Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
21/05/2024, 01:23
General
-
Target
0bf1110ef3290769bf40fcdc73b8df2b5cf509d1d90ebb4781f80b8a6ed1fe5c.exe
-
Size
563KB
-
MD5
6d078aa59c6189f23a10bac510c4a120
-
SHA1
5ca07e80d9b641018bc67da416848ffd106f7a5f
-
SHA256
0bf1110ef3290769bf40fcdc73b8df2b5cf509d1d90ebb4781f80b8a6ed1fe5c
-
SHA512
fbb81274ae3a19a8937d298bf3f14db1a705d6562464540d744967ba5a476004d1e1dc2b462f94a940d03ae58ce27587a753ea072477eb56372aeb67d289ef54
-
SSDEEP
12288:x6X3bMUem352kyOBCqGjm7PH8t2VHiJba7mydO5Ox9Ew8:Q3bMZozywC/g/8t2Vz7myM5OUw8
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6391280536:AAESZ3NYNHmB2sa_7hA_g6U5Mw3cJR9yhiI/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0bf1110ef3290769bf40fcdc73b8df2b5cf509d1d90ebb4781f80b8a6ed1fe5c.exe"C:\Users\Admin\AppData\Local\Temp\0bf1110ef3290769bf40fcdc73b8df2b5cf509d1d90ebb4781f80b8a6ed1fe5c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.9MB
-
Filesize
584KB
-
Filesize
32KB
-
Filesize
104KB
-
Filesize
6.9MB
-
Filesize
376KB
-
Filesize
4KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB