Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12/06/2024, 01:05
Static task
static1
Behavioral task
behavioral1
Sample
a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe
Resource
win10v2004-20240611-en
General
-
Target
a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe
-
Size
1.2MB
-
MD5
3f02a2516380a49f81ae8e15e7f548cc
-
SHA1
282b7fca5197f2257c91e61e5dbbcfdcab9df9eb
-
SHA256
a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017
-
SHA512
4c2d392b2bf2cd3c1a14a5bd7a2aef9b7d84c46c0c0180979bc21bdc3e9ef4a069c8e97d843a43f0cc984003e176b719a21705f4a98ae74a4e9a521e527997a4
-
SSDEEP
24576:iAHnh+eWsN3skA4RV1Hom2KXMmHaYdQOhQHQVQH8bj5QF5:lh+ZkldoPK8YaYibHP
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2728 set thread context of 2720 2728 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe 32 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2720 RegSvcs.exe 2720 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 2928 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe 2640 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe 2728 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2720 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 2928 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe 2928 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe 2640 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe 2640 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe 2728 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe 2728 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe -
Suspicious use of SendNotifyMessage 6 IoCs
pid Process 2928 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe 2928 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe 2640 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe 2640 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe 2728 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe 2728 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2928 wrote to memory of 2760 2928 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe 28 PID 2928 wrote to memory of 2760 2928 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe 28 PID 2928 wrote to memory of 2760 2928 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe 28 PID 2928 wrote to memory of 2760 2928 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe 28 PID 2928 wrote to memory of 2760 2928 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe 28 PID 2928 wrote to memory of 2760 2928 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe 28 PID 2928 wrote to memory of 2760 2928 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe 28 PID 2928 wrote to memory of 2640 2928 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe 29 PID 2928 wrote to memory of 2640 2928 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe 29 PID 2928 wrote to memory of 2640 2928 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe 29 PID 2928 wrote to memory of 2640 2928 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe 29 PID 2640 wrote to memory of 2712 2640 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe 30 PID 2640 wrote to memory of 2712 2640 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe 30 PID 2640 wrote to memory of 2712 2640 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe 30 PID 2640 wrote to memory of 2712 2640 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe 30 PID 2640 wrote to memory of 2712 2640 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe 30 PID 2640 wrote to memory of 2712 2640 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe 30 PID 2640 wrote to memory of 2712 2640 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe 30 PID 2640 wrote to memory of 2728 2640 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe 31 PID 2640 wrote to memory of 2728 2640 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe 31 PID 2640 wrote to memory of 2728 2640 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe 31 PID 2640 wrote to memory of 2728 2640 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe 31 PID 2728 wrote to memory of 2720 2728 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe 32 PID 2728 wrote to memory of 2720 2728 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe 32 PID 2728 wrote to memory of 2720 2728 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe 32 PID 2728 wrote to memory of 2720 2728 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe 32 PID 2728 wrote to memory of 2720 2728 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe 32 PID 2728 wrote to memory of 2720 2728 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe 32 PID 2728 wrote to memory of 2720 2728 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe 32 PID 2728 wrote to memory of 2720 2728 a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe"C:\Users\Admin\AppData\Local\Temp\a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe"1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe"2⤵PID:2760
-
-
C:\Users\Admin\AppData\Local\Temp\a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe"C:\Users\Admin\AppData\Local\Temp\a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe"2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe"3⤵PID:2712
-
-
C:\Users\Admin\AppData\Local\Temp\a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe"C:\Users\Admin\AppData\Local\Temp\a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2720
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD56a7c2029ecf1dce46416c7fc3fcba355
SHA14dcbdfd1e878c92b7476889873f47f6209c4907f
SHA256398090cda22b48d439d0db3381b912f8d90d00c4df3dc1182194a4b11a1461f3
SHA512c4fdc832b08e4b4ed001c05e77bc586d7f71a3e69d35143739770cae650ca4f3d1d47ee2f6672df8cc9a04cb1ae3097c04b6b3a0c72330b7a7acab453c33d7d3
-
Filesize
28KB
MD53ada8e4b5d2e14594140cc4eece28f46
SHA1012c8e4896652703f01483c9df0be3ce520095f2
SHA2563f66d1eee75d1eeb9856ff140f415519f688785ae3d2ec02bbf618b6095997ba
SHA5121f2b063d3f39eddff78724ccc6bc48366a8f7cbdf06f5d87914492a95250476f29f913ab85d1d103c678409b09d1b1877e03523d6f3010990dd07202af72ba24
-
Filesize
262KB
MD5c3f40d425d3a0ca4b4b41b6caaa0d718
SHA1098602fbfffaa0498747bf00192e62329e17685e
SHA256ef7c97b98f5b48fb212a0644860f18db870283d0e81a99af7103fe40f8b111d9
SHA5129c71fe0c3212e04a8afa02c75e92cf620c645a5f2e75ffed1f17580f2ac6d37e8b9a990ea88061df7aa756719f480dfbf4cd437f7f0f2f593e0a98cd49aefce0