.dmp

    Filesize

    308KB

  • memory/1932-1058-0x000000007453E000-0x000000007453F000-memory.dmp

    Filesize

    4KB

  • memory/1932-1057-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

  • memory/1932-61-0x00000000009F0000-0x0000000000A3D000-memory.dmp

    Filesize

    308KB

  • memory/1932-29-0x00000000009F0000-0x0000000000A3D000-memory.dmp

    Filesize

    308KB

  • memory/1932-55-0x00000000009F0000-0x0000000000A3D000-memory.dmp

    Filesize

    308KB

  • memory/1932-53-0x00000000009F0000-0x0000000000A3D000-memory.dmp

    Filesize

    308KB

  • memory/1932-51-0x00000000009F0000-0x0000000000A3D000-memory.dmp

    Filesize

    308KB

  • memory/1932-49-0x00000000009F0000-0x0000000000A3D000-memory.dmp

    Filesize

    308KB

  • memory/1932-47-0x00000000009F0000-0x0000000000A3D000-memory.dmp

    Filesize

    308KB

  • memory/1932-45-0x00000000009F0000-0x0000000000A3D000-memory.dmp

    Filesize

    308KB

  • memory/1932-43-0x00000000009F0000-0x0000000000A3D000-memory.dmp

    Filesize

    308KB

  • memory/1932-39-0x00000000009F0000-0x0000000000A3D000-memory.dmp

    Filesize

    308KB

  • memory/1932-37-0x00000000009F0000-0x0000000000A3D000-memory.dmp

    Filesize

    308KB

  • memory/1932-35-0x00000000009F0000-0x0000000000A3D000-memory.dmp

    Filesize

    308KB

  • memory/1932-67-0x00000000009F0000-0x0000000000A3D000-memory.dmp

    Filesize

    308KB

  • memory/1932-33-0x00000000009F0000-0x0000000000A3D000-memory.dmp

    Filesize

    308KB

  • memory/1932-31-0x00000000009F0000-0x0000000000A3D000-memory.dmp

    Filesize

    308KB

  • memory/1932-57-0x00000000009F0000-0x0000000000A3D000-memory.dmp

    Filesize

    308KB

  • memory/1932-27-0x00000000009F0000-0x0000000000A3D000-memory.dmp

    Filesize

    308KB

  • memory/1932-25-0x00000000009F0000-0x0000000000A3D000-memory.dmp

    Filesize

    308KB

  • memory/1932-24-0x00000000009F0000-0x0000000000A3D000-memory.dmp

    Filesize

    308KB

  • memory/1932-1056-0x0000000074530000-0x0000000074C1E000-memory.dmp

    Filesize

    6.9MB

  • memory/3056-12-0x0000000000690000-0x0000000000694000-memory.dmp

    Filesize

    16KB

  • memory/3056-0-0x00000000012F0000-0x000000000146C000-memory.dmp

    Filesize

    1.5MB

  • memory/3056-17-0x00000000012F0000-0x000000000146C000-memory.dmp

    Filesize

    1.5MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.