Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
1615274acd75a7b13afe34886165cf97e6f15485b2186c75509fb47d7baa7468
-
Size
788KB
-
Sample
240608-b19cqsgb59
-
MD5
d5c52173b2b47227742614bac91fa160
-
SHA1
852e4c1a66790c2759f2753a5f3636e3c06fa267
-
SHA256
1615274acd75a7b13afe34886165cf97e6f15485b2186c75509fb47d7baa7468
-
SHA512
ef90dfb80f48a66e91419c60045dcdd0e9518b17a7db933514e98efab9f2eb984a7f6a12354d08cf667ee0610f53a31fce947c00faa830d3073f9e4a4c659968
-
SSDEEP
12288:X+UTm7btljWklC4cZDHOohDaFC6j3AVmg0fNsdIrKdRtEQHM:X+RbtMkM4cZLhDaFCU3MsNvrK1EX
Static task
static1
Behavioral task
behavioral1
Sample
1615274acd75a7b13afe34886165cf97e6f15485b2186c75509fb47d7baa7468.exe
Resource
win7-20240221-en
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot7207061695:AAF0n2ptfpKko1R4L1IUb4eqtXbyEcJ2KUU/
Targets
-
-
Target
1615274acd75a7b13afe34886165cf97e6f15485b2186c75509fb47d7baa7468
-
Size
788KB
-
MD5
d5c52173b2b47227742614bac91fa160
-
SHA1
852e4c1a66790c2759f2753a5f3636e3c06fa267
-
SHA256
1615274acd75a7b13afe34886165cf97e6f15485b2186c75509fb47d7baa7468
-
SHA512
ef90dfb80f48a66e91419c60045dcdd0e9518b17a7db933514e98efab9f2eb984a7f6a12354d08cf667ee0610f53a31fce947c00faa830d3073f9e4a4c659968
-
SSDEEP
12288:X+UTm7btljWklC4cZDHOohDaFC6j3AVmg0fNsdIrKdRtEQHM:X+RbtMkM4cZLhDaFCU3MsNvrK1EX
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks for VirtualBox Guest Additions in registry
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
4Virtualization/Sandbox Evasion
2